Privacy Policy

Mineliqo is the controller of the personal data processed through this platform. To exercise your rights, ask questions, or lodge a complaint, contact us at privacy@mineliqo.ca. Our Data Protection contact is dpo@mineliqo.ca.

Owner action required: replace with your registered legal name, address, and (if applicable) EU/UK representative under GDPR Article 27.

• Account & identity: name, email, password hash, roles, company, phone.
• Business verification: business address, license number, uploaded documents.
• Supply-chain records: shipments, batches, supply-chain events, contracts, offers, bids.
• Logistics & GPS: live and historical location data for transporters who opt in, delivery photos and signatures.
• Communications: feedback, NPS responses, support messages, notifications.
• Security: audit logs, sign-in events, passkeys/2FA, security questions.
• Technical: IP address, user agent, cookie identifiers (see Cookie Policy).

• Providing the service (accounts, roles, shipments, contracts): Article 6(1)(b) — contract.
• Verification & regulatory oversight: Article 6(1)(c) — legal obligation and (f) — legitimate interests.
• Immutable audit trail & fraud prevention: Article 6(1)(f) — legitimate interests in supply-chain integrity.
• Live GPS tracking of transporters: Article 6(1)(b) with transparency to affected workers; a Data Protection Impact Assessment is maintained.
• Product analytics, marketing, and non-essential cookies: Article 6(1)(a) — consent (withdrawable at any time).
• Security & incident response: Article 6(1)(f) and (c).

We share personal data only with vetted service providers acting on our instructions under a Data Processing Agreement, and with authorities where legally required.

• Supabase — database, authentication, storage.
• Cloudflare / Lovable — hosting and application delivery.
• Google Maps — map tiles and routing (loaded only after Functional consent).
• Lovable AI Gateway — optional AI features.

Owner action required: add any additional processors you introduce (email, analytics, payment, support).

Where personal data is transferred outside the EEA/UK, we rely on adequacy decisions or Standard Contractual Clauses (SCCs) with supplementary safeguards. A copy of the safeguards is available on request.

• Account data — while your account is active, then anonymised or deleted within 30 days of closure.
• Notifications — 12 months.
• GPS tracking events — 24 months or contract term.
• Shipment, contract, POD, audit-trail records — up to 7 years to meet regulatory recordkeeping.
• Cookie consent records — 24 months from collection.

Backups are retained on a rolling basis and overwritten on the same schedule.

Under GDPR you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate data.
• Erase your data ("right to be forgotten"), subject to legal retention.
• Restrict or object to certain processing.
• Data portability in a machine-readable format.
• Withdraw consent at any time (does not affect prior lawful processing).
• Lodge a complaint with your local supervisory authority (e.g. ICO in the UK, your national DPA in the EU).

Signed-in users can start most requests from Settings. Otherwise email privacy@mineliqo.ca. We respond within 30 days.

We encrypt data in transit (HTTPS) and at rest, enforce role-based access controls with row-level security, maintain an immutable supply-chain audit trail, and support multi-factor authentication. In the event of a personal-data breach affecting your rights, we will notify the relevant supervisory authority within 72 hours and affected users without undue delay.

See our Cookie Policy for the categories we use and how to change your choices at any time.

We may update this policy; the effective date at the top of the page reflects the latest version. Material changes will be communicated in-app or by email. Questions: privacy@mineliqo.ca.