PortSignal — Privacy Policy

Last updated: 14 September 2026

1. Introduction

PortSignal is operated by Signal Ocean Ltd (company number 09297294), a private limited company incorporated in England and Wales, with registered office at 83 Cambridge Street, Pimlico, SW1V 4PS, London, England ("Signal", "we", "us"). Signal is the data controller of personal data processed through the Platform.

This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the Platform. We comply with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (GDPR), and other applicable data-protection laws.

For brevity, capitalised terms used here and not defined have the meanings given in the Terms of Service.

2. Data We Collect

Feed content generally relates to companies, vessels, ports, and commodities and is not intended to identify individuals. Where Contributor-uploaded content includes personal data (for example, a named sole trader, agent, or crew member), the Contributor warrants the lawful basis for processing (see Terms §4.1) and indemnifies Signal under Terms §12.2.

Analytics run only on the public pages of the Platform. No other part of the Platform loads the analytics tag: your dashboards, the feed catalogue, sign-in, sign-up and administration never start it. Because a browser keeps a script for as long as the page stays open, following a link from a public page into one of those areas can carry an already-started tag with it; where we can, we make such a link reload the page so the tag is discarded. We never send your name, email address, account identifier, or any other direct identifier to Google Analytics.

Analytics data collected from the Platform is not used for advertising or commercial profiling: the advertising consent signals are denied on every visit and are never granted, so this data cannot be used for ad personalisation, remarketing, or audience building (see §11).

3. Legal Basis for Processing

We rely on the following legal bases under the UK GDPR and EU GDPR:

• Contract performance — to provide the Platform, process subscriptions, trials, API access, and payouts.
• Legitimate interests —
  • product usage analysis from our own server-side records (Platform and API logs) and service improvement; cookie-based website analytics is not covered by this basis and relies on your consent instead (see §11);
  • security monitoring, fraud detection, and anti-sharing enforcement (including magic-link and API access-pattern monitoring);
  • automated Buyer vetting (see Terms §6); adverse decisions may be reviewed on request to port-signal@thesignalgroup.com;
  • enforcement of our Terms and protection of legal rights.
• Legal obligation — tax record-keeping, sanctions compliance, and responding to valid legal requests.
• Consent — analytics cookies (Google Analytics 4, see §11), marketing communications and, where offered in future, SMS notifications.

You may object to processing based on legitimate interests at any time (see §8).

4. How We Use Your Data

• Provide and maintain the Platform and its features.
• Process registrations, Feed publications, subscriptions, trials, and payouts.
• Perform automated Buyer vetting and sanctions screening.
• Monitor Platform access and API usage for security, fraud, and anti-sharing enforcement — never for advertising or commercial profiling.
• Send email about your account, transactions, security events, and material changes to these policies.
• Improve data quality through AI-assisted extraction and normalisation.
• Respond to disputes, investigations, and legal process.

5. Data Sharing and Recipients

We share personal data only as necessary to operate the Platform. Our processors are listed below, each engaged on appropriate contractual protections; the one recipient that acts as an independent controller rather than as our processor is identified as such in the table and described under "Analytics".

We use the "separate charges and transfers" model on Stripe Connect: Buyers pay Signal, and Signal calls Stripe Connect to transfer the applicable net amount to the Contributor's Connect account. We do not retain full card or bank numbers.

An updated list of sub-processors is maintained in this section. Material additions will be flagged in updates to this Privacy Policy.

Analytics. Until you accept analytics cookies, Google Analytics 4 operates in a cookieless mode: it stores nothing on your device and Google receives only the technical information carried by any web request (your IP address, the page address, the referring page, and your browser type), which we use for aggregate traffic volumes. Unlike the other recipients listed above, Google determines its own purposes for the analytics data it receives, and so acts as an independent controller for that data rather than as our processor. The Google Analytics property used to measure the Platform is operated by The Signal Group and shared with other group websites; that property is linked to a group Google Ads account and has advertising features, including Google Signals, enabled at property level. None of them apply to Platform visitors: our cookie banner denies advertising storage, advertising user data, and advertising personalisation on every visit, and never grants them. Platform measurement data is therefore not used for advertising, remarketing, audience building, or association with Google accounts.

We do not sell personal data to third parties.

Vetted Buyers. Purchased data, including Contributor-provided lineup records, is delivered only to Buyers who have passed our vetting and hold an active subscription. Feed listings are not public. Anonymous Contributors' legal identities are never shared with Buyers.

Enterprise Data Processing Agreements. Enterprise Buyers requiring a bespoke Data Processing Agreement may request one by contacting privacy@thesignalgroup.com.

6. Anonymous Contributors

Anonymous Contributors publish under an alias. The legal identity of an Anonymous Contributor is stored in an isolated vault, logically and encryption-separated from the marketplace alias, and is:

• never shared with Buyers;
• shared with Stripe only as required for KYC and payouts;
• disclosed to law enforcement only on a valid legal order;
• accessible to our compliance personnel only on a legitimate sanctions or fraud-investigation trigger.

7. Data Retention

• Lineup records — retained indefinitely for audit, legal, and tax purposes. Trial-only records: see Terms §5.2.1.
• Account and profile data — archived for 5 years after account deletion, then permanently deleted.
• Contact details (name, email, phone) — anonymised 30 days after account deletion, except where retention is required for an ongoing billing dispute, tax, or other legal obligation.
• Banking and payment details — not retained by Signal; Stripe retains payment records under its own policy.
• Magic-link tokens — expire after 5 days; deleted on expiry.
• API access and security logs — retained for 12 months.
• Subscription and commission history — retained for 7 years for tax and legal compliance.
• Analytics data — currently retained by Google Analytics for 14 months, then only as aggregated reports.

8. Your Rights

You have the right to:

• Access your personal data;
• Rectify inaccurate or incomplete data;
• Erase your personal data (subject to retention requirements and the Terms §5.2.1 trial-data obligation);
• Restrict processing in certain circumstances;
• Data portability — receive your personal data in a structured, machine-readable format;
• Object to processing based on legitimate interest;
• Withdraw consent to marketing communications at any time.

To exercise these rights, contact privacy@thesignalgroup.com. Signal has not formally designated a Data Protection Officer; privacy matters are handled by the Signal Group privacy team at that address.

Supervisory authority. UK users may lodge a complaint with the Information Commissioner's Office (Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; 0303 123 1113; ico.org.uk). EU users may lodge a complaint with their national supervisory authority.

9. Security

• All data is encrypted at rest (AES-256) and in transit (TLS 1.3).
• Signal Group is certified to ISO/IEC 27001:2022 for information security management.
• Access to user and Feed data is restricted to Signal personnel with a legitimate need-to-know; role-based access controls apply; access is logged and periodically reviewed; all personnel are bound by confidentiality obligations under their employment contract or consultancy agreement.
• Anonymous Contributor legal identities are stored in an isolated vault (see §6).
• Rate limiting is applied to all API endpoints.
• Multi-factor authentication is offered via Clerk; users are strongly encouraged to enable it.

10. Data Breach Notification

In the event of a personal-data breach that is likely to adversely affect you, we commit to notify affected users without undue delay, and within 72 hours of becoming aware of the breach, consistent with UK GDPR Art. 33–34. The notification will describe the nature of the breach, categories of personal data affected, approximate number of users involved, mitigation steps taken, and Signal's contact for queries.

11. Cookies and Similar Technologies

Strictly necessary cookies. We use strictly necessary cookies for authentication, session management, and CSRF protection. These are required for the Platform to function and are set without consent, as permitted by law.

Analytics cookies. We use Google Analytics 4 to measure how the public areas of the Platform are used. Analytics cookies (_ga and _ga_<container-id>, retained for up to 2 years) are set only if you choose Accept on our cookie banner. We implement Google Consent Mode v2: until you accept, analytics storage is denied and Google sets no analytics cookie. Advertising storage, advertising user data, and advertising personalisation are denied on every visit and are never granted, so the advertising features enabled on the shared property (see §5) cannot apply to you. We run no advertising on the Platform.

Your choice. Your decision is recorded in your browser's local storage (key consentMode) so that we do not ask again. You can change it at any time using the Cookie settings link in the footer of any public page, or the equivalent link in this section, or by clearing your browser's storage for this site. Withdrawing your consent also deletes the analytics cookies already set on this site. Rejecting analytics cookies does not restrict any Platform functionality. You can also reopen the banner from here.

We use no advertising, cross-site tracking, or social-media cookies, and we do not sell or share personal data for advertising purposes (see §5).

12. International Data Transfers

Personal data may be processed in countries outside your country of residence, including the United States (Clerk, Stripe, Anthropic, Vercel, and Google when you browse our public pages) and within the European Economic Area (Supabase, Upstash, and Google Ireland Limited). Where transfers leave the UK/EEA, we rely on appropriate safeguards including the UK International Data Transfer Agreement, UK Addendum, and EU Standard Contractual Clauses as applicable; for Google, transfers rely on its certification under the EU-US Data Privacy Framework and the UK Extension to that framework.

13. Children's Privacy

The Platform is not intended for use by individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided personal data to the Platform, please contact privacy@thesignalgroup.com so we can delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email and by posting an updated version on the Platform at least 30 days before the change takes effect.

15. Contact

• Privacy and data-protection requests: privacy@thesignalgroup.com
• Platform support and commercial inquiries: port-signal@thesignalgroup.com
• Postal address: Signal Ocean Ltd, 83 Cambridge Street, Pimlico, SW1V 4PS, London, England