Demca — Privacy Policy
Effective date: 1 September 2026 Version: 1.0
1. Who we are
This Privacy Policy explains how AMALGAMA - FZCO, a free zone company licensed by the Dubai Integrated Economic Zones Authority (IFZA, Dubai Silicon Oasis), trade licence no. 50672, registered address Premises 50672-001, IFZA Business Park, Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates ("Amalgama", "we", "us"), handles information in connection with the Demca service at demca.online (the "Service").
Questions and requests: support@demca.online.
This policy should be read together with our Terms of Service.
2. Our role
2.1 Account, billing and usage information. We decide how and why this information is processed, and we are responsible for it as controller.
2.2 Personal data inside your documents. Charter parties, recaps and statements of facts may contain personal data of third parties, such as names and signatures of masters, agents and representatives. We process that information on your behalf and on your instructions, solely to provide the Service to you. You are responsible for having a lawful basis to upload it and for informing the people concerned where required.
3. What we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Account information | your e-mail address, login credentials (stored securely by our authentication provider, never in plain text), account creation date | you |
| Billing information | name, company name, billing address and tax number entered at checkout; subscription status and billing dates | you, via our payment provider |
| Payment card details | not collected by us. Card details are entered directly on our payment provider's page and never reach our systems | — |
| Your documents | the files you upload and their contents | you |
| Outputs | extracted data, timesheets, calculations and exports produced from your documents | generated by the Service |
| Service and usage information | error codes, processing times, counts, and a record of which fields were corrected during review (without the text of documents or timesheet rows) | generated by the Service |
| Technical information | IP address and browser information in server and security logs | your device |
| Support communications | messages you send us and our replies | you |
We do not use advertising or analytics trackers. The Service uses only the cookies and local storage strictly necessary to keep you signed in and to operate the application.
4. How we use information
We use information to:
- create and operate your account and provide the Service;
- read your documents and produce Outputs;
- process payments, issue invoices and manage your subscription;
- detect, investigate and fix errors, and keep the Service secure;
- respond to support requests;
- improve the accuracy and reliability of the Service using service and usage information (section 3), which does not include the text of your documents;
- comply with legal obligations, including accounting, tax and sanctions requirements;
- establish, exercise or defend legal claims.
We rely on the performance of our contract with you, our legitimate interests in operating, securing and improving the Service, compliance with legal obligations, and, where required, your consent.
5. Artificial intelligence processing
5.1 To extract information from your documents, the Service sends their contents to our artificial intelligence provider, Anthropic, through its commercial API.
5.2 Under Anthropic's commercial terms, inputs and outputs of its commercial API are not used to train its models by default. Data sent through the API is retained by Anthropic for no longer than thirty (30) days, subject to its published exceptions for trust and safety review and legal obligations.
5.3 We do not use the contents of your documents to train artificial intelligence models, and we do not use your documents to test or develop the Service without your consent.
5.4 Outputs are generated automatically. They are not decisions about you, and you review and correct them before relying on them, as described in our Terms of Service.
6. Who can access your documents
6.1 Your documents and Outputs are visible only to your account.
6.2 Authorised Amalgama personnel and contractors may access them, under confidentiality obligations and only as needed to provide support you request, investigate or fix an error affecting your account, keep the Service secure, or comply with the law.
6.3 We do not sell personal data or Customer Content, and we do not share it with third parties for their own marketing.
7. Our sub-processors
We use the following providers to operate the Service. Each processes data only as needed for the purpose shown.
| Provider | Purpose | Data involved | Location |
|---|---|---|---|
| Supabase | database, file storage, authentication, server functions | all Service data | European Union (Ireland) |
| Anthropic | artificial intelligence extraction of document contents | document contents during processing | United States |
| Stripe | payment processing, subscriptions and invoicing | billing information and card details (entered directly with Stripe) | United States and other countries where Stripe operates |
| Lovable, delivered through Cloudflare | hosting and delivery of the web application | technical information | global content delivery network |
| Zoho | support e-mail | support communications | United States |
We will update this list when we add or replace a sub-processor. Material changes will be notified as described in section 13.
8. International transfers
Our providers operate in several countries, including outside the United Arab Emirates. Where information is transferred abroad, we rely on appropriate safeguards available under applicable law, such as the provider's contractual commitments and data processing terms.
9. How long we keep information
| Information | Retention |
|---|---|
| Documents, timesheets, Outputs | until you delete the port call or voyage to which they belong |
| Account information | while your account is active, then as needed to comply with law or resolve disputes |
| Billing and invoice records | as long as required by applicable accounting and tax law |
| Operational event records (error codes, counts, processing times) | 365 days |
| Records of corrections made during review | retained to improve accuracy; they contain no text of documents or timesheet rows and are kept after the related port call is deleted |
| Server and security logs | according to our providers' log retention periods |
| Backups | deleted data may persist in backups until those backups expire in the normal cycle (7 days) |
10. Security
We protect information using measures appropriate to its nature, including encryption in transit, private file storage, access controls that restrict each account to its own data at database level, restricted internal access, and regular review of permissions. No system is completely secure; if we become aware of a breach affecting your personal data, we will notify you and the relevant authorities where required by law.
11. Your rights
Depending on the law that applies to you, you may have the right to access, correct, delete or obtain a copy of your personal data, to object to or restrict certain processing, and to withdraw consent where processing relies on it. You can delete documents, port calls and voyages yourself in the Service. For other requests, contact support@demca.online. We may need to verify your identity before responding.
If the request concerns personal data inside a document uploaded by one of our customers, we will refer it to that customer, who is responsible for it.
You may also have the right to complain to a data protection authority.
12. Eligibility
The Service is for business use by persons aged 18 or over. We do not knowingly collect information from children.
13. Changes to this policy
We may update this policy. We will notify you of material changes by e-mail or in the Service at least fourteen (14) days before they take effect. The version and effective date are shown at the top.
14. Contact
AMALGAMA - FZCO — support@demca.online Premises 50672-001, IFZA Business Park, Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates