Personal data we store
Information comes from your account, your submissions and other authorised participants. Documents and free-text fields may contain personal information; include only what the case needs.
Account and profile
- Stored
- Email, name, company, country, phone, job title and profile photo, where supplied; account applications and approved roles.
- Purpose
- Sign-in, account approval, identifying case participants and account administration.
- Who sees it
- You and authorised administrators; relevant contact and company details are available to authorised case participants. Passwords are handled by the account service and are not shown to participants.
- Where
- Lovable Cloud account and profile records; photos in private avatar storage.
Invitations
- Stored
- Invited contact details, case reference, invitation status, token, expiry and acceptance records.
- Purpose
- Invite a named supplier and manage their access.
- Who sees it
- The inviting buyer, invited recipient and authorised administrators. Invitation links are access credentials and should not be forwarded.
- Where
- Private case and invitation records in Lovable Cloud.
Cases and commercial history
- Stored
- Product and route details, buyer requirements, supplier offers and drafts, comments, proposals, approvals, accepted terms, assessments and dated input/report snapshots.
- Purpose
- Compare a proposed deal, record decisions and reproduce earlier assessments.
- Who sees it
- Authorised case parties, assigned reviewer and administrators, according to their permissions. Private commercial limits are withheld from the counterparty; only permitted brief fields and authorised proposal disclosures are shared.
- Where
- Private case records and append-only histories in Lovable Cloud.
Evidence and reviews
- Stored
- Evidence titles and types, ownership, scope, issuing organisation, issue/expiry dates, source links, files and replacement versions, uploader details, review outcomes and reviewer/date records.
- Purpose
- Track required evidence and dated reviews for a defined scope.
- Who sees it
- Authorised case parties, assigned reviewer and administrators. Uploaders cannot mark their own upload as reviewed.
- Where
- Versioned evidence register and separate private evidence storage.
Shared case documents
- Stored
- Uploaded files, filenames, uploader and upload date, size, type and scan status.
- Purpose
- Share supporting documents within a case, separately from reviewed evidence.
- Who sees it
- Authorised case participants; uploads are restricted to buyers and suppliers.
- Where
- A separate private shared-document bucket in Lovable Cloud.
Reviewer notes and AI summaries
- Stored
- Reviewer-authored notes, generated summaries, recommended next steps and references to supplied case records.
- Purpose
- Assist the reviewer with concise drafting; AI never determines case outcomes.
- Who sees it
- Notes and summary snapshots are private to their author under case permissions. Supplied prompts and case context are sent to Groq when AI assistance is requested.
- Where
- Author-private records in Lovable Cloud; prompt processing by Groq.
Corridors, news links and price repairs
- Stored
- Owner-entered trade routes and products, links to authorised cases, saved news relevance links and price-discrepancy discussions and decisions.
- Purpose
- Organise related information and record bilateral discrepancy handling.
- Who sees it
- Corridor owners and authorised linked-case participants; case repair records are available only to permitted participants.
- Where
- Permission-controlled records in Lovable Cloud. Official tariff/news services receive lookup requests, not private case files through those tools.
Alerts and preferences
- Stored
- Notification preferences, recipient-scoped alerts and read status; recipient email and message content when an email is sent.
- Purpose
- Notify you about case changes and actions awaiting you.
- Who sees it
- Your in-app alerts are recipient-scoped. Resend receives email recipients and message content for delivery; administrators handle relevant account and data requests.
- Where
- Lovable Cloud notification records; email processing by Resend.
Privacy and data requests
- Stored
- Notice acknowledgement version and timestamp, export/deletion requests, request notes and status, administrator decisions and recorded retention preferences.
- Purpose
- Record acknowledgements and review requests about your information.
- Who sees it
- The requester and authorised administrators. Acknowledging this notice is not a substitute for establishing applicable lawful bases.
- Where
- Private profile, request and retention records in Lovable Cloud.
Who can see your information
A UK buyer and a Nigerian supplier on the same case can see each other’s contact and shared case details. Assigned reviewers and administrators can access the case for their work. This includes access from the UK and Nigeria.
Unrelated users cannot access private cases. Buyer quantity ranges, hard latest dates and price ceilings, and supplier private floors and undisclosed concessions, are not provided to the counterparty. Reviewers and administrators have access only for their authorised work; author-private reviewer notes remain separate.
Private files and security
Evidence and shared documents are separate and stored in private buckets, not at public file URLs. File downloads use signed links that expire after 60 seconds. Profile photos use separate signed links that can last up to 24 hours. Do not share download links outside the authorised participants.
Evidence and shared-document uploads have a 20 MB maximum, file-format checks, content-byte checks and empty-file rejection. Malware scanning is not currently configured: files are labelled “Not scanned”. A file reported as BLOCKED cannot be downloaded. These controls do not promise malware protection.
Uploading a document never means it is verified. A review applies only to its defined scope and does not provide legal, customs, food-safety or import clearance.
Service providers and email
- Lovable Cloud hosts account, case and permission-controlled records and private files.
- Groq receives supplied prompts, reviewer notes and selected case context for requested AI assistance. AI drafts do not decide outcomes. Processing locations and transfer terms require review.
- Resend receives recipients, email subjects and message content for invitations and alerts. The current default sending address is onboarding@resend.dev and only delivers to the Resend account owner; it is not a privacy contact inbox. General-recipient email requires an explicitly configured address on an authorised verified domain. In-app alerts remain available independently of email.
- Google Fonts supplies the Manrope font. Loading it connects your browser to Google, which receives your IP address and normal browser request information.
Visitor analytics and browser storage
On the published site, Lovable records pages visited, where visitors came from, country, browser, operating system and device type, time on page, page-load speed and errors. Click tracking is enabled; clicks are identified by their position, not their text. The editor preview is not counted.
This analytics uses no cookies, stores nothing on your device, does not keep IP addresses and does not identify visitors or recognise returning visitors. Lovable collects this data for us. Lovable’s privacy policy explains how it handles it. Detailed data is kept for 90 days and daily summaries for a year.
There is no analytics consent banner connected on this site. The listed analytics, including clicks, is recorded for every visitor. Error reports include technical context about failures; do not put sensitive information into error messages.
Separately from analytics, the account service stores sign-in session information in browser storage to keep you signed in. Your light/dark theme choice is also saved in browser storage. Sign out on shared devices. No advertising pixels or embedded third-party media are currently loaded by the site.
Retention and historical records
Buyers and administrators can record a case retention period. Recording a period does not automatically delete data. Default periods, record-specific retention, legal holds and an automatic removal process still require approval; no fixed period is promised for account or case data here.
Audit events, assessments, reviews and report/input snapshots are append-only to preserve earlier decisions. These historical records may contain personal data. Complete erasure needs an approved anonymisation approach that preserves the audit skeleton; disabling historical protections is not the deletion process.
Request export or deletion
- Sign in and open Data requests in the workspace sidebar, or use the case’s data controls for a case-specific request.
- Add an optional note identifying the information you want, then choose Request export or Request deletion. Do not include passwords or unnecessary sensitive documents.
- An administrator reviews the request. Return to Data requests to see its status and the administrator’s recorded response; email is not required to submit or track it.
Submitting a deletion request does not immediately remove files or personal data. The current queue records and reviews requests but does not perform complete erasure. Personal-record exports cover profile and authored records; full case-history archives and original file delivery require administrative review. An export prepared for review does not mean a complete archive has been delivered to you.
Requests are handled by the TradeConnect Africa Privacy Team, a service contact label, not a separate legal entity. A legal controller name and monitored external privacy contact have not yet been supplied. If you cannot access your account, contact the person who invited you or your workspace administrator; no external privacy email is published until it is confirmed.
UK–Nigeria access and legal review
Nigerian suppliers can access permitted buyer contacts, case details and shared files; UK buyers can access supplier contacts, submissions and shared evidence. Authorised reviewers and administrators may work from either country. Resend and Groq processing locations and subprocessors also need confirmation.
Controller details, hosting regions, lawful bases, international-transfer mechanisms and assessments, Nigerian requirements, retention periods and rights-response procedures remain subject to legal review. This notice is based on the operational data map and is not a compliance certification. Privacy rules differ by country; the operator should review these arrangements with a qualified adviser for the places its visitors and participants are located.