Privacy Policy

Commodity Plus operates verified commodity trade infrastructure for African origins. This policy describes the personal data the platform actually holds, the third parties that process it on our behalf, and what you can do about it.

Commodity Plus is a trading name of 247 CARGO EXPORT LTD, a company registered in England and Wales under company number 14184905, whose registered office is at 1st Floor North Westgate House, Harlow, Essex, CM20 1YS, United Kingdom.

That company is the data controller for the personal data described here, and the address above is where you can write to us about it — the one exception being farmer records, where the supplier who entered them is the controller and we act as processor. See below.

Data we hold about you

Account and identity

Your email address and a hashed password (or a passwordless sign-in token), held by our authentication provider; session records; and the profile you fill in — name, display name, phone, country, city, language, timezone, job title, and biography. Where you belong to an organisation we record that membership and your role in it.

Verification and compliance

Your KYC status and any identity or corporate documents submitted for review, business registration numbers, and the compliance certificates you upload — the certificate itself, its issuing body, and its expiry date. Certificate and evidence files are held in private storage that is not publicly readable.

Business and commercial records

Supplier, buyer, and processor profiles, including commodity coverage, capacity, incoterms, and contact details. Demand requests, the offers made against them, orders, contracts, fulfilment milestones, disputes, warehouse receipts, and finance applications.

Location data

Farm plot boundaries and centre points, recorded as precise coordinates, together with the accuracy of the reading and who captured it. Mine site locations. Supplier and farmer locations where provided. This data exists to support deforestation-free and due-diligence claims and is precise by necessity.

Farmer records

Suppliers can enrol the farmers behind their supply, recording name, phone number, region, village, crops, farm size, and location. These are records about people who are usually not platform users and have no account here.

For this data the supplier is the controller and Commodity Plus is a processor. The supplier is responsible for having a lawful basis to record it and for telling those farmers it exists. If you are a farmer and want to know what is held about you, contact the supplier who enrolled you, or write to us and we will route the request.

Communications

Messages and attachments you send through the platform. For email we keep the recipient address, the rendered message, delivery status, the provider's message id, and any bounce or spam-complaint report — the last so we stop mailing an address that has rejected us. We also keep your per-category email preferences.

Advisory bookings

If you book a compliance call: the contact name and number you give us, your preferred times, what you asked for help with, a snapshot of your readiness score at the time of booking, and our notes on the outcome.

Learning and audit

Academy enrolments, quiz results, and certificates earned. Platform staff actions that affect your records — verification decisions, role grants, suspensions — are written to an immutable audit log recording who acted, when, and what changed.

How we use it

• To authenticate you and decide what you are allowed to do.
• To match supplier capability against buyer demand and surface relevant requests.
• To send notifications tied to your activity — see email preferences below.
• To review verification submissions and support compliance claims.
• To detect abuse, fraud, and sanctions breaches.

Verification decisions are made by a person, not automatically. The platform computes readiness and flags gaps, but approval, rejection, and suspension are all human decisions, and you can ask for the reason.

Who else processes your data

The platform runs on infrastructure operated by others. Each of these processes personal data on our behalf:

• Supabase — database, authentication, and file storage. Effectively all data described above.
• Vercel — application hosting, plus the page-view analytics described below.
• Cloudflare — runs the scheduled job that sends our email. It handles recipient addresses and message contents in transit.
• Resend — email delivery, and the bounce and complaint reports that come back.
• FAO / OpenForis (WHISP) — deforestation analysis. When a plot is checked, its boundary geometry is sent to this service. No name, contact detail, or business identity is sent with it.

Some pages also load assets directly from third parties, which means your browser contacts them and they can see your IP address: map tiles from OpenStreetMap and map assets from unpkg on pages showing plots, and YouTube where an Academy lesson embeds a video. YouTube may set its own cookies.

We do not sell personal data and do not share it for advertising.

Analytics

We use Vercel Web Analytics to count page views. It sets no cookies and builds no cross-site profile. Visitors are identified by a hash derived from the request, which is discarded after 24 hours. Each page view records the time, the page, the referrer, an approximate location (country, region, city), and the browser, operating system, and device type.

Because our URLs contain organisation names and record identifiers, we rewrite them in your browser before anything is sent: the tenant is replaced with [tenant], record identifiers with [id], unsubscribe tokens with [token], and query strings are dropped entirely. What reaches the analytics provider is the shape of the page, not which record you looked at.

Who can see what

Access is enforced at the database level, per row, not merely hidden in the interface. Your organisation's data is readable by your organisation. A buyer and a supplier engaged on the same request see each other's business profile and the terms exchanged. Directory entries and published profiles are public by design. Platform staff with a review role can see verification material; those actions are audited.

Retention

Account, business, and transaction records are kept for as long as the account is active and afterwards where we need them for tax, accounting, sanctions, or dispute purposes. Verification documents are kept for the life of the verification and its audit trail. Sent-email records are kept for delivery troubleshooting; suppression records for bounced addresses are kept indefinitely, because forgetting them would mean mailing a dead address again. Analytics data is aggregate and holds no identifier to delete.

Your choices and rights

• Review and change your profile in account settings.
• Choose which emails you receive in email preferences, or use the unsubscribe link in any email — no sign-in needed. Verification and advisory emails cannot be switched off while your account is active, because they tell you about things that stop you trading.
• Request a copy of your data, correction, or deletion by email. We respond within 30 days unless a legal or regulatory hold applies, and will tell you if one does.

Contact

Email privacy@commodity.plus. If you believe we have handled your data wrongly you can also complain to your local data protection authority.