Privacy policy

This policy covers the Ellanat website, the Ellanat mobile app and the Ellanat trade desk, all operated by Ellanat.

It is written for the people who actually use them: business owners, buyers, exporters and the staff on our own desk. Where a sentence could be short or precise, we have chosen precise.

• Your account — name, email, phone, the language you read in, and your password, which we store only as a hash we cannot reverse.
• Your business — trading name, legal name, registration and tax numbers, address, country, the categories you trade in, and the documents you upload for verification.
• What you trade — your requests, your quotes, your deals, your invoices, your shipping documents, and the messages you send through the platform.
• Payments — the amount, the currency, the rate, the reference and the account it came from or went to. We do not hold full card numbers.
• Technical — IP address, device and browser, the pages you open, and the time. Kept for security and for working out what is slow.

To run the trade: match a request to suppliers, present a quote, hold a payment, check a document, pay a supplier, raise an invoice.

To verify a business, which is our whole proposition, and to keep out the businesses that should not be here.

To meet legal obligations: tax records, customs paperwork, anti-money-laundering and sanctions checks, and the accounting records we are required to keep.

To tell you things you need to know about your own deals. Marketing is separate, is asked for separately, and can be switched off without touching the rest.

A verified supplier’s profile is public: trading name, country, province, categories, description, products, the verified badge, and reviews from completed deals. That is the point of being listed.

These are never public, and never shown to another user of the platform: your registration and tax documents, your payout account, your bank details, your personal phone and email, your requests, your quotes, your prices, your invoices, and your messages.

A buyer does not see a supplier’s name or contact details until the deal is agreed, and a supplier never sees the buyer’s. That is a deliberate part of how Ellanat works, described in section 11 of the terms — not an accident of configuration.

Our own staff, limited to the people whose job needs it — the desk agent on your deal, the document reviewer, the finance officer releasing the payment. Access is by role and is logged.

Service providers under contract: hosting, email and SMS delivery, and payment processing. They act on our instructions and may not use your data for anything else.

Banks and money-service businesses, where that is how a payment or a payout has to move.

Authorities, where we are legally required — a tax authority, a customs authority, a court order, a sanctions obligation. We do not hand over data on an informal request.

We do not sell your data. We do not rent your contact details to anybody, and we do not pass a buyer’s details to a supplier or the other way round.

On servers we control, with the database and the document store encrypted at rest and every connection encrypted in transit.

Deal records, invoices and payment records are kept for seven years after the deal closes, because tax and accounting law requires it and because a dispute about a shipment can arrive long after the shipment did.

Verification documents are kept while the business is listed and for five years after, for the same reason.

An account you close is closed: the profile comes off the site, and what remains is the record above, which we are not free to delete.

Technical logs are kept for 12 months.

A copy of what we hold about you, in a form you can read.

A correction, where something is wrong. You can change most of it yourself on your own profile.

Deletion of what we are not required to keep — see section 6 for what we are.

An end to marketing, at any time, without giving a reason.

Write to privacy@ellanat.com. We answer within 30 days, and sooner where we can.

Passwords are hashed, never stored as text. Sessions expire. Actions that move money or change a payout account require a second confirmation from the person doing them.

Every read and every change to a record that matters is written to an audit log with who did it and when. That log cannot be edited, including by us.

If a breach ever affects your data, we will tell you what happened, what it touched and what to do about it — and we will tell you promptly rather than after we have finished being embarrassed.

Ellanat is for businesses. We do not knowingly collect anything about anyone under 18, and an account we find to belong to a minor is closed.

The date at the top says when this policy last changed. A material change is notified to the address on your account before it takes effect.

Questions, requests and complaints: privacy@ellanat.com.