CelioShip

Privacy Policy

Standard template supplied with the application. The company operating this CelioShip instance is the data controller and should complete the fields in brackets and review this policy with legal counsel.

1. Who we are

[Provider legal name], [address] (“we”), operates CelioShip and is the controller of the personal data described here. For the shipment data your company enters, your company is the controller and we act on its instructions as processor. Contact: [contact e-mail].

2. Data we process

  • Account data: name, username, e-mail address, WhatsApp number (optional), language, role, permissions, company, time zone.
  • Security data: sign-in times, IP address, device description, failed attempts and lockouts, two-factor status (the authenticator secret is stored encrypted), audit trail of actions.
  • Shipment data entered by your company: files, containers, suppliers, clients, consignees, forwarders and their contacts, documents and pictures uploaded, costs, charges, payments and invoices.
  • Billing data: plan, subscription status, billing e-mail; card details are handled by our payment processor and never reach our servers.
  • Technical data: server logs and error reports needed to keep the Service running.

3. Why and on what basis

  • To provide the Service and perform the contract with your company: accounts, shipment records, alerts, reports, billing.
  • To keep the Service secure and prevent abuse (legitimate interest): lockouts, new-device alerts, audit trail, rate limits.
  • To send service e-mails you or your company requested: confirmations, invitations, password resets, deadline reminders, subscription notices.
  • To comply with legal obligations, for example accounting records.

4. Who else processes your data

We use established providers under contract: Supabase (database, file storage and authentication), Vercel (application hosting), Resend (transactional e-mail) and Stripe (payments). Data is hosted in [region]; where a provider processes data outside your country, transfers rely on the safeguards those providers offer (standard contractual clauses or an adequacy decision). We do not sell personal data and do not use it for advertising.

5. How long we keep it

Account and shipment data are kept for as long as your company’s workspace exists and for 30 days after it ends, then deleted from live systems and from backups in their normal rotation. Audit and security logs are kept for [24] months. Billing records are kept as long as accounting law requires.

6. Security

Data travels encrypted (TLS) and is stored on encrypted infrastructure. Credentials are hashed by the authentication provider and never shown in clear; authenticator secrets and access codes are encrypted at rest. Each company’s rows are separated at the database level. Two-factor sign-in is available to every account and can be made mandatory by your company. Every sensitive action is recorded in an audit trail your administrators can consult.

7. Your rights

You may ask for access to, correction or deletion of your personal data, object to or restrict certain processing, and receive your data in a portable form. Administrators can export the company’s complete data at any time. Requests go to [contact e-mail]; you may also complain to your data-protection authority.

8. Cookies

The Service uses only the cookies needed to operate it. No advertising or third-party tracking cookies are set.

  • its_session — Keeps you signed in (15 days at most, ends after inactivity).
  • its_remember — Set when you tick “Keep me signed in”: longer inactivity window.
  • its_device — Identifies this browser for sign-in protection (lockouts, new-device alerts).
  • its_locale — Remembers your language.
  • its_2fa — Five-minute token between the password and the authenticator code.
  • its_view_company — Super Admin only: the company currently viewed.

9. Changes

We may update this policy; material changes are announced to administrators before they take effect. Last updated: 2026-09-12.