Privacy Policy

Last updated: 24 June 2026

SFC Deal Tracker (“the application”) is an internal operations tool used by SFC Global Commodity Pvt Ltd (“we”, “us”) to manage metal-scrap import/export deals. It is restricted to authorised team members and is not a public service. This policy explains what data the application stores and how it is handled.

1. Data we store

Account data — your name, work email, role, hashed password, and last-login time.
Business records — buyers, suppliers, deals, contracts, payments, documents (BLs, invoices, KYC), and the bank/contact details you enter for counterparties.
Audit logs — a record of significant actions (logins, edits, approvals) with the acting user and timestamp.
Operational messages — WhatsApp/email content you paste or forward in for parsing.

2. How we use it

Data is used solely to run SFC's trade operations — tracking deals, generating sales confirmations and invoices, sending counterparty notifications you trigger, and producing internal reports. We do not sell or share data with third parties for marketing.

3. Third-party processors

When enabled by an administrator, the application may transmit specific data to: Anthropic (Claude — to extract fields from messages/documents you submit), Resend (to send emails you compose), Meta WhatsApp Cloud API (to send WhatsApp messages you trigger), and a container-tracking provider (BL/container numbers). Each is used only to perform the action you initiate.

4. Cookies

The application uses strictly-necessary cookies only: sfc_session (keeps you signed in; HttpOnly, SameSite=Lax, secured over HTTPS in production) and, if you sign in with Google, g_oauth_state (a short-lived anti-forgery token used only during sign-in, ~5 minutes). No advertising or third-party tracking cookies are used.

5. Security & retention

Passwords are stored only as salted scrypt hashes. Access is role-gated and audit-logged. Records are retained for as long as needed for business and statutory (trade/tax) purposes.

6. Your rights & contact

Team members may request access to, correction of, or deletion of their personal account data by contacting the administrator at accounts@sfcplindia.com.