Privacy policy

1. Who we are

MachLoad is a container loading calculator for machinery exporters, operated from Hong Kong. For the purposes of the EU General Data Protection Regulation (GDPR), we act as the data controller for account and enquiry data, and as a processor for cargo data that a customer uploads about its own shipments.

Contact for any privacy matter, including data subject requests: legal@mach-load.com.

2. What we collect

• Account data: name, work email, company name, hashed password or single sign-on identifier, preferred language and currency.
• Billing data: plan, billing country, tax identifier if you provide one, and the last four digits of the payment method. Full card numbers are held by our payment processors, never by us.
• Cargo data you upload: SKU dimensions, weights, constraints, quantities, container specifications, plan results and any client names you add to a consolidation.
• Usage data: pages viewed, calculations run, features used, export formats, quota consumption and error events, linked to your account where you are signed in.
• Technical data: IP address, browser and device type, referring URL, and a device fingerprint used to enforce the free-tier limit.
• Communications: the content of enquiries you send through the contact form or by email, and the delivery status of the guide emails.

3. Why we process it, and on what legal basis

• To provide the service and calculate a load plan: performance of a contract (GDPR Art. 6(1)(b)).
• To bill you, prevent fraud and enforce the free-tier limit: performance of a contract and our legitimate interest in protecting the service (Art. 6(1)(b) and (f)).
• To send the compliance guide and occasional product emails: consent, which you can withdraw in one click (Art. 6(1)(a)).
• To improve the product through aggregated usage statistics: legitimate interest, using a cookieless analytics tool (Art. 6(1)(f)).
• To meet tax, accounting and legal obligations: legal obligation (Art. 6(1)(c)).

4. Where your data is stored

All account and cargo data is stored on servers located in Hong Kong. Hong Kong is outside the European Economic Area and the United Kingdom, so transfers from those regions are transfers to a third country. We rely on standard contractual clauses approved by the European Commission, together with technical measures including encryption in transit and at rest.

If you are located in mainland China, storing your data in Hong Kong constitutes a cross-border transfer under the Personal Information Protection Law. By creating an account you consent to that transfer; you may request deletion at any time.

5. How long we keep it

• Account and cargo data: while your account is active, then 90 days after deletion so that an accidental deletion can be reversed on request.
• After the 90-day window, plans, SKU libraries and profile data are permanently deleted.
• Billing records: seven years, as required by Hong Kong tax law.
• Enquiry emails: 24 months from the last exchange.
• Analytics events: aggregated, retained for 24 months, never used to re-identify a visitor.

6. Your rights

Under the GDPR you have the right to access your personal data, to correct it, to erase it, to restrict or object to processing, to data portability and to withdraw consent at any time. You also have the right to lodge a complaint with your national supervisory authority.

To exercise any of these rights, email legal@mach-load.com from the address on the account. We respond within 30 days.

• Access and portability: export every plan, SKU and profile field as CSV or JSON from Settings, Data.
• Erasure: delete individual plans immediately, or the whole account from Settings, Account, Delete account. Deletion removes plans, libraries and profile data and cannot be undone after the 90-day window.
• Objection: opt out of product emails in one click, or ask us to stop any processing based on legitimate interest.

7. Sharing

We do not sell personal data. We share it only with processors that are necessary to run the service: a cloud host in Hong Kong, a transactional email provider, Stripe and PayPal for payments, and a cookieless analytics provider. Each is bound by a data processing agreement and processes data only on our instructions.

We may disclose data where required by law, or to establish or defend a legal claim. If the business is sold, data may transfer to the buyer under the same terms described here.

8. Security

Traffic is encrypted with TLS. Data at rest is encrypted at the volume level. Passwords are stored as salted hashes. Access to production systems is limited to named individuals with multi-factor authentication, and access is logged.

The loading algorithm runs locally in your browser, so the geometry of a plan you do not save never reaches our servers at all.

9. Children

MachLoad is a business tool and is not directed at anyone under 16. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

10. Changes

If we change this policy in a way that affects your rights, we will email account holders at least 14 days before the change takes effect and post the new version here with a revised date.