Who is responsible
MP Platform AB, Sweden, operates Multipass Shipping and is the controller for the personal data described here. Contact us at contact@multipass-shipping.com. Public and Basic previews can be browsed without an account; this does not prevent the processing of technical request data.
Information we process
We receive information you enter or upload: contact and company details, messages, quotations, images, optional audio, charter enquiries, vessel and cargo details, ports, routes, coordinates, estimates, notes and saved plans with their revisions. Provide only information you are authorised to share.
Accounts include your name, email, optional profile image, sign-in identifiers and tokens, preferences and subscription status. Google sign-in supplies the profile information you authorise. Requests also produce IP addresses, browser details, timestamps and operational or security logs. Device location is requested only through a location feature with browser permission.
Purposes and legal bases
We use data to deliver requested calculations, saved records, document extraction, enquiries, reports, support and payments. The GDPR basis is performance of a contract or steps you request before one; business-contact communications, service reliability, abuse prevention and security rely on our legitimate interests, balanced against your rights. Accounting and lawful disclosure rely on legal obligations. Where consent is required for an optional feature, you may withdraw it.
Quotation benchmarks use extracted item, price, quantity and port information with supplier, vessel and contact identifiers omitted. Our legitimate interest is improving commercial comparisons; removing direct identifiers does not necessarily make every record anonymous. Market forecasts support decisions; they do not make automated decisions about people with legal or similarly significant effects.
Public information and private work
Market Intelligence publishes source observations, comparisons and calculated forecasts from USDA, BLS, MPA and EIA feeds. Daily collection does not mean each source updates daily. Customer account records and uploaded documents are not part of that public feed.
Ship Tracking displays vessel identifiers, positions and maritime details from AIS/data providers such as Pelyr. These can relate to identifiable people. Our legitimate interest is providing maritime situational information, subject to your rights. Browser-saved scenarios remain on the device; account-saved charter records and passage plans require sign-in. Requested emails go to your selected recipient and may be copied to our service team. Public preview access does not publish your private workspace.
Service providers and recipients
Google Cloud provides storage, market collection and document OCR; Hetzner still hosts application and account services. Moving market and weather data to Google Cloud does not move every personal record off Hetzner. Google supports optional sign-in; OpenAI processes audio when you use transcription; our email provider delivers requested communications. Stripe processes payments when checkout is used; we receive billing metadata, not full card numbers.
Map services, including OpenFreeMap, receive technical requests and the area of the map loaded. Providers receive data needed for their functions. Authorised staff, professional advisers and authorities may receive data for service delivery, legal duties or claims. We do not sell personal data. External services also explain their processing in their own privacy notices.
Cookies and browser storage
We use sign-in/security cookies, the mp_lang language cookie (up to one year), a Ship Tracking session cookie (up to 12 hours), and browser storage for language, theme and saved drafts or scenarios. Ship-tracking abuse controls use a keyed IP-derived identifier and recent request/vessel-access counters. These are pseudonymous, not necessarily anonymous. You can clear browser storage or revoke location permission; doing so can remove local drafts or affect features. Clearing the browser does not delete server-saved records.
How long information is kept
Market Intelligence is scheduled once daily at 01:00 UTC. Historical collection archives in Google Cloud become eligible for automatic deletion after 10 days from storage. Deletion is asynchronous; soft-deleted copies remain recoverable for a further 7 days. The current publication is preserved and can include older reporting periods needed for comparisons. This rule concerns market archives, not all personal data.
Account records, customer uploads, enquiries and correspondence are kept for the service relationship and as needed for support, legal obligations or claims. Security records are kept as needed to investigate and prevent abuse. Retention depends on the purpose and applicable duties; contact us to request deletion or details for a particular record. Backups, recovery copies, legal holds and recipients' email copies can outlast removal from the active service.
International processing
Providers and recipients may process data outside the EU/EEA. Such transfers require an applicable adequacy decision or appropriate safeguards, such as European Commission standard contractual clauses, with additional protection where necessary. Contact us for the destinations and safeguards applicable to your data and how to obtain a copy.
Your choices and rights
Subject to GDPR conditions, you can request access, correction, deletion, restriction or portability, object to processing based on legitimate interests, and withdraw consent without affecting earlier lawful processing. Email contact@multipass-shipping.com; we may verify your identity and normally respond within one month, with lawful extensions explained. You may complain to Sweden's Integritetsskyddsmyndigheten (IMY, imy.se) or your local data-protection authority.
Integritetsskyddsmyndigheten · IMY ↗Security and changes
We use access controls and technical safeguards, but cannot guarantee absolute security. The service is intended for maritime and commercial use, not directed at children. We publish revisions with an updated date and provide additional notice where required. This policy is information about processing, not consent to new uses of your data.