Legal
Privacy Policy
Last updated: 3 October 2026
The short version
- We collect what we need to run your account and your container orders, and nothing to sell. We never sell personal data.
- The factory you order from sees your order and the company details you give for it, because it has to fulfil the order.
- Usage analytics and third-party maps only run if you allow them. Everything else is strictly necessary.
- You can see, correct, export or delete your data. Email hello@ceramify.io.
This policy explains how Ceramify ("Ceramify", "we", "us") handles personal data when you visit ceramify.io or use the Ceramify platform for ordering containers of pottery (the "Service"). It is written to meet the EU General Data Protection Regulation (GDPR).
1. Who is responsible for your data
Ceramify is the controller of the personal data described here. You can reach us about anything in this policy at hello@ceramify.io. We have not appointed a data protection officer, as we are not required to; privacy questions go to the same address.
When you order from a factory through Ceramify, that factory also receives the data it needs to fulfil your order (see section 5). It uses that data as a separate controller, under its own responsibility.
2. What we collect
Data you give us
- Account details: your name, work email, password (stored only as a salted hash by our authentication provider; we never see it), company name, role and company website.
- Business details: country, billing and invoice address, company legal details (such as registered name, registration and VAT numbers), destination ports, how many containers you import, and your phone number if you give it.
- Orders: the products, quantities, notes and names in your carts and orders, container and freight choices, delivery dates, vessel tracking codes, invoices, and records of payments and deposits the factory marks as received. Payments are made directly to the factory by bank transfer; Ceramify never receives your card or bank account details.
- Messages: what you write, and files you attach, in chats with a factory.
- Factory accounts: for factories, also the factory profile, pickup address, bank details shown to buyers for payment, product listings and photos, the catalog files uploaded for import, and the names, emails and roles of team members the owner adds.
Data collected when you use the Service
- Technical data: your IP address, browser type and the pages requested, which our hosting provider logs to deliver the site and keep it secure.
- Usage analytics, only if you allow them: pages viewed, actions such as adding to a cart, time spent active, your browser's user-agent, the referring page and, when you are signed in, your account. We do not store your IP address with analytics, and nothing is shared with advertisers.
You must give us your account details to use the Service, and the details an order needs to place it. Everything else is optional.
3. Why we use it, and our legal basis
| Purpose | Legal basis (GDPR Art. 6(1)) |
|---|---|
| Creating and running your account, signing you in | Performance of a contract (b) |
| Building carts, submitting orders to factories, reserving stock, estimating freight and container fill, tracking orders | Performance of a contract (b) |
| Chats between buyers and factories | Performance of a contract (b) |
| Service emails about your account and orders (confirmations, status changes, password resets) | Performance of a contract (b) |
| WhatsApp order updates, if you tick the box at checkout | Consent (a), which you can withdraw at any time by emailing us |
| Usage analytics to understand and improve the Service | Consent (a), given in the cookie settings |
| Keeping the Service secure, preventing fraud and abuse, fixing faults | Our legitimate interest in a safe, working service (f) |
| Reading factory catalog files to create product drafts (factories only) | Performance of a contract (b) |
| Keeping invoices and order records as tax and commercial law require | Legal obligation (c) |
| Establishing or defending legal claims | Our legitimate interest (f) |
We do not use your data for automated decisions that have legal or similarly significant effects on you, and we do not build advertising profiles.
4. Cookies and similar storage
Ceramify sets no cookies of its own. We keep your sign-in session, a copy of the catalog and your cookie choice in your browser's local storage, which the Service needs to work. Analytics runs only with your permission. The Cookie Policy lists each item, and you can change your choice at any time in cookie settings.
5. Who we share it with
Factories you order from
When you save a cart or submit an order, the factory receives your order, your name, company and contact details, the legal and delivery details you enter for the order, and your chat messages to it. Factories may not use this for anything other than dealing with you. A factory's bank details are shown to the buyers who order from it so they can pay.
Service providers who process data for us
These providers act only on our instructions, under data processing agreements:
| Provider | What they do | Data involved |
|---|---|---|
| Supabase | Database, sign-in and file storage | All account, order, message and file data |
| Render | Hosts the website and our servers | Everything passing through the Service, and server logs with IP addresses |
| Our email delivery provider | Sends account and order emails | Your email address and the email's content |
| OpenAI | Reads catalog files a factory uploads, to draft product listings | The contents of those files (factories only). OpenAI does not train on data sent through its API. |
| Meta (WhatsApp Business) | Delivers WhatsApp order updates, only if you opted in | Your phone number, order reference, factory name and order status |
| jsDelivr | Delivers the code library our sign-in uses | Your IP address, as for any download |
Others
- Authorities and advisers, where the law requires it, or to establish or defend legal claims.
- A buyer of our business, if Ceramify is sold or merged, under the same protections as this policy.
6. Transfers outside the EU
Some of the providers above are based in, or use infrastructure in, the United States or other countries outside the European Economic Area. Where that happens we rely on an adequacy decision (such as the EU–US Data Privacy Framework, for certified companies) or on the European Commission's Standard Contractual Clauses, together with any additional safeguards needed. You can ask us for a copy of the relevant safeguards.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account and business details | While your account is open. Deleted within 30 days of closing it, except what must be kept as below. |
| Orders, invoices, payment and deposit records | As long as tax and commercial law requires, generally up to 10 years after the year of the transaction. |
| Chat messages and attachments | As long as the order they relate to, or until the account is closed if not tied to an order. |
| Usage analytics | 13 months, then deleted automatically. |
| Server logs | A short period set by our hosting provider, normally no more than 30 days. |
| Your cookie choice (in your browser) | 12 months, after which we ask again. |
8. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy;
- rectify data that is wrong or incomplete (most of it you can edit yourself in your account);
- erase your data ("right to be forgotten"), subject to what we must keep by law;
- restrict how we use it while a complaint is resolved;
- port data you gave us, in a machine-readable format;
- object to use based on our legitimate interests;
- withdraw consent at any time, without affecting what was done before. Use the cookie settings for analytics and maps. For WhatsApp, leave the box unticked on your next order, or email us to stop updates for orders already placed.
To use any of these, email hello@ceramify.io from the address on your account. We answer within one month, and it is free. We may need to confirm who you are first.
You also have the right to complain to a data protection supervisory authority, in particular in the EU country where you live or work, or where you believe your rights were infringed. We would appreciate the chance to put things right first.
9. How we protect it
All traffic to Ceramify is encrypted (HTTPS). Passwords are hashed by our authentication provider. Access to data is limited by database access rules so that buyers and factories see only their own records, and staff access is limited to what is needed to run the Service. No system is perfectly secure; if a breach puts your rights at risk, we will tell you and the authorities as the law requires.
10. Children
Ceramify is a service for businesses. It is not meant for anyone under 18, and we do not knowingly collect data about children.
11. Changes to this policy
When we change this policy we update the date at the top. If a change materially affects how we use your data, we will tell you by email or in the Service before it takes effect.
12. Contact
Ceramify · hello@ceramify.io