Last updated: September 2024

Privacy Policy

Your privacy matters. Here's exactly what we collect, why, and what we never do with it.

1. What We Collect

  • Account data: Your name, work email, and organisation name when you register.
  • Operational data: Container records, event timelines, client names, tariff configurations, and documents you upload.
  • Usage data: Pages visited, features used, and error logs — for debugging and improving the product.
  • Session data: A secure HTTP-only cookie that keeps you logged in.

2. What We Never Do

  • We do not sell your data to any third party.
  • We do not use your container or client data to train AI models without your explicit consent.
  • We do not share your data with shipping lines, ports, or freight brokers.
  • We do not store plain-text passwords. All passwords are hashed using bcrypt.

3. How We Use Your Data

Your data is used solely to: provide the DemurrageOS service; send you operational alerts and task notifications you configure; send account and security emails (verification, password reset); and improve the platform based on anonymised usage patterns.

4. Data Storage & Security

All data is stored in a PostgreSQL database hosted on a secure cloud provider. Data in transit is encrypted using TLS 1.2+. Session tokens are stored as HTTP-only cookies and are never accessible to JavaScript. We apply role-based access control — your organisation's data is completely isolated from other organisations.

5. Cookies

We use one first-party HTTP-only session cookie to maintain your login state. We do not use advertising cookies or third-party tracking pixels. Usage analytics (if any) are anonymised and aggregated.

6. Data Retention & Deletion

Your data is retained for as long as your account is active. To delete your account and all associated data, email us at hello@demurrageos.app. Deletion is completed within 30 days. Certain audit logs may be retained for up to 90 days per legal requirements.

7. Third-Party Services

We may use the following third-party services: an email delivery provider (e.g. Resend or SendGrid) for transactional emails; error monitoring (Sentry) for crash reporting — only anonymised stack traces are sent. No business data is transmitted to these services.

8. Contact

For any privacy questions or data requests, contact us at hello@demurrageos.app