Privacy notice

Supercargo is a trading name of JG Core Ltd, a company registered in England & Wales under number 16218779, registered office C/O Burton Varley Ltd, The Counting House, 24 Richmond Road, Bowdon, Altrincham, WA14 2TT, England. We are registered with the Information Commissioner’s Office as a data controller, registration number ZC079115.

For any privacy question, email contact@getsupercargo.com. We do not have a statutory Data Protection Officer (we are not required to appoint one), so that address reaches the person who actually decides these things.

We handle personal data in two distinct capacities, and your rights differ between them.

As CONTROLLER: for data about our own customers, the people who contact us, visitors to this site, and businesses we approach about Supercargo. We decide why and how that data is used, so you exercise your rights directly against us.

As PROCESSOR: for personal data that happens to sit inside documents a customer uploads: a name on a commercial invoice, a signatory on a customs entry, a contact at a supplier. We handle that only on the customer’s instructions. If you are that person, the customer is the controller and your rights are exercised against them; tell us and we will pass it on promptly.

Account and billing data: name, business email, company, billing address, and payment records. Basis: performance of a contract. Retained for the life of the account plus six years, because HMRC requires business records to be kept for six years.

Purchase records for digital products: when you ticked the immediate-access box and the wording you saw, the IP address and browser it was ticked from, when the download link was emailed, and each download (time, IP address, browser, size). Kept with the payment at Stripe, our payment processor. Basis: legitimate interests in answering payment disputes and preventing fraud. Kept with the payment record for the same six years as billing data, and used for nothing else.

Correspondence: what you send us and our replies. Basis: legitimate interests in answering and in keeping a record. Retained three years.

Site analytics: see section 6. Basis: legitimate interests in understanding whether the site works.

Prospect data for business development: the name, business email and role of a named person at a company we think Supercargo suits, the company’s public details, and a record of what we sent and any reply. Basis: legitimate interests, assessed and documented. Kept for up to 24 months from collection, or until you object; if you object we keep only a one-way code of your address so we never contact you again. See section 11.

When you connect a marketplace account we retrieve commercial data: units sold, fees, advertising spend, inventory positions, inbound shipments and financial transactions.

We request only non-restricted permissions. We do not receive your customers’ names, addresses, or contact details, and we never call the operations that return them. This is not a policy we could quietly change: the marketplace does not grant us the permission, and the consent screen you approve enumerates exactly what we asked for.

Raw marketplace-derived data is retained for 18 months, the ceiling set by the marketplace operator’s data protection policy. Derived month-level aggregates are kept for 36 months where necessary for forecasting. You can revoke our access at any time, directly with the marketplace, without telling us.

Commercial invoices, customs entries, packing lists and purchase orders may contain names: a signatory, a broker, a supplier contact. We process these solely to extract the commercial figures the product needs, acting as your processor.

Please send only what is needed and redact what is not. Where an automated extraction step uses a third-party language model, that provider is a subprocessor under contract, and the content is not used to train their models.

This site sets no advertising cookies and runs no cross-site tracking.

We log each page request server-side: the requested path, the user-agent, the referrer, and a coarse country derived from the connection. This is aggregated daily into counts by visitor type and is not used to build a profile of an individual. It is how we distinguish human visitors from search engines and AI crawlers, which a client-side script cannot do because crawlers do not run JavaScript.

We count visits without cookies: a small script from JG Core Ltd (jgcore.com) records the page, the referring site, whether you allowed analytics cookies, and a daily-rotated, irreversible code so a visit isn’t counted twice. Nothing is stored on your device. Lawful basis: legitimate interests. Your browser’s Global Privacy Control or Do Not Track setting turns it off.

We also use Google Analytics 4, which sets cookies on your device and is therefore non-essential storage requiring your prior consent under PECR. It is not loaded at all until you allow it: no Google script runs, and nothing is sent to Google, unless you choose "Allow". Your choice is recorded in a single `cookie_consent` cookie (essential: it remembers your choice for a year) and you can change it at any time from this page. IP anonymisation is on.

The full list of cookies this site sets: `cookie_consent` (your choice, 1 year, essential); `cs-cc` (your country, 30 days, used only to show prices in your currency, essential); `cs-currency` in local storage, only if you pick a currency yourself; `jg_ft` in session storage (the page your visit started on and its utm_source, added to your order if you buy; cleared when the tab closes), only if you allow analytics; `jg_consent` (records the same choice for the JG Core partner programme, 6 months, essential); and, only if you allow them, Google Analytics’ `_ga` and `_ga_*` (up to 2 years) and `aff_ref` (credits the partner who referred you if you buy within 60 days, 90 for the audit). Checkout happens on Stripe’s own pages under Stripe’s cookie policy.

Hetzner (hosting, Germany, including our prospect database), Vercel (this marketing site), Stripe (payments; we never see a card number), Amazon Web Services (email delivery, SES, London region) with Resend as a backup, MillionVerifier (checks that a business email address exists before we write to it; the address only), Cloudflare (network), and a language-model provider for document extraction. Each is under a contract that restricts them to processing on our instructions.

We do not sell personal data, and we do not share it with advertisers or data brokers. We may disclose where legally required, and will tell you unless prohibited.

Application and database hosting is in the EU. Where a subprocessor processes data outside the UK, the transfer relies on UK adequacy regulations or on the International Data Transfer Addendum to the EU Standard Contractual Clauses.

Each customer has a separate database, a separate database role and a separate AES-256-GCM encryption key wrapped by a master key held apart from the data. There is no shared table and no tenant identifier column to get wrong. TLS 1.2 or better in transit. Administrative access requires multi-factor authentication. The database is not reachable from the public internet.

What we do not claim: we hold no SOC 2 report and have not undergone a third-party penetration test. Production access sits with one named person. We would rather state that plainly than imply an assurance programme we do not run. The security page describes the controls in full.

Where we are controller you have the right to be informed; of access; to rectification; to erasure; to restrict processing; to data portability; to object, including an absolute right to object to direct marketing; and rights relating to automated decision-making. We make no automated decisions producing legal or similarly significant effects.

Email contact@getsupercargo.com. We respond within one month. There is no charge unless a request is manifestly unfounded or excessive. We may ask you to confirm your identity.

You are entitled to know how we got your details. We write to businesses in the United States that import goods, about refunds of US import duty. We find them in public, openly licensed sources: OpenStreetMap (© OpenStreetMap contributors, Open Database Licence), state business registers such as Florida’s Division of Corporations, the company’s own website, and, for a small number of companies, public US Customs import records looked up by hand. The named contact and their business email come from the company’s own website. We do not buy lists, we do not use Google Maps data, and we do not scrape personal social media profiles.

Our lawful basis is legitimate interests: offering a relevant business service to a business likely to need it. We have carried out and documented a legitimate interests assessment weighing that against your rights, and we will send it to you on request.

We write only to business addresses about a business matter, one company at a time, and never more than once in 180 days to the same person. Every email says who we are, gives our postal address and a working opt-out, and says we are not affiliated with US Customs and Border Protection, as the US CAN-SPAM Act requires. In the UK we contact registered companies and limited liability partnerships only, because the corporate-subscriber exemption in the Privacy and Electronic Communications Regulations does not cover sole traders or ordinary partnerships.

To stop, use the unsubscribe link in any message or reply asking us to stop; either works, and both are immediate. To have your details erased entirely rather than suppressed, say so and we will do that instead. Email contact@getsupercargo.com.

If you are unhappy with how we have handled your data, please tell us first; we would rather fix it. You can also complain to the Information Commissioner’s Office at ico.org.uk, on 0303 123 1113, or at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Complaining to us first does not affect that right.

We will update this notice as the product changes. The current version and its date are always at this address. Where a change materially affects how we use personal data about you, we will tell you directly rather than relying on you to notice.