This Privacy Policy explains how Majorbird HK [LEGAL ENTITY NAME TO CONFIRM] ("Majorbird", "we", "us") collects and uses personal data in connection with BerthTime, our container and shipment tracking service (the "Service"), including its website, web application, API, webhooks and integrations.
The Service is a business-to-business product. The people whose personal data we handle are mainly the employees and contractors of our business customers who use the Service, and visitors to our website.
1. Who is responsible
Controller for account and website data. Majorbird is the controller (in Hong Kong terms, the "data user") for personal data about our customers' account holders and users, our billing contacts and website visitors, as described in sections 3 to 5.
Processor for customer data. When our customers submit data to the Service (for example shipment references, their own references, tags, notes and webhook settings), the customer decides what is submitted and why. For any personal data contained in that customer data we act as a processor (service provider) on the customer's behalf and only on its instructions. Questions about that data should go to the customer concerned. We offer customers a data processing agreement (DPA), including the EU Standard Contractual Clauses where needed, on request at odoo@majorbird.com.
Contact. Majorbird HK [LEGAL ENTITY NAME TO CONFIRM], Room 1123, 11/F., Star House, 3 Salisbury Road, Tsim Sha Tsui, Kowloon, Hong Kong. Email: odoo@majorbird.com. [EU REPRESENTATIVE UNDER GDPR ART. 27 AND UK REPRESENTATIVE — TO CONFIRM WITH COUNSEL WHETHER REQUIRED] [PIPL REPRESENTATIVE IN MAINLAND CHINA UNDER ART. 53 — TO CONFIRM WITH COUNSEL WHETHER REQUIRED]
2. Which laws we follow
We operate from Hong Kong and serve business customers worldwide. Depending on where you are, the following laws may apply to our handling of your personal data, and we have written this policy with them in mind:
- the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO");
- the EU General Data Protection Regulation ("GDPR") and the UK GDPR, where we offer the Service to people in the European Economic Area or the United Kingdom;
- the Personal Information Protection Law of the People's Republic of China ("PIPL"), where we process personal information of individuals in mainland China;
- United States state privacy laws, to the extent they apply to a business-to-business service of our size.
3. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, business email address, company name, role in the company workspace, password (stored only as a one-way hash), account status, last login time | You, or the colleague who invites you |
| Security and session data | Session identifiers (stored as hashes), browser user agent, IP address of sessions, failed login and sign-up attempts, proof-of-work challenge records | Your device, when you use the Service |
| Usage and abuse-prevention metrics | Per-minute request counts per company, user, API key and IP address; error and rate-limit counts | Generated by the Service |
| Audit log | Security-relevant actions in your workspace (for example sign-in, invitations, API key creation, settings changes), the acting user or API key, time and IP address | Generated by the Service |
| API keys and integrations | API key name and prefix (the key itself is stored only as a hash), webhook URLs and their delivery logs, AI assistant connections | You |
| Billing data | Billing contact, company address, tax number, plan, invoices and payment status. Card details are collected and held by Stripe, not by us | You and Stripe |
| Communications | Emails and support requests you send us and our replies | You |
| Website analytics and advertising measurement (only with your consent where required, see section 5) | Pages viewed, approximate location derived from the IP address, device and browser type, the ad or link that brought you to the site, and steps such as sign-up, email confirmation, checkout start and purchase (plan, billing interval, price) | Your device, through Google Analytics and Google Ads tags |
| Sign-up source | For the first visit of the browser used to sign up: campaign parameters in the link (utm_source, utm_medium, utm_campaign, utm_term, utm_content), the Google Ads click identifier (gclid), the referring site (address without query string), the landing page and the date | Your device, sent with the sign-up form |
| Customer data (we act as processor) | Shipment references, your own references and tags, and any personal data you choose to include in them; carrier credentials you connect | You |
Tracking data about containers, vessels and voyages is generally not personal data. We ask customers not to put personal data (for example names of private individuals) in free-text fields such as references, tags or notes unless it is necessary.
We do not knowingly collect sensitive categories of data, and the Service is not intended for children.
4. How we use personal data and our legal bases
| Purpose | Data used | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Create and run your account, authenticate you, provide the Service and support | Account, session, API key and integration data | Performance of our contract with your company, and our legitimate interest in providing the Service to the business you work for |
| Keep the Service secure: rate limiting, abuse and fraud prevention, bot protection, investigating incidents | Session data, usage metrics, audit log, IP addresses | Legitimate interests (security and integrity of the Service); legal obligations where applicable |
| Measure usage for billing (Tracked Shipments) and enforce plan limits | Usage records linked to your company | Performance of contract |
| Billing, invoicing, accounting and tax | Billing data | Performance of contract; legal obligation (accounting and tax records) |
| Service messages: security notices, changes to terms, usage warnings, invoices | Account data | Performance of contract; legitimate interests |
| Improve the Service, for example ETA accuracy and carrier coverage | Aggregated or de-identified usage data | Legitimate interests |
| Measure website traffic and the results of our advertising (Google Analytics, Google Ads conversions) | Website analytics and advertising measurement data | Consent where required by law (for example in the EEA, the UK and Switzerland); elsewhere our legitimate interest in measuring our marketing, with the option to refuse in the cookie settings |
| Know which marketing channels bring customers and what they cost | Sign-up source, linked to the company account | Legitimate interests (understanding and budgeting our marketing) |
| Product news by email | Business email address | Legitimate interests for existing business customers, with an opt-out in every message; consent where required by local law |
| Comply with law and enforce our terms | Any relevant data | Legal obligation; legitimate interests (establishing, exercising or defending legal claims) |
Under the PIPL, we process personal information where it is necessary to conclude or perform a contract to which the individual is a party, where necessary for human resources management under a lawful employment policy of our customer, or with consent where consent is required. Under the PDPO, we use personal data for the purposes stated in this policy, which is our Personal Information Collection Statement, or for directly related purposes.
We do not sell personal data, we do not share it for cross-context behavioural advertising, and we do not make decisions that produce legal or similarly significant effects about individuals based solely on automated processing.
5. Cookies and similar technologies
Strictly necessary. These run the Service and are always on:
| Name | Type | Purpose | Duration |
|---|---|---|---|
keelson_session | HTTP-only, secure cookie | Keeps you signed in | Until you sign out, or up to 30 days |
keelson_company | HTTP-only cookie | Remembers which company workspace is selected | Up to 12 months |
bt_consent | Cookie | Remembers your cookie choice | 6 months |
| Selected workspace and sidebar state | Browser local storage | Interface preferences (selected workspace, collapsed sidebar) | Until you clear them |
Analytics and advertising (optional). On our main website we use Google Analytics 4 to measure traffic and Google Ads to measure which ads lead to a sign-up or a purchase:
| Name | Set by | Category | Purpose | Duration |
|---|---|---|---|---|
_ga, _ga_<id> | Google Analytics (first-party cookie) | Analytics | Distinguishes visits to count pages and sign-up steps | Up to 2 years |
_gcl_au, _gcl_aw and other _gcl_* | Google Ads (first-party cookie) | Advertising | Links a visit to the ad that was clicked, to count conversions | Up to 90 days |
bt_attr | BerthTime (first-party cookie) | Advertising | Remembers the campaign or site that brought you, sent with the sign-up form | 90 days |
| Purchase marker | BerthTime (browser local storage) | Analytics | Avoids counting the same purchase twice | Until you clear it |
How consent works:
- A banner lets you Accept, Reject or choose per category in Settings. You can change your choice at any time with the "Cookie settings" link in the website footer. Withdrawing consent deletes the analytics and advertising cookies above from our domain.
- If your browser's time zone is in the European Economic Area, the United Kingdom, Switzerland, mainland China or Brazil, nothing is loaded from Google and none of the optional cookies are set until you click Accept or enable a category. In addition, Google's consent mode treats visitors from those countries (by IP address) as not having consented until they do.
- Elsewhere, the optional cookies are on by default and the banner lets you turn them off. Rejecting stops them for future pages and deletes them.
- We use Google's consent mode. While a category is refused, Google tags do not read or write cookies for it, but Google may receive cookieless signals (for example that a page was viewed, without identifiers) that it uses in aggregate to model results. When advertising is refused, ad click identifiers are redacted.
- The Google tags are not loaded on links that contain a private token (shared tracking pages, invitations, password reset, unsubscribe), and we remove tokens and similar parameters from page addresses before they are sent to Google.
We do not use these cookies for remarketing or personalised advertising audiences, and we do not sell personal data. The sign-up bot protection runs on our own servers without third-party scripts.
Even without these cookies, the sign-up form sends the campaign parameters and referring site of the current visit (see "Sign-up source" in section 3), which we keep with the account to know which channels bring customers.
6. Who we share personal data with
We share personal data only with the service providers (subprocessors) we need to run the Service, under contracts that require them to protect it, and otherwise only as described below.
| Subprocessor | Service | Data | Location |
|---|---|---|---|
| OVH Singapore Pte. Ltd. (OVHcloud) | Server hosting for the application and database | All Service data | Singapore |
| Alibaba Cloud (Singapore) Private Limited | Object storage for encrypted database backups | All Service data, encrypted with AES-256 before upload | Singapore |
| Stripe, Inc. and affiliates [ONCE BILLING IS LIVE] | Payment processing, invoices, customer billing portal | Billing data, billing contact name and email | United States and other Stripe locations |
| Google Ireland Limited (for the EEA and Switzerland) and Google LLC (elsewhere) | Google Analytics 4 and Google Ads conversion measurement on the website, when allowed by your cookie choice | Website analytics and advertising measurement data | Ireland, United States and other Google locations |
| [EMAIL PROVIDER TO CONFIRM] [ONCE LIVE] | Sending transactional email (invitations, password resets, alerts) | Name, email address, message content | [TO CONFIRM] |
Data sources (carriers and aggregators). To track a shipment we send the shipment reference (container number, bill of lading or booking number) to the relevant carrier or a tracking data aggregator (currently Findteu), and, where you connect them, your own carrier credentials to that carrier. We do not send your name, email address or other account data to carriers or aggregators. A shipment reference is not normally personal data.
Integrations you choose. If you configure a webhook, connect an AI assistant through our MCP endpoint, or connect an ERP system such as Odoo, we send the data you request to that destination. That destination is chosen and controlled by you and is not our subprocessor.
Other disclosures. We may disclose personal data: to our professional advisers under confidentiality; to a buyer or successor in a merger, acquisition or sale of the business, subject to this policy; and where required by law, a court order or a competent authority, after checking the request is lawful and, where permitted, informing the customer concerned.
We will update the subprocessor list before adding a new subprocessor that processes customer data. Customers who have signed our DPA can subscribe to notice of changes and object as set out in the DPA.
7. International transfers
Our Service is hosted in Singapore and operated from Hong Kong. If you are located elsewhere, your personal data will be transferred to, stored in and accessed from Singapore and Hong Kong, and, for payment processing and (with your consent where required) website analytics and advertising measurement, the United States.
- From the EEA, UK and Switzerland: these countries do not currently have an adequacy decision from the European Commission or the UK. Where GDPR applies, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) with our customers and subprocessors, together with supplementary measures such as encryption in transit and of backups, access control and data minimisation.
- From mainland China: where the PIPL applies, we will rely on an applicable transfer mechanism (such as the standard contract for outbound transfers of personal information, or an exemption available for transfers necessary to perform a contract), inform individuals as required, and obtain separate consent where the PIPL requires it. [MECHANISM TO CONFIRM WITH COUNSEL]
- From Hong Kong: we take reasonable steps so that personal data transferred outside Hong Kong is protected to a standard comparable to the PDPO.
8. How long we keep personal data
| Data | Retention |
|---|---|
| Account data | For as long as the Account exists. Deleted within 30 days after the Account is closed, unless we must keep it longer by law |
| Customer data | For as long as the Account exists, then available for export for 30 days and deleted (see the Terms of Service) |
| Usage and abuse-prevention metrics, including IP addresses | 35 days, then automatically deleted |
| Failed login and sign-up records | 35 days, then automatically deleted |
| Sessions | Expire after up to 30 days or at sign-out [AUTOMATIC DELETION OF EXPIRED SESSION RECORDS — TO IMPLEMENT] |
| Audit log | For the life of the Account [TARGET: 12 MONTHS ROLLING — TO IMPLEMENT] |
| Webhook delivery logs | [TARGET: 90 DAYS — TO IMPLEMENT] |
| Database backups | Encrypted backups are kept on a rotation of 7 daily and 4 weekly copies, so data deleted from the live system disappears from backups within about 35 days |
| Invoices and accounting records | 7 years, as required by Hong Kong tax and company law |
| Support emails | Up to 3 years after the last contact |
| Google Analytics event data | 14 months (Google Analytics data retention setting), then deleted by Google |
| Sign-up source stored with the account | For as long as the Account exists |
9. Security
We protect personal data with measures appropriate to the risk, including: encryption in transit (HTTPS); passwords stored only as salted one-way hashes; API keys and session tokens stored only as hashes; tenant isolation between company workspaces; role-based access; rate limiting and bot protection; encryption of backups with AES-256 before they leave our servers; restricted administrative access; and logging of security-relevant actions. If a personal data breach occurs, we will notify affected customers and, where required, the competent authorities, within the time limits that apply (for example 72 hours under the GDPR).
10. Your rights
Depending on the law that applies to you, you may have the right to:
- access the personal data we hold about you and receive a copy;
- correct inaccurate data;
- delete your data;
- restrict or object to certain processing, including processing based on legitimate interests and direct marketing;
- receive your data in a portable format;
- withdraw consent where processing is based on consent;
- under the PIPL, ask us to explain our processing rules, and, after a death, for close relatives to exercise certain rights;
- under the PDPO, request access to and correction of your personal data (we may charge a fee that is not excessive for a data access request, as the PDPO allows).
You can update your name and password in the application settings. For other requests, email odoo@majorbird.com. We will reply within one month (40 days for PDPO data access requests), and may need to verify your identity. If your request concerns customer data that we process for your employer or another customer, we will pass it to that customer and assist them.
You also have the right to complain to a data protection authority, for example the supervisory authority of your EU member state, the UK Information Commissioner's Office, the Office of the Privacy Commissioner for Personal Data in Hong Kong, or the Cyberspace Administration of China. We would appreciate the chance to address your concern first.
11. Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top shows the current version. For material changes we will notify account owners by email or in the application before the change takes effect.
12. Contact
Majorbird HK [LEGAL ENTITY NAME TO CONFIRM] Room 1123, 11/F., Star House, 3 Salisbury Road, Tsim Sha Tsui, Kowloon, Hong Kong Email: odoo@majorbird.com