1. Who we are
Finlay Hunter, a sole trader trading as Exportly, of an address in Poole, Dorset (full postal address to be published), is the data controller for personal data described here.
Contact: privacy@exportly.uk.
2. What we collect
You give us:
| Data | Why |
|---|---|
| Email address | To create your account and sign you in |
| Name (optional) | To address you properly |
| Organisation name | To label your account |
| Product and shipment details | To generate Route Cards. May include business identifiers such as an EORI or REX number |
| Billing details | Handled by Stripe. We never see or store your card number |
We collect automatically:
| Data | Why | Note |
|---|---|---|
| A hash of your IP address | Rate limiting, abuse prevention, audit records | We store a salted hash, not the address. Rotating the salt breaks correlation with older records by design |
| Sign-in and account events | Security and support | |
| Usage of the service | To operate and improve it |
We do not use advertising cookies, tracking pixels, or third-party analytics that profile you across other websites.
3. Why we may lawfully use it
| Purpose | Lawful basis (UK GDPR Article 6) |
|---|---|
| Providing the service you subscribed to | Performance of a contract |
| Taking payment | Performance of a contract |
| Keeping the service secure, preventing abuse | Legitimate interests |
| Improving the service | Legitimate interests |
| Keeping records we must keep | Legal obligation |
| Sending service emails you have asked for, such as rule alerts | Performance of a contract |
| Sending marketing email | Consent — you may withdraw it at any time |
Where we rely on legitimate interests we have considered whether it is fair to you. You may object — see §9.
4. Route Cards and shared links
A Route Card contains business information, and may contain identifiers such as an EORI number.
If you create a share link, anyone with that link can read that card without signing in. The link expires, you can revoke it at any time, and we record when it is opened. You choose who to send it to; we cannot control what they do with it.
5. How long we keep things
| What | How long |
|---|---|
| Account and organisation records | While your account is open, then 30 days |
| Route Cards and products | While your account is open, then 30 days |
| Billing records | 6 years — required by UK tax law |
| Security and audit records | 12 months |
| Hashed IP addresses | 12 months |
| Backups | Up to 30 days after deletion, then overwritten |
After you close your account you have 30 days to export your data. After that it is deleted, other than records we must keep by law.
6. Who we share it with
We do not sell your data. We do not share it for anyone else's marketing.
We share it with the service providers in §7, who process it on our instructions only, under written terms. We may disclose data where the law requires it — and where we are permitted to tell you, we will.
If we introduce you to a customs broker, we will share only what is needed to make the introduction, and only with your agreement at the time. We do not pass your details to a third party for them to contact you without asking you first.
7. Where your data is processed
| Provider | What for | Where | Safeguard |
|---|---|---|---|
| Supabase | Database, authentication, file storage | EU West (London) | UK/EU processing |
| Vercel | Hosting | EU region where available | Standard contractual clauses where data leaves the UK |
| Upstash | Rate limiting, caching | London | UK processing |
| Stripe | Payments | EU/US | Standard contractual clauses. We never see card details |
| Resend | Transactional email | EU/US | Standard contractual clauses |
| Anthropic | AI classification assistance | US | Standard contractual clauses. Sent only when you use that feature, and never used to train anyone's models |
To be verified against what is actually deployed before publication. The current subprocessor list is maintained in
COSTS.mdandSECURITY.md.
We keep your primary data in the UK and EU. Where a provider processes data outside the UK, we rely on the safeguards above.
8. How we protect it
- Encrypted in transit and at rest
- Row-level database isolation between organisations, enforced by the database itself and proven by an automated test
- Strict access controls; administrative database access is not used to serve ordinary requests
- IP addresses hashed with a rotating salt before storage
- Security headers, origin checking and rate limiting on every request
No system is completely secure. If a breach affects your rights we will tell the ICO within 72 hours where required, and tell you where the risk to you is high.
9. Your rights
You may ask us to: give you a copy of your data; correct it; delete it; restrict how we use it; give you a portable copy; or object to processing based on legitimate interests. Where we rely on consent, you may withdraw it at any time.
Email privacy@exportly.uk. We will respond within one month.
You may complain to the Information Commissioner's Office — ico.org.uk, 0303 123 1113 — though we would prefer the chance to put it right first.
10. Cookies
We use only what the service needs to work:
| Cookie | Purpose | Consent needed |
|---|---|---|
| Authentication | Keeps you signed in | No — strictly necessary |
| CSRF protection | Security | No — strictly necessary |
We use no advertising or third-party tracking cookies, which is why you are not asked to accept anything.
11. Children
The service is for businesses and is not directed at anyone under 18. We do not knowingly collect children's data.
12. ICO registration
Exportly is registered with the Information Commissioner's Office under registration number ZC234999.
Most UK organisations processing personal data must pay the ICO data protection fee. There is a self-assessment at ico.org.uk. Complete this before taking on users.
13. Changes
We will post any change here and, where material, tell you by email at least 30 days beforehand.
Exportly is a trading name of Finlay Hunter, a sole trader established in the United Kingdom. an address in Poole, Dorset (full postal address to be published).