Privacy Policy

Last updated: 29 July 2026

This policy explains how Tradewind International (“Tradewind”, “we”, “us”) collects, uses, and protects personal data in connection with the Windward application — our internal freight operations and finance system — and our dealings with clients and partners. It is written to align with the EU General Data Protection Regulation (GDPR) and Egypt’s Personal Data Protection Law (Law No. 151 of 2018).

1. Who we are

Tradewind International is the data controller. Address: 21 Rich Point, Joseph Tito Axes, El Nozha, Cairo, Egypt. Tax ID: 753-650-983. Website: www.tradewindintl.com. For any privacy request — including access, correction, or erasure — email our data-protection contact at privacy@tradewindintl.com, or reach us through our website or your usual Tradewind contact.

2. Whose data we process

Employees and authorised staff who use Windward.
Client and partner contacts (e.g. carriers, agents) whose details we hold to transact freight business.

3. What data we process

Account & identity: name, work email, role, and authentication data.
Employee HR data (restricted): date of birth, emergency contacts, payroll details, and HR documents. This is stored separately and is visible only to authorised administrators.
Client & partner contact data: company name, contact name, email, phone, tax registration, and address.
Operational & financial records: bookings, quotations, invoices, collections, and related documents you create or upload.
Technical data: a strictly-necessary session cookie (to keep you signed in) and standard server logs. Your light/dark theme choice is saved in your browser’s local storage, not in a cookie. We do not use advertising or cross-site tracking cookies.

4. Why we process it, and our legal basis

To operate the business — managing freight bookings, finance, and client relationships (legitimate interests; performance of a contract).
To employ and pay staff — HR and payroll administration (performance of the employment contract; legal obligation).
To secure the system — authentication, audit logging, and abuse prevention (legitimate interests).

5. Automated processing and AI

Windward does not make automated decisions that produce legal or similarly significant effects about you. We use the Anthropic Claude model for one purpose only: to draft the wording of an internal weekly management summary from that week’s aggregate figures (see section 7). A person reviews and sends that summary; it is not used to evaluate individuals or to make decisions about them.

6. Cookies & local storage

We use a single strictly-necessary cookie: a session cookie that keeps you signed in. Your light/dark theme preference is stored in your browser’s local storage, not in a cookie. Where bot-protection is enabled on our sign-in page, Cloudflare Turnstile may set its own short-lived challenge cookie to distinguish human from automated traffic. We use no advertising, analytics, or cross-site tracking cookies, and we do not profile you.

7. Who we share it with (subprocessors)

We host and run Windward using a small set of trusted service providers, each bound by a data-processing agreement:

Supabase — database, authentication, and file storage (see data residency below).
Vercel — application hosting and content delivery.
Resend — outbound email delivery (e.g. invoices, quotations, and system notifications).
Anthropic — drafting the text of our internal weekly business digest. It receives a short summary of that week’s aggregate metrics (such as bookings, revenue, and cash position), which may include a named team member (for example, the week’s top performer). It does not receive client records, HR data, or document contents, and under its commercial terms does not use this data to train its models.
Sentry — application error monitoring, where enabled. It receives error messages and diagnostic stack traces only, and is configured not to collect IP addresses, request contents, or personal data.
Cloudflare — bot-detection (Turnstile) on our sign-in page, where enabled, to protect against automated abuse.

We do not sell personal data. We disclose data to authorities only where legally required.

8. Data residency & international transfers

Our primary database and uploaded files are hosted by Supabase in the European Union (Paris, France; AWS region eu-west-3). Because Tradewind operates from Egypt, this means personal data is transferred from Egypt to the EU and processed there. Other subprocessors (for example Vercel, Resend, Anthropic, Cloudflare, and error monitoring) may process limited technical or summary data in other locations. Where data crosses borders, we rely on appropriate safeguards — such as standard contractual clauses — together with the data-processing agreements we hold with each provider.

9. Retention

We keep personal data only as long as needed for the purposes above and to meet legal, tax, and accounting obligations. Financial records are retained for the period required by applicable law; HR records are retained for the duration of employment and a reasonable period afterward.

10. How we protect it

Access is role-based and enforced at the database level; data is encrypted in transit; restricted HR data is segregated; and changes to key records are recorded in an immutable audit log.

11. Your rights

Subject to applicable law, you may request access to, correction of, or erasure of your personal data, and may object to or restrict certain processing. To exercise these rights, contact us using the details in section 1. We will respond within the timeframe required by law.

You also have the right to lodge a complaint with a competent supervisory authority — in Egypt, the Personal Data Protection Center, or in the EEA, your local data-protection authority.

12. Children’s data

Windward is an internal workplace system for authorised staff and is not directed to children. We do not knowingly collect personal data relating to children.

13. Changes

We may update this policy from time to time. Material changes will be communicated through our official channels, and the “last updated” date above will change.