Who is responsible
The controller of the personal data described here is AYBARION SOFTWARE LTD, registered in England and Wales under company number 17473674, registered office 61 Bridge Street, Kington, HR5 3DJ, United Kingdom ("AYBARION", "we", "us"). AYBARION TRADE is our trading name.
| Privacy contact | info@aybarion.com |
| ICO registration number | [pending] |
| EU representative (GDPR Art. 27) | [to be appointed] |
| Data protection officer | We have not appointed one. Please use the privacy contact above. |
We process personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where the EU GDPR applies to you, it applies as well. For people in Türkiye, the information notice required by Law No. 6698 is the KVKK Aydınlatma Metni.
This policy is written in English, and the English version is the binding one. Translations are provided for convenience.
When our member is the controller
Our members are businesses. For personal data that a member puts into the platform about other people, such as its CRM records, its outreach recipient list, message content and documents it uploads, the member decides why and how the data is used and is the controller. We process that data for the member as its processor, under the data processing terms in our Terms of Service. If your data is in such records, please contact that member first.
What we process
This list follows what the platform stores. We do not buy personal data, we do not sell it and we do not build advertising profiles.
| Category | Data | Source |
|---|---|---|
| Access and demo requests | Name, work e-mail, company, website, country, role, team size, product codes, your message, your consent, language, browser type; your network address only as a salted hash | You, through the request form |
| Account | Name, work e-mail address, password (stored only as a scrypt hash), language, time zone, optional job title, phone number and photo, e-mail verification status, whether you asked for product updates, team role | You, or the admin who invited you |
| Sign-in security | Authenticator (MFA) secret, hashed recovery codes, one time e-mail codes, failed sign-in counter and temporary lock; if Google or Microsoft sign-in is offered and you use it: the provider's account identifier and verified e-mail address | You; your sign-in provider |
| Sessions | A hash of the session token, a request forgery token, IP address, shortened browser user agent, sign-in and last activity times | Your browser |
| Security monitoring | Counts of refused or failed requests per network address and hour; a hash of browser type and network range to detect sign-ins from new devices; security alerts | The platform |
| Company | Company name, country, role, plan, website, description, logo, product codes, LEI and the public GLEIF record, registry number, verification status and reviewer notes | You; GLEIF |
| Documents | Files you upload (registry extracts, certificates, contracts, attachments), their checksum, malware scan result and review status | You |
| Marketplace and workflows | Listings, offers, orders, reviews, reports, blocks, saved searches; deal rooms, conversations, negotiation workspaces, private exchanges and trade missions; freight requests, quotes and shipments (with vessel identifiers and positions for booked sea shipments); finance and secured payment workflows; reports, share links and their access log; watchlists, favourites and saved analyses; sanctions screening queries and their results | You and the members you deal with |
| CRM and outreach | CRM accounts and activities (the platform refuses e-mail addresses and phone numbers there); outreach recipients entered by a member (e-mail, name, company, country, lawful basis and evidence), campaigns and delivery events; unsubscribes kept only as a keyed hash of the address | The member; e-mail provider events |
| Billing | Stripe customer and subscription identifiers, plan, status, trial and period dates, invoice numbers, amounts and receipt links. Card details, billing address and tax ID are collected and held by Stripe, not by us | Stripe |
| Team and notifications | Invitations (e-mail, role, who invited, dates); in-app notifications and preferences; the log of e-mails we send (address, subject, text); web push subscriptions (push service address and keys, language) | Your admin; the platform; your browser |
| Developer API and data delivery | API keys (stored hashed), API request log with IP address, webhook endpoints and delivery destinations (their secrets encrypted), usage counters | You |
| Legal records | Which version of the Terms of Service you accepted and of this policy you acknowledged, when, from which IP address and browser | Your browser |
| Audit log | Who did what and when (for example sign-ins, approvals, moderation decisions), with IP address | The platform |
| Questions to AYBİ | The question text, with e-mail addresses and phone numbers removed before it is stored, and your feedback on the answer. Your IP address is used only for rate limiting and is not stored with the question | You |
| E-mails you send us | Your message and contact details in our company mailboxes | You |
| Server logs | Web server access logs with IP address, address requested, time and browser; cookies and authorisation headers are removed from the logs | Your browser |
We do not ask for special category data (such as health or political opinions). Please do not put such data, or personal data you are not allowed to share, into the platform.
Public data about companies and listed persons
- Company directory: built from official company registers and open datasets (listed in the legal notice). It holds legal entities only: name, country, region and city, sector, legal form, status, registry number, LEI, founding year and website. Sole traders and other natural person forms are excluded. We do not store names of directors, owners or contacts, e-mail addresses, phone numbers or street addresses. A company name can still contain a person's name where that is how the company is registered.
- Sanctions lists: to support screening we load the official OFAC, UK and EU sanctions lists. They include names, aliases, countries and programmes of listed persons and entities as published. We keep nothing else from the lists and replace the data whenever a list is refreshed.
- Tenders and research: for EU TED tenders and OpenAlex research results we keep notice and publication metadata only, without contact points, author names or abstracts.
- You can object to the use of data about you or your company, or ask for a correction, at info@aybarion.com. We check the evidence and correct, restrict or remove the record.
Purposes and legal bases
| Purpose | Legal basis (UK GDPR Art. 6) |
|---|---|
| Providing the platform: account, company profile, marketplace, workflows, team, notifications, support, billing | Contract, Art. 6(1)(b); for users acting for a member, our and the member's legitimate interest in running the service the member ordered, Art. 6(1)(f) |
| Answering access and demo requests | Steps before a contract at your request, Art. 6(1)(b), and legitimate interests, Art. 6(1)(f) |
| Security: sign-in protection, MFA, sessions, rate limits, malware scanning, security monitoring, audit log, preventing fraud and abuse | Legitimate interests in a secure service, Art. 6(1)(f) |
| Company verification, moderation of reports, four eyes decisions | Legitimate interests in a trustworthy marketplace, Art. 6(1)(f) |
| Company directory and sanctions list data | Legitimate interests of our members and us in identifying business partners and screening them, Art. 6(1)(f) |
| Keeping accounting and tax records, answering authorities | Legal obligation, Art. 6(1)(c) |
| Establishing, exercising or defending legal claims (for example acceptance records) | Legitimate interests, Art. 6(1)(f) |
| Product update e-mails you asked for; browser push notifications you switched on | Consent, Art. 6(1)(a), which you can withdraw at any time |
| Processing a member's CRM, outreach and message data for that member | The member's legal basis; we act as processor |
Where we rely on legitimate interests, you can object (see "Your rights"). You need to give the account data marked as required to use the platform; without it we cannot provide the service.
We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. Scores are explainable comparisons of trade data, and sanctions screening results always need human review.
Who receives data
Other members see what you publish or share with them (for example listings, offers, messages, deal room documents, or a finance case you agreed to share). Blind listings hide your company until an offer is accepted. Platform operators of AYBARION see what they need for support, verification and moderation. We use these service providers:
| Provider | Purpose | Data | Location |
|---|---|---|---|
| OVHcloud (OVH SAS) | Server hosting the website, API, database and files | All platform data | Roubaix, France |
| Cloudflare, Inc. | DNS for aybarion.com; storage of offsite backups (Cloudflare R2) | DNS: none about you. Backups: all platform data, encrypted on our server before upload, so Cloudflare cannot read it | United States (company); storage region of our R2 bucket |
| Resend, Inc. | Delivery of transactional e-mails (verification codes, password reset, notifications, invitations, access request confirmations) | Recipient address, subject, text | United States |
| Stripe Payments UK Ltd and Stripe group companies | Card payments, subscriptions, invoices and receipts | Company and billing details, card data, payment history | United Kingdom; Stripe group companies including the United States |
| Hostinger | Our company mailboxes | E-mails you send to us and our replies | Hostinger data centres used by our mail plan |
| Web push services of your browser vendor (Google, Mozilla, Microsoft, Apple) | Delivering browser notifications, only if you switch them on | Encrypted message, push address of your device | Global |
| Google / Microsoft | Single sign-on, only if we offer it and you choose it | Sign-in request; we receive your account identifier, name and verified e-mail | Global |
| GLEIF (Global Legal Entity Identifier Foundation) | Checking the LEI your company enters | The LEI only | Switzerland |
| aisstream.io | Live vessel positions for booked sea shipments, only when this feature is switched on | Vessel identifiers (MMSI) only | Online service |
Malware scanning of uploads runs on our own server (ClamAV); no file is sent to a third party for scanning. The AYBİ assistant runs on our own server. When it cannot answer a question, it may use the question text as a search term in public sources such as Wikipedia, Wikidata and the World Bank, so please do not put personal data into questions.
Stripe acts as our processor for some processing and as an independent controller for other processing, such as fraud prevention and its own legal duties; see Stripe's privacy policy. We may also share data with professional advisers, with authorities where the law requires it, and with a buyer of our business, who would have to respect this policy. We do not sell personal data.
International transfers
Our main server is in France. The UK recognises the EEA as giving adequate protection, and the EU recognises the UK. Some providers above process data in other countries, in particular the United States. For those transfers we rely on UK adequacy regulations (including the UK Extension to the EU US Data Privacy Framework where the provider is certified) or on the standard contractual clauses with the UK Addendum, or the UK International Data Transfer Agreement, in the provider's data processing terms. You can ask us for details of the safeguards at info@aybarion.com.
How long we keep data
| Data | Retention |
|---|---|
| Access and demo requests | Deleted automatically after 180 days. A copy of the notification e-mail to our team stays in the e-mail log (see below) and in our mailbox |
| Sessions | Valid for at most 7 days, and ended after 12 hours without activity. The session record (with IP address and browser) is deleted when you sign out, change your password, are removed from the team, when an expired session is used again, or when the account is deleted |
| One time e-mail codes, sign-in challenges, single sign-on state | Valid for 15 minutes, 5 minutes and 10 minutes; deleted when used |
| Team invitations | The link is valid for 7 days; the record stays with the company account |
| Account, company, documents and records you create | As long as the account exists. You can delete documents, listings, saved items and many other records yourself at any time |
| Deleted company account | Completed by a platform operator within 30 days of the owner's request, once open orders and secured payments are settled. Personal data and private records are deleted; completed orders and reviews stay in anonymised form; shared records (for example a conversation with another member) stay for the other party without your personal data |
| Billing records | Our subscription and invoice status records are kept as accounting records (UK law requires at least 6 years). On account deletion we cancel the subscription, delete the Stripe customer and remove receipt links; Stripe keeps payment records as the law requires it to |
| Legal acceptance records | While the account exists and for 10 years after its deletion, as evidence of the contract |
| Outreach (if ever used) | Message log 24 months; unconfirmed opt-in recipients 30 days; e-mail provider events 90 days; unsubscribe and suppression entries as a keyed hash without end date, so the address is never contacted again |
| Developer API request log, webhook delivery log | 30 days; usage counters 400 days |
| Security monitoring counters | 30 days |
| Listing view counters | 2 days |
| Web push subscriptions | Until you switch notifications off, the push service reports the device as gone, after 10 failed deliveries, or on account deletion; queued push messages 7 days |
| Sanctions list data | Replaced when the list is refreshed (checked daily). Your screening history stays until the account is deleted |
| Backups | Daily copies on our server are kept for 14 days. Offsite backups are encrypted before upload; we keep daily copies for 14 days, weekly copies for 8 weeks and monthly copies for 12 months. Deleted data can therefore remain in encrypted backups for up to about 12 months. Backups are used only to restore the service, and if we restore one we repeat the deletions made since |
| Server logs | Rotated automatically by size and overwritten; not archived |
| E-mail log (messages we sent, including verification codes) | Deleted automatically 90 days after sending |
| In-app notifications | Read notifications are deleted automatically after 180 days. All notifications are deleted with the company account, and you can delete them yourself at any time |
| Audit log | Kept for 6 years, then deleted automatically |
| Security alerts | Deleted automatically after 180 days |
| AYBİ questions | No automatic deletion period is set yet. They are kept until we set one, and we will publish the period here |
| E-mails you send to our mailboxes | As long as needed to handle your request and keep our business records |
Security
Passwords are hashed with scrypt; sessions use random tokens of which only a hash is stored; sensitive actions require MFA; every request is checked against the company that owns the record; uploaded files are checked for their real type and scanned for malware; stored delivery secrets are encrypted; moderation and approvals follow a four eyes rule and are logged. Data is encrypted in transit (HTTPS) and offsite backups are encrypted. More on the security page.
Your rights and how to use them
You have the right to access your personal data, to receive a copy in a portable format, to have it corrected or deleted, to restrict its processing, to object to processing based on legitimate interests, and to withdraw consent at any time without affecting earlier processing.
- Copy of your data: Settings › Privacy & data › Download my data gives you your account, company and marketplace records as one file. A member admin can export the company's outreach records on the Outreach page.
- Correction: edit your profile in Settings at any time; an admin can edit the company details.
- Deletion of the company account: the account owner requests it in Settings › Privacy & data.
- Deletion of your own login as a team user: ask your company admin to remove you, then write to us and we delete your login.
- Product update e-mails and other consents: write to us to withdraw. Switch browser notifications off in Settings or in your browser.
- Anything else, including objection and restriction: write to info@aybarion.com. We may ask you to confirm your identity. We answer within one month; for complex requests we may extend this by up to two further months and will tell you why.
You can complain to the UK Information Commissioner's Office (ico.org.uk). If you live or work in the EU, you can also complain to the data protection authority there. We would appreciate the chance to deal with your concern first.
Cookies and browser storage
We set only strictly necessary cookies (the sign-in session and, during Google or Microsoft sign-in, a short lived binding cookie), and keep your display preferences in your browser. We use no analytics, advertising or third party cookies and load no third party scripts in the browser. Details: Cookie Policy.
Business users only
The platform is for businesses and their staff. It is not directed at children, and accounts must not be created for people under 18.
Changes to this policy
The version number and dates at the top of this page change with every update. We tell users about material changes by e-mail to the account owner and in the app before they apply.