§ 1 · Who we are
SellexIo ("SellexIo", "we", "us") operates the SellexIo maritime claims and compliance platform. SellexIo is the data controller for personal data processed through the platform. Contact: dpo@gdcs.me.
§ 2 · Personal data we collect
- Account data: name, business email, hashed password, role, organization.
- Authentication data: login timestamps, IP address, user-agent, session tokens.
- Customer content: claim narratives, uploaded bills of lading, port invoices, statements of fact and related shipping documents (may contain third-party personal data such as master/agent names).
- Support and communications: emails, in-app messages, reply metadata.
- Usage and telemetry: pages viewed, features used, error logs, device identifiers.
- Billing metadata: plan, subscription status, invoice history. Card and bank details are collected and stored by Paddle, not by us.
§ 3 · Purposes and legal basis
- Providing the service (contract): account creation, claim processing, AI-assisted drafting, notifications.
- Security and fraud prevention (legitimate interests / legal obligation): abuse detection, audit logging, incident response.
- Service improvement (legitimate interests): aggregated, de-identified analytics and model evaluation.
- Customer support (contract): responding to inquiries and troubleshooting.
- Marketing communications (consent or legitimate interests): product updates and outreach; unsubscribe available in every email.
- Legal compliance (legal obligation): tax records, sanctions screening, responding to lawful requests.
§ 4 · How we share personal data
We share personal data with categories of recipients as needed to run the service:
- Merchant of Record — Paddle.com Market Limited for payment processing, subscription management, tax compliance, invoicing, and refunds.
- Infrastructure and hosting subprocessors providing database, storage, and edge compute.
- AI model providers used to power document extraction and drafting features (inputs processed transiently, not used to train third-party foundation models).
- Email delivery providers for transactional and outreach email.
- Maritime data providers (Datalastic, DataDocked) for AIS lookups initiated by the operator.
- Professional advisers (legal, accounting) under confidentiality.
- Authorities where required by law, court order, or to protect rights and safety.
§ 5 · International data transfers
Personal data may be processed in the United States and the European Union. Where personal data leaves the UK/EEA we rely on the EU Standard Contractual Clauses (2021/914) and the UK IDTA as appropriate safeguards.
§ 6 · Data retention
Account and billing records are retained for the life of the account and for up to 7 years thereafter to satisfy tax and regulatory obligations. Uploaded documents and claim data are retained for the life of the account and deleted or anonymized within 90 days of account closure, except where longer retention is required by law or to defend legal claims. Audit logs (ai_audit_log, tos_acceptances) are retained for 7 years.
§ 7 · Your rights
Subject to applicable law you have the right to access, rectify, erase, restrict, port, and object to processing of your personal data, and to withdraw consent. Where GDPR/UK GDPR applies you may lodge a complaint with your supervisory authority. We respond to verified requests within one month. Contact dpo@gdcs.me.
§ 8 · Security
We apply appropriate technical and organizational measures including encryption in transit, encrypted storage, role-based access control, tenant isolation via row-level security, and audit logging of AI generations and privileged actions.
§ 9 · Cookies
We use strictly-necessary cookies for authentication and session management. We do not currently use advertising cookies. Any future analytics cookies will be introduced with a consent banner.
§ 10 · Changes
We will post material changes to this notice on this page and, where required, notify you by email.