Privacy Policy

PortPulse is a B2B maritime logistics visibility platform operated by PortPulse Ltd., incorporated in Ghana. We provide container tracking, demurrage monitoring, and customs clearance alerting services for freight forwarders, importers, and clearing agents operating at Tema Port, Ghana.

For questions about this policy, contact us at: privacy@portpulse.io

Account data: Your name, email address, organisation name, industry type, and contact phone number — provided when you create an account.

ICUMS credentials: Your Ghana Revenue Authority ICUMS username and password, provided optionally to enable automated container monitoring. These are encrypted with AES-256-CBC encryption before storage and are never readable by PortPulse staff. See Section 4.

Container data: Container numbers, carrier names, vessel names, bill of lading numbers, discharge dates, and custom demurrage rates you enter or import.

Usage data: IP addresses, browser user agents, and timestamped audit logs of actions taken within your account (e.g., credentials updated, containers added). This data is retained for security and compliance purposes.

Payment data:Subscription payments are processed by Paystack. PortPulse does not store card numbers or banking information. Paystack's privacy policy applies to payment data.

Communication data: WhatsApp numbers provided for alert delivery. Alert delivery status and timestamps.

Service delivery: To provide container monitoring, demurrage tracking, and alert notifications as described in our Terms of Service.

ICUMS polling:Your encrypted ICUMS credentials are decrypted only within our secure Edge Functions to authenticate API calls to Ghana's ICUMS system every 30 minutes. The decrypted values are never logged or stored outside this temporary process.

Security: Audit logs, IP addresses, and user agents are retained to detect abuse, investigate security incidents, and fulfil our obligations under Ghanaian law.

Service communications: We may send transactional emails (account verification, password reset, subscription notices) to the email address on your account.

We do not sell, rent, or trade your data to third parties. We do not use your data for advertising.

ICUMS credentials are the most sensitive data we handle. Our security controls:

• Credentials are encrypted with AES-256-CBC using a server-side key before reaching our database
• The encryption key is stored as a Supabase Edge Function secret, never in code or the database
• Encrypted values are never returned in any API response
• Only our Edge Function polling process decrypts credentials, transiently, to call ICUMS
• Access to credentials is restricted by Row Level Security — only your organisation can query them
• Audit logs record every credential update

You may revoke credentials at any time from Settings → ICUMS. Deletion removes the encrypted values from the database permanently.

We share data only with the following categories of sub-processors, all operating under appropriate data protection agreements:

• Supabase Inc. — database, authentication, and Edge Function hosting (United States)
• Vercel Inc. — web application hosting (United States)
• Paystack Inc. — payment processing (Nigeria / United States)
• Resend Inc. — transactional email delivery (United States)
• Meta Platforms Inc. — WhatsApp Business Cloud API for alert delivery (United States)

We may disclose data if required by Ghanaian law, court order, or regulatory authority.

Account data: Retained while your account is active and for 12 months after cancellation.

Container and status history: Retained for 24 months to support operational reporting and dispute resolution.

Audit logs: Retained for 7 years to meet Ghanaian financial record-keeping requirements.

ICUMS credentials: Deleted immediately upon your request or within 30 days of account closure.

Under Ghanaian data protection law and GDPR (where applicable), you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (subject to legal retention obligations)
• Object to processing of your data
• Data portability — receive your data in machine-readable format

To exercise these rights, email privacy@portpulse.io. We will respond within 30 days.

We implement industry-standard security controls including TLS encryption in transit, AES-256 encryption at rest for credentials, Row Level Security on all database tables, rate limiting on all API endpoints, and regular security monitoring. No system is completely secure; we encourage you to use a strong unique password for your PortPulse account.

We may update this policy to reflect changes in our practices or applicable law. We will notify you of material changes by email at least 14 days before they take effect. Continued use of the service after that date constitutes acceptance.

This Privacy Policy is governed by the laws of the Republic of Ghana, including the Data Protection Act, 2012 (Act 843). Any disputes arising from this policy shall be subject to the exclusive jurisdiction of the courts of Ghana.