Privacy Policy

Ebbrate is operated by Sellernova Limited, a company registered in the Republic of Cyprus. We are the controller of the personal data described here.

For anything about your data, write to admin@ebbrate.com.

We collect what you give us and a small amount that using the site produces:

• Your account: name, email address, company name, the role you signed up for, and your password, which we store only as a one-way hash.
• Verification documents: company registration, proof of address, photo ID, licences and insurance certificates, with the dates they expire.
• Shipments: pickup and delivery addresses, the contacts at each end, cargo details, customs details such as the importer of record, Amazon shipment references, and the documents you upload.
• What you do on the marketplace: bids, awards, messages on a shipment, reviews, claims and their outcomes.
• Technical data: IP addresses and sign-in attempts, kept to protect accounts from guessing, and the session that keeps you signed in.

To run the marketplace you signed up for: to post shipments, take bids, award them, pass contacts to the carrier who won and settle what is owed. This is necessary to perform our contract with you.

To meet legal duties: we check companies and people against the US Consolidated Screening List, which combines the sanctions and export-control lists of OFAC, the Bureau of Industry and Security and the State Department, and we keep records that accounting and tax law require.

For legitimate interests: keeping accounts secure, preventing fraud, resolving claims between the two sides of a shipment, and sending emails about your shipments and bids. You can turn most notification emails off from any of them.

We do not sell personal data and do not use it for advertising.

The other side of your shipment. Carriers bidding on a shipment see the cargo, the route and the dates. Your contact details go only to the carrier you award it to. A seller sees the profile, record and reviews of the carriers who bid.

Members of your company’s team on Ebbrate, if you invite any.

Our administrators, when reviewing verification documents, screening results or a claim. Messages on a shipment are read by an administrator only if a claim is filed.

Services that run parts of the site for us, under contracts that limit them to that work:

• OVHcloud hosts our servers and database.
• Postmark (ActiveCampaign) delivers our emails.
• Google, if you choose to sign in with Google: we receive your email address and Google’s confirmation that you own it, never your Google password.
• Google Cloud Translation, when you or the other side choose “Translate” under a message: the text of that message is sent to Google and the translation is kept with it.

Postmark and Google may process data in the United States. Where they do, the transfer relies on the EU–US Data Privacy Framework or on the European Commission’s standard contractual clauses.

Your account data is kept while your account is open.

When an account is erased, everything that identifies the person is deleted or blanked. The record of what was shipped, for how much and what happened to it stays, because it is also the other party’s record and because accounting and tax law require it. An account cannot be erased while it still has a shipment in transit, an open claim or money not yet settled.

Verification documents are kept while your verification is valid and for as long as we need them to show the check was made. Expired sign-in sessions are deleted automatically.

Under the GDPR you may ask for a copy of your data, have it corrected, have it erased, restrict or object to how we use it, and receive it in a portable format. Write to admin@ebbrate.com; we answer within one month.

You can also complain to the Commissioner for Personal Data Protection in Cyprus (dataprotection.gov.cy), or to the authority where you live.

We use no advertising or analytics cookies. To keep you signed in, the site stores a session token in your browser’s local storage, and removes it when you sign out.

If sign-in with Google is shown on the sign-in page, that page loads a script from Google, which may set Google’s own cookies under Google’s privacy policy.

The site is served only over HTTPS. Uploaded documents are stored encrypted, and passwords are stored only as hashes. Repeated failed sign-ins are slowed down and then blocked.

Ebbrate is for businesses and is not meant for anyone under 18.

When we change this policy we update the date at the top. If a change affects how we use data you have already given us, we tell you by email before it applies.