Privacy Policy

This policy describes the personal information the DDP Brokerage platform handles, why it is held, and who processes it. It describes the platform as operated on the review date shown above.

What the platform collects

• Access requests. When someone asks for access using the supplier registration form, the platform records the name, email address and telephone number entered on that form.
• Supplier profiles. An onboarded supplier completes a farm profile containing business details — legal and trading name, registered and operational addresses, and registration and tax numbers — together with named contacts, their positions and their contact details.
• Documents and records. Supplier documents such as certificates of analysis, licences and batch photographs are stored against the batch they belong to, along with the batch, stock and pricing information a supplier submits.
• Account information. Accounts are identified by email address. Sign-in, password-reset and invitation handling are performed by our authentication provider.

Why it is held

To operate the review process the platform exists for: to identify who submitted a record, to let reviewers ask a supplier for missing evidence, to keep an audit trail of review decisions, and to prepare review packs for buyers. Supplier information is not sold, and it is not shared for advertising.

Who processes it

The application, its database, its file storage and its authentication run on Supabase, which acts as our hosting and infrastructure processor. The site is served by Vercel. Email we send and receive is handled by our email provider. Staff of DDP Brokerage access records in the course of reviewing them.

How access is restricted

Uploaded documents are held in private storage: they have no public address, and are reached only through short-lived links issued to a signed-in user who is entitled to that record. Database access is restricted per account by row-level security rules enforced by the database itself rather than by the browser, so a signed-out visitor reads nothing. Suppliers see their own records; reviewers see the records they review.

Cookies and tracking

This site runs no third-party analytics, advertising or tracking scripts. Its content security policy allows the browser to execute code only from this site itself, which is what prevents such a script from being added.

When you use this site your browser contacts exactly three places. It requests pages and code from this site. It sends and receives your data — over both ordinary requests and a live connection — with our Supabase project, which is the database and file storage described above. And it requests a stylesheet and typefaces from Google Fonts, which means Google receives your IP address and basic request information each time a page loads. No other outside service is contacted, and no data about you is sent to Google beyond what making that font request necessarily reveals.

If you would rather not make that request to Google, blocking those two addresses in your browser leaves the site fully usable; only the typefaces change.

Browser storage is used in place of tracking cookies. For a visitor who is not signed in, the only thing kept is whether you chose English or Thai. Once you sign in it also holds your session, so you stay signed in between pages, and some operational screens keep working notes — such as a record of which buyer packs have been downloaded — in your own browser.

One case works differently and is worth stating plainly. If this application is run as an offline demonstration, with no database configured, then browser storage IS the database: farm profiles, stock records, review requests and similar entries you type in are held only in your own browser and are never sent anywhere. The hosted service at this address is not run that way — it is configured against the database described above — but anyone running their own copy should know which of the two they are using.

How long records are kept

Supplier records, review decisions and the documents attached to them are retained while the account is active and afterwards where they form part of an audit trail of a decision already taken. To ask how long a specific record will be held, or to ask that a record be corrected or removed, contact us at the address below and we will tell you what applies to it.

Changes to this policy

If the platform changes what it collects or who processes it, this page is updated and the review date above changes with it.