Privacy Policy

FrigoConnect ("we", "us") is a load contact board for refrigerated freight. We collect the minimum data needed to run the board, verify companies, and keep contact details safe from scraping. This policy explains what we collect, why, and your rights under UK GDPR.

1. Data we collect

• Account data: name, email address, hashed password, whether you have confirmed your email address, marketing preference, and when you last signed in.
• Company data: company name, address, website, company and VAT numbers, contact names, phone numbers and email addresses, preferred contact method, a description, whether the company posts or searches for loads and vehicles, the contact visibility setting (Public / Registered users only), and verification status and history. Verification checks are made by our team; we don't ask you to upload documents.
• Load data: route, dates, weight, pallets, temperature regime and any notes a supplier chooses to publish.
• Vehicle data: for hauliers advertising available vehicles, the vehicle's current town and postcode, available dates, temperature capability, preferred destination region and any notes.
• Account activity: your saved searches, favourited loads, notifications and notification settings, and any reports you submit about a load or company.
• Usage data: load views, profile views, and contact clicks (call/ email), recorded against a hashed IP address and user agent — never the raw value — and against your account if you're signed in. Used to power supplier and platform statistics such as load cover rate, and to protect against misuse.
• Session data: a single random session token stored in a cookie to keep you signed in (we store only a hash of it) — see our Cookie Policy.

We do not collect payment details, bank details, or live vehicle-tracking or GPS data — vehicle locations are only what a haulier chooses to enter. FrigoConnect never books, brokers, contracts or pays for transport, so we hold no transaction records.

2. Why we process it

• To create and secure your account and company profile (contract necessity).
• To operate the load board: publish, search and display loads (contract necessity).
• To verify companies and moderate reports, protecting users from fraud (legitimate interest).
• To produce cover-rate and usage statistics for suppliers and platform admins (legitimate interest).
• To keep the service secure and working — limiting repeated sign-in attempts and bulk viewing of contact details, and diagnosing errors (legitimate interest).
• To send you marketing emails, only if you opted in at registration (consent — withdraw any time).
• To meet legal and accounting obligations (legal obligation).

3. Who can see your contact details

Each company sets its own contact visibility: Public (visible to anyone viewing the load or profile) or Registered users only (visible only to signed-in accounts that have confirmed their email address). We never sell or share contact details with third parties for their own marketing.

To stop contact details being harvested in bulk, each account can view a limited number of "Registered users only" contact details per hour and per day — well above what normal use of the board needs.

Separately from the contact-visibility setting above, viewing a company's profile page at all now requires being signed in — this stops company details being indexed by search engines or scraped by anonymous visitors.

4. Service providers and international transfers

We use a small number of service providers to run FrigoConnect. They process personal data only on our instructions and under data processing terms that bind them to UK GDPR standards — never for their own purposes.

• Vercel (hosting) — runs the website and handles every request, including what you enter into forms.
• Neon (database, London) — stores the data described in section 1.
• Resend (email delivery, Ireland) — receives your email address and the content of the emails we send you, such as verification, password-reset and notification emails.
• Sentry (error monitoring, data stored in the EU) — receives technical details when something goes wrong, such as the page, browser and error message, so we can fix it. It is configured not to collect cookies or account details.
• Upstash (abuse protection, London) — keeps short-lived counters used to block password guessing and contact-detail scraping. It only receives scrambled (hashed) identifiers, never readable email or IP addresses.
• Vercel Web Analytics (visitor statistics) — counts page visits without cookies and without identifying individual visitors.
• Zoho Mail (business email, Dublin) — handles any email you send to hello@frigoconnect.co.uk.

Most of your data stays in the UK: our application servers, database and abuse-protection counters are all in London. Email delivery (Resend), error reports (Sentry) and our business mailbox (Zoho) are handled in the EU, which UK law recognises as giving personal data adequate protection. Vercel is a US company, so although our servers run in London, some data — such as request logs and visitor statistics — may be processed in the United States. There we rely on the safeguards in Vercel's data processing terms: the UK–US data bridge, or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. Contact us if you'd like more detail.

5. Retention

We keep account and company data for as long as your account is active. If you delete your account, we anonymise your personal data (name, email, phone) while retaining a minimal, non-identifying record where needed for audit, fraud-prevention or accounting purposes. If you were the only person at your company, the company is closed too: its profile is removed, its contact details, address, website and description are deleted, and its live loads and vehicles are taken off the board. We keep only its name, town, company and VAT numbers and verification history as a business record. Load and usage records tied to a deleted account remain anonymised for platform statistics.

6. Your rights

Under UK GDPR you can ask us to: access the data we hold about you; correct inaccurate data; delete your account and anonymise your personal data; restrict or object to certain processing; and receive your data in a portable format. Contact us using the details below to exercise any of these rights.

7. Security

Passwords are hashed with scrypt and never stored in plain text. Your sign-in is a random token kept in an httpOnly, SameSite=Lax cookie; we store only a keyed hash of it, and it lasts up to 14 days after you sign in. Email verification and password-reset links work once and expire quickly. All authenticated actions are re-checked against your account and company permissions on the server. See How It Works for more on how the platform operates.

8. Contact

For any privacy question or to exercise your rights, email hello@frigoconnect.co.uk. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ico.org.uk).