Privacy Policy

Lugbook is a peer-to-peer travel and marketplace platform that connects travellers ("Carriers") with buyers who need goods transported across borders. This Privacy Policy explains what personal information we collect, why we collect it, and how we use it. Our email is team@lugbook.com if you have any questions about your data.

We collect only what is necessary to operate the platform: • Account information: your name, email address, and password (stored securely via Supabase Auth — we never see your raw password). • Profile information: any details you choose to add to your profile, such as a bio or profile picture. • Trip and listing data: travel dates, origin, destination, and item descriptions you submit when creating a supply trip or demand listing. • Usage data: pages visited, features used, and approximate location (country-level, derived from your IP address on first visit). We do not track you across other websites. • Contact form messages: if you send us a message via the contact form, we retain that message to respond to you. We do not collect payment information — all payments are agreed directly between Carriers and Buyers outside the platform.

We use your information solely to provide and improve the Lugbook service: • To create and manage your account. • To show your listings and trip details to other users so that Carriers and Buyers can connect. • To send you transactional emails (e.g. verification emails, password resets). We do not send unsolicited marketing emails. • To detect your approximate country on first visit so we can show you relevant local listings. This is done using your IP address and is not stored beyond your session unless you choose to interact with the map. • To respond to support requests or contact form enquiries.

Lugbook does not sell, rent, trade, or share your personal information with any third party for commercial purposes. Your information is never passed to advertisers, data brokers, or marketing companies. The only third-party services we use are: • Supabase — our database and authentication provider, hosted on AWS. Your data is stored securely on their servers. • Resend — used to send transactional emails (e.g. contact form replies). Only the content of your message and your email address are passed to Resend for delivery purposes. • Cloudflare — we use Cloudflare's CDN to detect your approximate country from your IP address on first visit. This does not involve any persistent tracking or profiling. All third-party providers are bound by their own privacy policies and GDPR-compliant data processing agreements.

Lugbook uses browser localStorage (not cookies) to remember your approximate location so that the map can show your country on return visits. This data is stored only in your own browser and is not transmitted to our servers unless you interact with a listing or trip. We do not use advertising cookies, third-party tracking cookies, or analytics cookies that follow you across the web.

We retain your account data for as long as your account is active. If you delete your account, your personal information is removed from our database within 30 days, except where we are required by law to retain certain records. Trip listings and demand posts are retained to allow historical reference for users involved in those transactions. You may request deletion of your listings at any time by contacting us.

Depending on your location, you may have rights under applicable data protection law (including GDPR and UK GDPR) including: • The right to access the personal data we hold about you. • The right to correct inaccurate data. • The right to request deletion of your data ("right to be forgotten"). • The right to restrict or object to processing. • The right to data portability — to receive your data in a structured, machine-readable format. To exercise any of these rights, contact us at team@lugbook.com. We will respond within 30 days.

We take security seriously. Your data is stored using Supabase, which uses industry-standard encryption at rest and in transit. Passwords are hashed and never stored in plain text. Access to production data is restricted to authorised team members only. While we take reasonable steps to protect your data, no online service can guarantee absolute security. Please use a strong, unique password for your Lugbook account.

Lugbook is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from minors. If you believe a child has provided us with their information, please contact us at team@lugbook.com and we will delete it promptly.

Lugbook is a global platform. Your data may be stored or processed in countries outside your own, including the United States (where Supabase's infrastructure is hosted). Supabase is GDPR-compliant and maintains Standard Contractual Clauses for international data transfers.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the bottom of this page. For significant changes, we will notify registered users by email. Continued use of Lugbook after changes are posted constitutes your acceptance of the updated policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please contact us: Email: team@lugbook.com We aim to respond to all privacy-related enquiries within 5 working days.