Privacy Policy

This Privacy Policy explains what information SupplierMafia (the "platform", "we", "us") collects when you use our website, iOS app and shared service, how we use it, who we share it with, and the controls you have.

0. Who is responsible

SupplierMafia is operated by SPLIT JJL LTD, company number 14338880. Its registered office and service address is 20–22 Wenlock Road, London, N1 7GU, United Kingdom.

Contact privacy@suppliermafia.com about how SupplierMafia handles your information or to make a privacy request.

EU and EEA users. Contact privacy@suppliermafia.com about your information or rights. General service contacts and EU content-reporting routes are described in Section 17 of our Terms of Service. A general contact address does not identify an appointed EU legal representative.

1. Information we collect

Account information

When you create an account we collect your name, email address and the information needed to sign you in. If you choose Apple or Google sign-in, we receive the identity information supplied for that sign-in. Apple may supply a private relay email when you choose Hide My Email. If you complete a buyer or supplier profile, we also store the fields you provide, such as location, time zone, sales platforms, referral source, selling-setup answers, business hours, biography and profile photo.

Conversation content

We store the messages and files you send, product requests and supplier replies, order and invoice records, payment evidence, reviews, notes, reports and support conversations. Conversation metadata includes participants, timestamps, read and delivery status, reactions, typing and presence information used to operate conversations. See Section 6 for retention and account closure.

Usage and technical data

We collect basic technical information when you use the platform: your IP address, browser and device type, the pages you load, and timestamps. This is used to keep the service running, diagnose problems, and detect abuse.

iOS notifications, permissions and local storage

If you enable push notifications, the service registers an installation identifier, push token, app version, locale, time zone and notification settings. It uses the active conversation reference to avoid unnecessary notifications while you view that conversation. Apple provides the push-notification service. Apple sign-in also uses Apple's identity service. Supabase provides the app's authentication, database, file storage and realtime services.

You choose which photos and files to upload. Camera access is used when you choose to take a photo or scan a document. Push notifications are optional; you can change the system permission in iOS Settings and the notification categories and quiet hours in SupplierMafia.

The iOS app can keep local copies of conversations and downloaded content and preserve drafts and settings. Clearing downloaded content removes the relevant local cache; it does not delete the original server records.

What we do not collect

We do not run third-party advertising trackers or sell your data. Buyers pay suppliers directly. We do not provide a SupplierMafia card-payment checkout for those purchases, but we store invoice and payment-status records and the payment evidence you upload. Evidence can contain personal and financial details, including bank or transfer information. Upload only the information needed for the relevant transaction.

2. How we use your information

• To operate the platform: deliver your messages, render your invoice list, show you the suppliers in our network.
• To keep the platform safe: detect abuse, off-platform contact attempts, and policy violations.
• To communicate with you about the service: account notifications, security alerts, important changes.
• To improve the platform: understand which features are useful, where things break, what to build next.

3. Legal basis for processing (UK / EU users)

Where UK GDPR or EU GDPR applies to the relevant processing, the following lawful bases are used for the purposes described:

• Contract performance (Art. 6(1)(b)): processing your account, messages, and invoices is necessary to deliver the service you signed up for.
• Legitimate interests (Art. 6(1)(f)): keeping the platform secure, detecting abuse, preventing fraud, and improving the service. We balance these against your rights and only rely on this basis where the impact on you is limited.
• Legal obligation (Art. 6(1)(c)): retaining certain records for tax, accounting, or law-enforcement disclosure where required.
• Consent (Art. 6(1)(a)): for optional features like marketing emails, where consent is what triggers the processing. You can withdraw consent at any time from Settings.

4. Who can see your data

Other users on the platform

Anyone you share a conversation with can see your name, profile photo, and the messages you send in that conversation. Suppliers you have not opened a conversation with cannot see your private profile information.

SupplierMafia staff

Authorised administrators can access conversations and relevant account records for support, administration, security and moderation. Conversation content is processed by the service; the app does not provide end-to-end encryption that prevents authorised service access.

Service providers

The services below support the functions shown. Their role depends on the service and how it is used. They receive the information needed for the relevant function. Contact privacy@suppliermafia.com for questions about the providers used for your information, their processing locations or applicable transfer safeguards.

We will notify users at least 14 days in advance of adding a material new sub-processor that has access to user content. To object to a planned change, email privacy@suppliermafia.com before the effective date; we will respond before adding the processor.

Legal requirements

We may disclose information when required by law (court order, valid subpoena, regulatory request), or when necessary to protect the rights, property, or safety of SupplierMafia, our users, or the public. We push back on overbroad requests and notify the affected user where legally permitted to do so.

5. International transfers

The service uses providers and supplier relationships that can involve processing outside the country where you live. Processing locations depend on the relevant provider, service configuration and the people receiving the information. Where international-transfer rules apply, the transfer must meet those rules. For information about a particular provider, location or applicable safeguard, contact privacy@suppliermafia.com.

6. Retention

We keep personal information for as long as is necessary to provide the service and to meet legal obligations:

• Active accounts: kept while the account is in use.
• Account closure and retained records: the current account-closing flow clears selected profile fields, replaces the profile name with "Deleted user" and changes sign-in credentials. It retains an account reference and does not automatically erase every authentication record, message, invoice or uploaded file. Retained messages, images and commercial records may still identify someone; replacing a profile name does not make all of that content anonymous. To request erasure of remaining personal information, contact privacy@suppliermafia.com. Any retention exception must have an applicable basis and is not established merely because another participant wants to keep a record.
• Conversation history: closing an account does not automatically remove content previously exchanged with other participants. Retaining personal information still requires an applicable purpose and basis; another participant's wish to keep a copy does not establish an unrestricted retention period.
• Invoices and payment records: retention depends on the commercial record, any relevant dispute or legal claim, and the accounting or tax obligations that actually apply. A single tax-record period does not automatically apply to every user's invoice or payment evidence.
• Security and audit logs: retention depends on the information needed to investigate a specific security or abuse concern and any applicable record-keeping obligation. Contact the privacy address for information about a particular record.
• Marketing-email opt-outs and consent records: where retained, these records are used to record the relevant choice and avoid sending a message after its consent has been withdrawn. Retention must be limited to what is needed for that purpose or another applicable requirement.

7. Your rights

Where UK GDPR or EU GDPR applies, you have the following rights subject to the conditions and exceptions in that law:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate data. Most fields can be edited directly from Settings; email us for anything you can't change yourself.
• Erasure: you can initiate account closure from Settings. In the iOS app, open You → Settings → Account and choose account closure. Account closure and the erasure of every associated record are not the same operation; see Section 6. You can request erasure of remaining personal information through privacy@suppliermafia.com. We must handle the request under the law that applies, including any specific retention exceptions and response periods.
• Restriction — ask us to pause processing while a dispute is resolved.
• Portability: where this right applies, request the relevant information in a structured, commonly used and machine-readable format by emailing privacy@suppliermafia.com.
• Object — to processing based on legitimate interests, including profiling for fraud detection. We will weigh your objection against our legitimate interests case by case.
• Withdraw consent — where we rely on consent (e.g. announcement emails), turn it off in Settings.
• Complain — you can lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority in the EEA. We would appreciate the chance to address concerns first.

8. California residents (CCPA / CPRA)

Where the California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies to our processing of a California resident's information, the following rights apply subject to the law's conditions and exceptions:

• Right to know what personal information we collect, why, and who we share it with — this policy is our disclosure.
• Right to delete the personal information we hold about you, subject to legal retention exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing of personal information. We do not sell personal information and do not share it for cross-context behavioural advertising. There is no "Do Not Sell or Share" link required because there is nothing to opt out of.
• Right to non-discrimination — exercising any of these rights will not affect the price or quality of the service we offer you.
• Sensitive personal information: we do not collect or use SPI for any purpose beyond providing the service.

To exercise any California right, email privacy@suppliermafia.com. We will verify your identity before responding (typically by confirming you control the email tied to the account).

9. Cookies and similar technologies

We use a small number of cookies and similar technologies to keep you signed in, remember your preferences, and detect abuse. We also use Google Analytics 4 with Consent Mode v2 to understand aggregate platform usage, but only after you have explicitly accepted the analytics cookie banner. We do not use third-party advertising cookies and we do not run Google Ads. See the Cookies Policy for the full list and your controls. You can change your analytics choice at any time from the cookie banner (re-open via "Cookie preferences" in the footer).

10. Automated decision-making

We do not make decisions about you that have legal or similarly significant effects based solely on automated processing. Suspicious-activity detection may surface accounts to admins for review, but the final decision to suspend, warn, or close an account is always made by a human.

11. Security

The app uses HTTPS connections, Supabase authentication and account and role access controls. Authorised service access is described in Section 4. No platform can guarantee perfect security.

Personal-data breach response. If a security incident results in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to your personal data, we follow the timelines in UK GDPR Article 33 and 34:

• Within 72 hours of becoming aware of a notifiable breach, we notify the UK Information Commissioner's Office (and any other supervisory authority with jurisdiction). Where we cannot complete the assessment in 72 hours, we send an interim notification and follow up with further information as it becomes available, as Article 33(4) allows.
• Without undue delay, where the breach is likely to result in a high risk to your rights and freedoms, we contact you directly (Article 34). The notification will tell you, in plain language, what happened, what data was affected, what we are doing about it, and what you can do to protect yourself.
• Personal-data breaches must be documented as required by applicable law, including the facts, effects and action taken. Relevant records must be available to the supervisory authority where required.

For service incidents or privacy questions, contact privacy@suppliermafia.com. Breach-notification duties depend on the incident and the law that applies.

12. Children

SupplierMafia is intended for adult business users and its Terms require users to be at least 18. An age requirement does not establish that children cannot access the service. If you believe a child is using the service or their information has been provided, contact privacy@suppliermafia.com. Requests concerning that information must be handled under the law that applies, rather than relying on account closure as complete erasure.

13. Affiliate programme data

When an affiliate link is opened, we process the affiliate link used, time of visit, limited campaign/referrer information, a random one-use attribution token, and a pseudonymous first-party visitor identifier. We do not retain the raw IP address for affiliate reporting. Preview crawlers and known bots are classified separately and do not receive referral attribution.

For affiliate fraud prevention, our trusted application edge may normalise an IP address and immediately convert it into a keyed cryptographic hash. We use that pseudonymous hash to identify possible matches between affiliate access, the attributed referral journey, payment evidence, and invoice confirmation. We do not store the raw address in the affiliate fraud ledger, disclose hashes to affiliates, or automatically treat a match as proof of fraud. A match freezes only the affected commission for authorised human review. Pseudonymous IP evidence is normally deleted after 365 days.

If a new buyer registers through that journey, we retain the affiliate attribution, verification state, qualifying invoice totals, platform-fee and commission snapshots, reversals, adjustments, messages, payout records, and audit history. Affiliates receive masked customer references and commercial totals by default. For a limited number of approved affiliate partners, a senior administrator may enable access to the referred buyer's current SupplierMafia display name. This exception is controlled per affiliate and audit logged. A display name that resembles an email address, website, telephone number, or other contact information remains masked. Even when access is enabled, the affiliate does not receive the buyer's email address, account identifier, conversations, supplier details, payment proofs, moderation records, or other contact information. Authorised administrators can see the underlying referred user for support, fraud prevention, accounting, and dispute resolution.

For affiliate payouts we collect only the Wise recipient email, recipient/legal name, and country. We do not collect bank account numbers, IBANs, routing numbers, sort codes, SWIFT details, or card numbers in the affiliate portal. Financial and attribution records may be retained for up to seven years where required for accounting, tax, legal claims, and fraud prevention. Unclaimed click tokens expire after 30 days and raw click-event detail is normally removed after 90 days, while aggregate reporting is retained.

14. Changes to this policy

If we change this policy materially we will notify you in-app or by email at least 14 days before the changes take effect. The "Last updated" date at the top of this page always reflects the current version. We keep prior versions on request.

15. Contact

Questions about this policy or your data? Email privacy@suppliermafia.com and we will get back to you within five business days.