Privacy Policy

1. Information we collect

• Account details: your name, company or station name, role (buyer or seller), country, email address, phone or WhatsApp number, postal address if you add one (P.O. Box or street, town or city, region, postal code), and password (stored only in encrypted, hashed form by our login provider).
• Profile and listings: your profile photo and description, licence or registration number if you add one, the lots and photos you list, requests you post, and offers you send or receive, including prices, volumes, terms and the final value of completed deals.
• Messages: the messages you exchange with other members about a deal.
• Ratings: the stars and comments you give and receive. They are shown publicly with your company name once both sides have rated, or after 14 days.
• Reports: reports you send us about suspicious listings, members or deals. Only our team sees them.
• Preferences: your language, units and display currency, stored in your browser.
• Technical data: basic logs our hosting and database providers keep automatically, such as IP address, browser type and time of access, used for security and to keep the site running.

We do not use advertising trackers or sell your data. The site stores a sign-in token in your browser so you stay logged in; it does not use marketing cookies.

2. How we use it

• To run your account and show your listings, requests and offers (needed to provide the service you signed up for).
• To share contact details between two members once an offer is accepted (needed to complete the deal).
• To verify members, prevent fraud and keep the site secure, including reviewing reports and suspending accounts that break the Terms (our legitimate interest in a safe marketplace).
• To invoice fees and keep business records, when fees apply (legal and contractual obligations).
• To send service emails: confirming your address, password resets, notice of changes to fees or terms, and notifications about your deals (new offers, replies, messages, and new lots that match your requests).

3. Who can see your information

• Everyone, including visitors: your name, company, role, country, profile photo and description, verification status, your listings and requests, and your ratings once they are revealed.
• Only you and the other party: offers, deals and the messages about them.
• Only after an offer is accepted: your email and phone number, shared with that deal's other party.
• Our administrators: all of the above, to run and protect the site.

4. Legal bases (EU/EEA, UK and similar laws)

Where a law such as the EU or UK GDPR asks for a legal basis, we rely on: contract (running your account, showing your listings and offers, sharing contact details after an accepted offer); legitimate interests (keeping the marketplace safe, preventing fraud and spam, verifying members, fixing problems and improving the site, which we balance against your rights); legal obligation (accounting, tax and responding to lawful requests); and consent where we ask for it, which you can withdraw at any time.

5. Service providers (processors)

We use these providers to run the site. They process personal data only on our instructions and under their data-processing terms:

• Supabase – database, login and photo storage.
• Netlify – website hosting and delivery.
• Cloudflare Turnstile – a check that stops automated sign-ups and log-ins; it processes your IP address and browser details.
• ImprovMX – forwards emails sent to our support address.
• Resend – sends service emails such as sign-up confirmations, password resets and deal notifications.
• Google Fonts – serves the site's fonts, so your browser connects to Google and shares your IP address.

If you choose to see prices in another currency, your browser fetches public exchange rates from ExchangeRate-API; no personal data is sent. If you contact us on WhatsApp, WhatsApp (Meta) processes that conversation under its own privacy policy. We may disclose information if the law requires it, to protect members from fraud, or as part of a sale or reorganisation of the site, in which case this policy continues to apply.

6. International transfers

Parchment Exchange is used worldwide and our providers operate in several countries, including the United States, so your information may be stored or accessed outside your country. Where the law requires it (for example for data leaving the EU/EEA, the UK, Switzerland, Brazil, Kenya, South Africa or Nigeria), we rely on the European Commission's standard contractual clauses and the UK addendum, adequacy decisions or frameworks where available, or other safeguards the law allows. You can ask us for more information about these safeguards.

7. How long we keep it

• Account, profile, listings, offers, messages and ratings: while your account is open. If you close your account we delete or anonymise them within 90 days. Ratings you gave others may stay visible without your name.
• Reports and records of suspended accounts: up to 3 years, to prevent repeat fraud.
• Support emails and WhatsApp messages: up to 2 years after the conversation ends.
• Invoices and accounting records: as long as tax law requires, usually 5 to 7 years.
• Technical logs: for the limited period each provider keeps them for security.

8. Your rights, wherever you live

Everyone can ask us to access their data, correct it, delete it, get a copy in a portable format, and object to or restrict some uses. You can edit most details yourself, and under Dashboard → Profile you can download your data or delete your account. For anything else, email support@coffeeparchment.coffee. We reply within 30 days (or sooner where your law requires), may need to confirm your identity, and will not treat you differently for using your rights. Depending on where you live, you also have these rights:

• EU/EEA and UK (GDPR and UK GDPR): access, rectification, erasure, restriction, data portability, the right to object (including to processing based on legitimate interests), and to withdraw consent. You can complain to your local data protection authority or, in the UK, the Information Commissioner's Office (ICO).
• California (CCPA/CPRA) and other US states with privacy laws: the right to know what we collect and why, to delete, to correct, and to not be discriminated against. We do not sell or share your personal information for cross-context behavioural advertising, and we do not use sensitive personal information for purposes that require an opt-out. You may use an authorised agent.
• Brazil (LGPD): confirmation of processing, access, correction, anonymisation or deletion, portability, information about sharing, and withdrawal of consent. You can complain to the ANPD.
• Kenya (Data Protection Act, 2019): to be informed, access, object, correction and deletion. You can complain to the Office of the Data Protection Commissioner.
• South Africa (POPIA): access, correction, deletion and objection. You can complain to the Information Regulator.
• Nigeria (Nigeria Data Protection Act, 2023): access, correction, deletion, portability, objection and withdrawal of consent. You can complain to the Nigeria Data Protection Commission.
• India (Digital Personal Data Protection Act, 2023): access to a summary of your data, correction, completion, erasure, grievance redressal and nominating another person to act for you. You can escalate to the Data Protection Board of India once its procedures apply.
• Canada (PIPEDA and provincial laws such as Quebec's): access and correction, and withdrawal of consent. You can complain to the Office of the Privacy Commissioner of Canada or your provincial commissioner.
• All other countries: we give everyone the rights above as a minimum, and we respect any additional rights your local data protection law gives you. You can also complain to the data protection authority in your country.

9. Security

Data is sent over encrypted connections, passwords are hashed, and database rules limit each member to the data they are allowed to see. No system is perfectly secure, so use a strong password that you don't use elsewhere.

10. No users under 18

Parchment Exchange is for businesses and adults. You must be 18 or older to use it. We do not knowingly collect information from anyone under 18, and we delete it if we learn we have.

11. Changes

We may update this policy. We will post the new version here with a new effective date and tell members by email about important changes.

12. Contact

For privacy questions or to use your rights: Parchment Exchange · support@coffeeparchment.coffee · WhatsApp +1 309 290 4001. The English version of this policy prevails over any translation.