This Privacy Policy explains how Majorbird HK [LEGAL ENTITY NAME TO CONFIRM] ("Majorbird", "we", "us") collects and uses personal data in connection with BerthTime, our container and shipment tracking service (the "Service"), including its website, web application, API, webhooks and integrations.
The Service is a business-to-business product. The people whose personal data we handle are mainly the employees and contractors of our business customers who use the Service, and visitors to our website.
1. Who is responsible
Controller for account and website data. Majorbird is the controller (in Hong Kong terms, the "data user") for personal data about our customers' account holders and users, our billing contacts and website visitors, as described in sections 3 to 5.
Processor for customer data. When our customers submit data to the Service (for example shipment references, their own references, tags, notes and webhook settings), the customer decides what is submitted and why. For any personal data contained in that customer data we act as a processor (service provider) on the customer's behalf and only on its instructions. Questions about that data should go to the customer concerned. We offer customers a data processing agreement (DPA), including the EU Standard Contractual Clauses where needed, on request at odoo@majorbird.com.
Contact. Majorbird HK [LEGAL ENTITY NAME TO CONFIRM], Room 1123, 11/F., Star House, 3 Salisbury Road, Tsim Sha Tsui, Kowloon, Hong Kong. Email: odoo@majorbird.com. [EU REPRESENTATIVE UNDER GDPR ART. 27 AND UK REPRESENTATIVE — TO CONFIRM WITH COUNSEL WHETHER REQUIRED] [PIPL REPRESENTATIVE IN MAINLAND CHINA UNDER ART. 53 — TO CONFIRM WITH COUNSEL WHETHER REQUIRED]
2. Which laws we follow
We operate from Hong Kong and serve business customers worldwide. Depending on where you are, the following laws may apply to our handling of your personal data, and we have written this policy with them in mind:
- the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO");
- the EU General Data Protection Regulation ("GDPR") and the UK GDPR, where we offer the Service to people in the European Economic Area or the United Kingdom;
- the Personal Information Protection Law of the People's Republic of China ("PIPL"), where we process personal information of individuals in mainland China;
- United States state privacy laws, to the extent they apply to a business-to-business service of our size.
3. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, business email address, company name, role in the company workspace, password (stored only as a one-way hash), account status, last login time | You, or the colleague who invites you |
| Security and session data | Session identifiers (stored as hashes), browser user agent, IP address of sessions, failed login and sign-up attempts, proof-of-work challenge records | Your device, when you use the Service |
| Usage and abuse-prevention metrics | Per-minute request counts per company, user, API key and IP address; error and rate-limit counts | Generated by the Service |
| Audit log | Security-relevant actions in your workspace (for example sign-in, invitations, API key creation, settings changes), the acting user or API key, time and IP address | Generated by the Service |
| API keys and integrations | API key name and prefix (the key itself is stored only as a hash), webhook URLs and their delivery logs, AI assistant connections | You |
| Billing data | Billing contact, company address, tax number, plan, invoices and payment status. Card details are collected and held by Stripe, not by us | You and Stripe |
| Communications | Emails and support requests you send us and our replies | You |
| Customer data (we act as processor) | Shipment references, your own references and tags, and any personal data you choose to include in them; carrier credentials you connect | You |
Tracking data about containers, vessels and voyages is generally not personal data. We ask customers not to put personal data (for example names of private individuals) in free-text fields such as references, tags or notes unless it is necessary.
We do not knowingly collect sensitive categories of data, and the Service is not intended for children.
4. How we use personal data and our legal bases
| Purpose | Data used | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Create and run your account, authenticate you, provide the Service and support | Account, session, API key and integration data | Performance of our contract with your company, and our legitimate interest in providing the Service to the business you work for |
| Keep the Service secure: rate limiting, abuse and fraud prevention, bot protection, investigating incidents | Session data, usage metrics, audit log, IP addresses | Legitimate interests (security and integrity of the Service); legal obligations where applicable |
| Measure usage for billing (Tracked Shipments) and enforce plan limits | Usage records linked to your company | Performance of contract |
| Billing, invoicing, accounting and tax | Billing data | Performance of contract; legal obligation (accounting and tax records) |
| Service messages: security notices, changes to terms, usage warnings, invoices | Account data | Performance of contract; legitimate interests |
| Improve the Service, for example ETA accuracy and carrier coverage | Aggregated or de-identified usage data | Legitimate interests |
| Product news by email | Business email address | Legitimate interests for existing business customers, with an opt-out in every message; consent where required by local law |
| Comply with law and enforce our terms | Any relevant data | Legal obligation; legitimate interests (establishing, exercising or defending legal claims) |
Under the PIPL, we process personal information where it is necessary to conclude or perform a contract to which the individual is a party, where necessary for human resources management under a lawful employment policy of our customer, or with consent where consent is required. Under the PDPO, we use personal data for the purposes stated in this policy, which is our Personal Information Collection Statement, or for directly related purposes.
We do not sell personal data, we do not share it for cross-context behavioural advertising, and we do not make decisions that produce legal or similarly significant effects about individuals based solely on automated processing.
5. Cookies and similar technologies
We use only what is strictly necessary to run the Service:
| Name | Type | Purpose | Duration |
|---|---|---|---|
keelson_session | HTTP-only, secure cookie | Keeps you signed in | Until you sign out, or up to 30 days |
keelson_company | HTTP-only cookie | Remembers which company workspace is selected | Up to 12 months |
| Selected workspace and sidebar state | Browser local storage | Interface preferences (selected workspace, collapsed sidebar) | Until you clear them |
We do not use advertising cookies, analytics or tracking cookies, or third-party tracking scripts, and the sign-up bot protection runs on our own servers without third-party scripts. Because we only use strictly necessary technologies, we do not show a cookie consent banner. If we ever add analytics or other non-essential cookies, we will update this policy and ask for consent where required.
6. Who we share personal data with
We share personal data only with the service providers (subprocessors) we need to run the Service, under contracts that require them to protect it, and otherwise only as described below.
| Subprocessor | Service | Data | Location |
|---|---|---|---|
| OVH Singapore Pte. Ltd. (OVHcloud) | Server hosting for the application and database | All Service data | Singapore |
| Alibaba Cloud (Singapore) Private Limited | Object storage for encrypted database backups | All Service data, encrypted with AES-256 before upload | Singapore |
| Stripe, Inc. and affiliates [ONCE BILLING IS LIVE] | Payment processing, invoices, customer billing portal | Billing data, billing contact name and email | United States and other Stripe locations |
| [EMAIL PROVIDER TO CONFIRM] [ONCE LIVE] | Sending transactional email (invitations, password resets, alerts) | Name, email address, message content | [TO CONFIRM] |
Data sources (carriers and aggregators). To track a shipment we send the shipment reference (container number, bill of lading or booking number) to the relevant carrier or a tracking data aggregator (currently Findteu), and, where you connect them, your own carrier credentials to that carrier. We do not send your name, email address or other account data to carriers or aggregators. A shipment reference is not normally personal data.
Integrations you choose. If you configure a webhook, connect an AI assistant through our MCP endpoint, or connect an ERP system such as Odoo, we send the data you request to that destination. That destination is chosen and controlled by you and is not our subprocessor.
Other disclosures. We may disclose personal data: to our professional advisers under confidentiality; to a buyer or successor in a merger, acquisition or sale of the business, subject to this policy; and where required by law, a court order or a competent authority, after checking the request is lawful and, where permitted, informing the customer concerned.
We will update the subprocessor list before adding a new subprocessor that processes customer data. Customers who have signed our DPA can subscribe to notice of changes and object as set out in the DPA.
7. International transfers
Our Service is hosted in Singapore and operated from Hong Kong. If you are located elsewhere, your personal data will be transferred to, stored in and accessed from Singapore and Hong Kong, and, for payment processing, the United States.
- From the EEA, UK and Switzerland: these countries do not currently have an adequacy decision from the European Commission or the UK. Where GDPR applies, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) with our customers and subprocessors, together with supplementary measures such as encryption in transit and of backups, access control and data minimisation.
- From mainland China: where the PIPL applies, we will rely on an applicable transfer mechanism (such as the standard contract for outbound transfers of personal information, or an exemption available for transfers necessary to perform a contract), inform individuals as required, and obtain separate consent where the PIPL requires it. [MECHANISM TO CONFIRM WITH COUNSEL]
- From Hong Kong: we take reasonable steps so that personal data transferred outside Hong Kong is protected to a standard comparable to the PDPO.
8. How long we keep personal data
| Data | Retention |
|---|---|
| Account data | For as long as the Account exists. Deleted within 30 days after the Account is closed, unless we must keep it longer by law |
| Customer data | For as long as the Account exists, then available for export for 30 days and deleted (see the Terms of Service) |
| Usage and abuse-prevention metrics, including IP addresses | 35 days, then automatically deleted |
| Failed login and sign-up records | 35 days, then automatically deleted |
| Sessions | Expire after up to 30 days or at sign-out [AUTOMATIC DELETION OF EXPIRED SESSION RECORDS — TO IMPLEMENT] |
| Audit log | For the life of the Account [TARGET: 12 MONTHS ROLLING — TO IMPLEMENT] |
| Webhook delivery logs | [TARGET: 90 DAYS — TO IMPLEMENT] |
| Database backups | Encrypted backups are kept on a rotation of 7 daily and 4 weekly copies, so data deleted from the live system disappears from backups within about 35 days |
| Invoices and accounting records | 7 years, as required by Hong Kong tax and company law |
| Support emails | Up to 3 years after the last contact |
9. Security
We protect personal data with measures appropriate to the risk, including: encryption in transit (HTTPS); passwords stored only as salted one-way hashes; API keys and session tokens stored only as hashes; tenant isolation between company workspaces; role-based access; rate limiting and bot protection; encryption of backups with AES-256 before they leave our servers; restricted administrative access; and logging of security-relevant actions. If a personal data breach occurs, we will notify affected customers and, where required, the competent authorities, within the time limits that apply (for example 72 hours under the GDPR).
10. Your rights
Depending on the law that applies to you, you may have the right to:
- access the personal data we hold about you and receive a copy;
- correct inaccurate data;
- delete your data;
- restrict or object to certain processing, including processing based on legitimate interests and direct marketing;
- receive your data in a portable format;
- withdraw consent where processing is based on consent;
- under the PIPL, ask us to explain our processing rules, and, after a death, for close relatives to exercise certain rights;
- under the PDPO, request access to and correction of your personal data (we may charge a fee that is not excessive for a data access request, as the PDPO allows).
You can update your name and password in the application settings. For other requests, email odoo@majorbird.com. We will reply within one month (40 days for PDPO data access requests), and may need to verify your identity. If your request concerns customer data that we process for your employer or another customer, we will pass it to that customer and assist them.
You also have the right to complain to a data protection authority, for example the supervisory authority of your EU member state, the UK Information Commissioner's Office, the Office of the Privacy Commissioner for Personal Data in Hong Kong, or the Cyberspace Administration of China. We would appreciate the chance to address your concern first.
11. Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top shows the current version. For material changes we will notify account owners by email or in the application before the change takes effect.
12. Contact
Majorbird HK [LEGAL ENTITY NAME TO CONFIRM] Room 1123, 11/F., Star House, 3 Salisbury Road, Tsim Sha Tsui, Kowloon, Hong Kong Email: odoo@majorbird.com