Privacy Policy

1. Who We Are

PortFlow is a maritime agency management platform operated by Jeffry Valerio, based in Costa Rica. We are committed to protecting your personal data and respecting your privacy.

Contact: info@portflow.tech

2. Data We Collect

We collect only what is necessary to provide the Service:

Account data (provided by you):

• Full name and email address
• Company / agency name
• Password (stored as a one-way hash — we cannot read it)

Operational data (created by you):

• Vessel registrations, quotations, invoices, and operations you create
• Crew member information you enter (names, documents, certifications)
• Client and contact information you manage

Technical data (collected automatically):

• IP address and browser/device type (for security and abuse prevention)
• Usage logs and error reports
• Session tokens (stored as secure HTTP-only cookies)

3. How We Use Your Data

We use your data exclusively to:

• Provide, maintain, and improve the Service
• Authenticate your identity and secure your account
• Send transactional emails (account creation, password resets, billing)
• Respond to your support requests
• Comply with legal obligations

We do not sell, rent, or share your data with third parties for marketing purposes. Ever.

4. Data Storage and Security

Your data is stored on Neon (PostgreSQL), hosted on AWS infrastructure in the United States. We implement industry-standard security measures including:

• Encrypted connections (TLS/SSL) for all data in transit
• Encrypted storage at rest
• Password hashing using bcrypt
• Multi-tenant isolation — your data is logically separated from other customers
• Access control via role-based permissions

5. Third-Party Services

We use a minimal number of trusted third-party services to operate PortFlow:

• Vercel — application hosting (USA)
• Neon — database hosting on AWS (USA)
• Resend — transactional email delivery

Each of these providers has their own privacy policies and processes data only as necessary to provide their services to us.

6. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. If you cancel your account:

• You may request a full export of your data within 30 days of cancellation
• Your data will be permanently deleted within 60 days of account closure
• Some anonymized data may be retained for aggregate analytics

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you
• Correction — request correction of inaccurate data
• Deletion — request deletion of your account and data
• Portability — receive your data in a machine-readable format
• Objection — object to certain types of processing

To exercise any of these rights, contact us at info@portflow.tech. We will respond within 30 days.

8. Cookies

PortFlow uses only essential cookies required for the Service to function:

• auth_token — a secure, HTTP-only session cookie for authentication. Expires after 7 days of inactivity.

We do not use tracking cookies, analytics cookies, or advertising cookies.

9. International Transfers

As PortFlow is a global service, your data may be transferred to and processed in the United States (where our infrastructure providers are located). By using PortFlow, you consent to this transfer. We ensure appropriate safeguards are in place in compliance with applicable data protection laws.

10. Children's Privacy

PortFlow is not directed at children under 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice in the application at least 14 days before changes take effect.

12. Contact

For any privacy-related questions, requests, or concerns:

PortFlow
info@portflow.tech