Privacy notice

The platform is operated for MOL Global Ship Management (Europe) as the reviewing party. [TO CONFIRM] The identity of the data controller, the controller's registered address and the contact point for data protection enquiries.

For each provisioned account the platform stores:

• full name, as supplied when the account is created;
• email address, which is also the sign-in identifier;
• company name, where one is recorded;
• role — marine superintendent, MOL administrator, or vessel operator;
• for vessel operators, the list of vessel names the account is permitted to see (its scope);
• an authentication record held by the platform's authentication service: a hashed password, timestamps for account creation, email confirmation and last sign-in.

Passwords are never stored or visible in readable form, and are not accessible to the application.

The platform records what each named person did during a review. Every one of these records carries the acting user and a timestamp:

• review decisions — accepting, overriding or deferring a finding — together with the comment the reviewer wrote;
• confirmations that a value was checked against its source document;
• clarification questions raised, and the answers given to them;
• changes to the status of a case, with the previous status and any comment;
• documents uploaded, with the original filename and the time of receipt.

Review decisions, clarifications, confirmations and case status changes are append-only. They cannot be edited or deleted through the application by any role, including administrators — the database grants no update or delete permission on those records. A correction is made by recording a further action, so the earlier one remains legible. This is deliberate: the value of the record is that it shows what was known and decided at the time.

Consequently, personal data contained in those records — the reviewer's name and their written comment — is retained for the life of the case record. [TO CONFIRM] The retention period after which case records are archived or destroyed, and the process for handling an erasure request against an audit record.

• Every user can read their own profile.
• Marine superintendents and MOL administrators can read all user profiles, so that decisions can be attributed to a named person in the audit trail.
• Vessel operators cannot read other users' profiles, and cannot see who raised a clarification or who recorded a decision.
• Vessel operators see only cases for the vessels in their own scope. They cannot see other operators' cases or documents.

These limits are enforced in the database, not only in the interface.

Application data, user records and uploaded documents are held in a managed PostgreSQL database and object store provided by Supabase, running on Amazon Web Services infrastructure in the US West (Oregon), us-west-2 region — this is the region of the database host this deployment connects to. [TO CONFIRM] Whether US hosting is acceptable to the client, and whether a data processing agreement and transfer mechanism are required for personal data of users in the EU or UK.

Uploaded case documents are held in a private bucket. They are not publicly addressable and are served only through short-lived signed links generated for an authorised user.

There is no analytics, advertising or marketing tracking in this application. No Google Analytics, no tag manager, no advertising pixel, no session-recording tool, no cookie banner, because there is nothing to consent to beyond the sign-in session itself.

The only cross-service traffic from a signed-in browser is to the Supabase endpoint that serves the database, authentication and document storage.

The code also contains a hook that reports an unhandled interface error to the Lovable development platform, and it only sends anything where that platform has injected its reporter into the page — which is the case in the development preview. [TO CONFIRM] Whether that reporter is also injected on the published site, and if so whether the client accepts it. It can be removed on request.

The browser stores a sign-in session token so that a signed-in user is not asked for a password on every page. It is used for authentication only, is cleared on sign-out, and is not used to profile anyone.

Requests to access, correct or erase personal data should be made to the operator. [TO CONFIRM] The contact address for privacy requests, the supervisory authority the client answers to, and the response time the operator commits to.