Privacy notice

Supercargo is a trading name of JG Core Ltd, a company registered in England & Wales under number 16218779, registered office C/O Burton Varley Ltd, The Counting House, 24 Richmond Road, Bowdon, Altrincham, WA14 2TT, England.

For any privacy question, email contact@getsupercargo.com. We do not have a statutory Data Protection Officer — we are not required to appoint one — so that address reaches the person who actually decides these things.

We handle personal data in two distinct capacities, and your rights differ between them.

As CONTROLLER: for data about our own customers, the people who contact us, visitors to this site, and businesses we approach about Supercargo. We decide why and how that data is used, so you exercise your rights directly against us.

As PROCESSOR: for personal data that happens to sit inside documents a customer uploads — a name on a commercial invoice, a signatory on a customs entry, a contact at a supplier. We handle that only on the customer’s instructions. If you are that person, the customer is the controller and your rights are exercised against them; tell us and we will pass it on promptly.

Account and billing data — name, business email, company, billing address, and payment records. Basis: performance of a contract. Retained for the life of the account plus six years, because HMRC requires business records to be kept for six years.

Correspondence — what you send us and our replies. Basis: legitimate interests in answering and in keeping a record. Retained three years.

Site analytics — see section 6. Basis: legitimate interests in understanding whether the site works.

Prospect data for business development — business contact details of companies we think Supercargo suits. Basis: legitimate interests, assessed and documented. See section 11.

When you connect a marketplace account we retrieve commercial data — units sold, fees, advertising spend, inventory positions, inbound shipments and financial transactions.

We request only non-restricted permissions. We do not receive your customers’ names, addresses, or contact details, and we never call the operations that return them. This is not a policy we could quietly change: the marketplace does not grant us the permission, and the consent screen you approve enumerates exactly what we asked for.

Raw marketplace-derived data is retained for 18 months, the ceiling set by the marketplace operator’s data protection policy. Derived month-level aggregates are kept for 36 months where necessary for forecasting. You can revoke our access at any time, directly with the marketplace, without telling us.

Commercial invoices, customs entries, packing lists and purchase orders may contain names — a signatory, a broker, a supplier contact. We process these solely to extract the commercial figures the product needs, acting as your processor.

Please send only what is needed and redact what is not. Where an automated extraction step uses a third-party language model, that provider is a subprocessor under contract, and the content is not used to train their models.

This site sets no advertising cookies and runs no cross-site tracking.

We log each page request server-side — the requested path, the user-agent, the referrer, and a coarse country derived from the connection. This is aggregated daily into counts by visitor type and is not used to build a profile of an individual. It is how we distinguish human visitors from search engines and AI crawlers, which a client-side script cannot do because crawlers do not run JavaScript.

We also use Google Analytics 4, which sets cookies on your device and is therefore non-essential storage requiring your prior consent under PECR. It is switched OFF until you allow it: consent defaults to denied under Google Consent Mode v2, so before you choose, GA4 receives only cookieless pings and stores nothing on your device. Your choice is recorded in a single `cookie_consent` cookie and you can change it at any time from this page. IP anonymisation is on.

Hetzner (hosting, Germany), Vercel (this marketing site; no customer data), Stripe (payments — we never see a card number), Resend (transactional email), Cloudflare (network), and a language-model provider for document extraction. Each is under a contract that restricts them to processing on our instructions.

We do not sell personal data, and we do not share it with advertisers or data brokers. We may disclose where legally required, and will tell you unless prohibited.

Application and database hosting is in the EU. Where a subprocessor processes data outside the UK, the transfer relies on UK adequacy regulations or on the International Data Transfer Addendum to the EU Standard Contractual Clauses.

Each customer has a separate database, a separate database role and a separate AES-256-GCM encryption key wrapped by a master key held apart from the data. There is no shared table and no tenant identifier column to get wrong. TLS 1.2 or better in transit. Administrative access requires multi-factor authentication. The database is not reachable from the public internet.

What we do not claim: we hold no SOC 2 report and have not undergone a third-party penetration test. Production access sits with one named person. We would rather state that plainly than imply an assurance programme we do not run. The security page describes the controls in full.

Where we are controller you have the right to be informed; of access; to rectification; to erasure; to restrict processing; to data portability; to object — including an absolute right to object to direct marketing; and rights relating to automated decision-making. We make no automated decisions producing legal or similarly significant effects.

Email contact@getsupercargo.com. We respond within one month. There is no charge unless a request is manifestly unfounded or excessive. We may ask you to confirm your identity.

You are entitled to know how we got your details. We build prospect lists from public sources: the Companies House register, published import manifest records, trademark registers, and company websites. We do not buy consumer lists and we do not scrape personal social media profiles.

Our lawful basis is legitimate interests — offering a relevant business product to a business likely to need it. We have carried out and documented a legitimate interests assessment weighing that against your rights, and we will send it to you on request.

We contact registered companies and limited liability partnerships only. We do not cold-email sole traders or ordinary partnerships, because the corporate-subscriber exemption in the Privacy and Electronic Communications Regulations does not cover them.

To stop, use the unsubscribe link in any message or reply asking us to stop — either works, and both are immediate. To have your details erased entirely rather than suppressed, say so and we will do that instead. Email contact@getsupercargo.com.

If you are unhappy with how we have handled your data, please tell us first — we would rather fix it. You can also complain to the Information Commissioner’s Office at ico.org.uk, on 0303 123 1113, or at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Complaining to us first does not affect that right.

We will update this notice as the product changes. The current version and its date are always at this address. Where a change materially affects how we use personal data about you, we will tell you directly rather than relying on you to notice.