Legal
Privacy Policy
Last updated: 20 September 2026
This policy explains how we handle personal data on this website and in the SmartLaycan platform. It covers two different situations that are easy to confuse: what happens when you simply visit smartlaycan.com, and what happens to correspondence inside a SmartLaycan installation run by a shipbroking desk.
1. Who we are
SmartLaycan is built and operated by Individual Entrepreneur Oleh Stepanov, registered in Ukraine under registration number (TIN) 3060215653.
- Registered address
- 14 Kosmonavtiv Street, apt. 8, Odesa, 65080, Ukraine
- info@smartlaycan.com
- Phone
- +380 50 392 0996
Write to info@smartlaycan.com with any privacy question or request; that address reaches us directly.
2. This website
This website is informational. It sets no cookies, runs no analytics, and loads nothing from third-party servers — the fonts, the brand marks and the map image are served from this domain itself. It contains no forms and collects nothing from you as you read it.
The only way this site passes anything to us is the “Book a demo” link, which opens your own email program. If you write to us, we process what you choose to send — typically your name, email address, company and your question — in order to answer it and, where it leads to one, to prepare a commercial proposal. Our legal basis is our legitimate interest in responding to business enquiries and in taking steps at your request before entering a contract.
3. The SmartLaycan platform: who decides what
SmartLaycan is software supplied to a shipbroking desk and run for that desk. The customer decides what correspondence enters it and what is done with the results, and is therefore the controller of that data. We act as a processor: we supply and maintain the software and act on the customer's documented instructions.
A customer's installation keeps its records in its own PostgreSQL database, dedicated to that customer and never pooled with another customer's. We do not operate a shared pool of customer correspondence, and we do not use customer correspondence to train models of our own.
4. What the platform processes
- Business contact details — names, email addresses, phone numbers, company names and roles of the desk's counterparties: shipowners, operators, charterers, brokers and agents.
- Chartering correspondence — the content of emails and messages reaching the desk: vessel positions, cargo orders, offers, replies and the negotiations around them, together with the attachments sent with them.
- Records the desk creates — the structured positions and orders extracted from that correspondence, the cases built on it, and the decisions brokers take, each signed with the name of the person who took it.
Most of this is ordinary business-to-business contact data that counterparties circulate themselves in the course of the chartering market.
5. How correspondence reaches the platform
- Email. The desk authorises SmartLaycan to read its own mailbox through the Google Gmail API, under credentials the customer holds and can revoke at any time.
- WhatsApp. Where the desk uses WhatsApp for chartering, messages reach the platform through the WhatsApp Business Platform — see section 7.
6. Reading correspondence with a language model
Turning a free-text circular into structured records is done by a language model, and the customer chooses the route:
- a dedicated GPU under the customer's or our control, where the message never reaches a third-party model provider; or
- a zero-data-retention route through a model router, where the message is passed to a model provider under terms that forbid the provider from retaining it or training on it. On this route the message text does leave the customer's machine and is seen by the provider that answers.
Which route an installation uses is a setting of that installation, and the customer is told which one is in force.
7. WhatsApp Business Platform
SmartLaycan integrates with the WhatsApp Business Platform, operated by Meta Platforms, so that a desk can receive and answer chartering messages in the same place as its email.
- The account stays with the customer. The customer connects its own WhatsApp Business Account and its own phone number, and remains the owner of both. Connecting grants SmartLaycan access to send and receive on the customer's behalf; the customer can withdraw that access at any time from its own WhatsApp settings.
- What is processed — the phone number and WhatsApp profile name of the person writing to the desk, the content of the messages and their attachments, and the delivery and read statuses Meta reports back.
- Meta's own role. Messages travel through Meta's infrastructure, and Meta processes them under its own terms as the platform provider. WhatsApp's terms and privacy policy apply to your use of WhatsApp alongside this policy.
- The name in the chat is the desk's, not ours. Counterparties correspond with the broker they already know.
If you contacted a shipbroking desk on WhatsApp and want to know how that desk uses your data, ask the desk: it is the controller. We will help it answer.
8. Who else is involved
Beyond the customer's own installation, these providers may process data in the course of the service:
- Cloudflare — serves this website and, where a desk publishes its workspace, carries and guards that connection.
- Meta Platforms — the WhatsApp Business Platform, where WhatsApp is in use.
- Google — the Gmail API, where the desk's mail is read from Gmail.
- A model router and the model provider that answers — where the zero-data-retention route of section 6 is in use.
We do not sell personal data, and we do not share it for advertising.
9. International transfers
We are established in Ukraine, and the providers above operate internationally, so data may be processed outside the country where it was collected. Where data protected by the GDPR is transferred, we rely on the appropriate safeguards available to us, including the European Commission's standard contractual clauses in the arrangements of the providers concerned.
10. Retention
Correspondence inside a customer's installation is retained for as long as the customer keeps it: the value of a chartering archive is that it reaches back years, and the retention decision is the customer's. Enquiries sent to us by email are kept for as long as the commercial conversation remains live and afterwards as our accounting and legal obligations require.
11. Security
A customer's records stay in that customer's own database, access to a desk is behind authentication, every shared change is written to an audit log against the name of the person who made it, and messages travel over encrypted connections.
12. Your rights
Depending on where you are, you may have the right to ask for access to your personal data, its correction or deletion, to object to or restrict its processing, and to receive it in a portable form. Write to info@smartlaycan.com. Where the data sits inside a customer's installation we will pass the request to that customer, who decides it, and assist them in answering you. If you believe we have handled your data wrongly you may also complain to your local supervisory authority.
13. Deleting your data
To have your data deleted, write to info@smartlaycan.com from the address or about the phone number concerned, say what you want removed, and we will confirm when it is done. Where we hold the data ourselves — an enquiry you sent us — we delete it on request. Where the data sits inside a customer's own installation, the deletion decision belongs to that customer as the controller; we pass the request on without delay, tell you who it went to, and carry out the deletion once the customer instructs it.
If you connected a WhatsApp Business Account to SmartLaycan, you can also cut our access yourself at any time from your WhatsApp Business settings. Doing so stops any further processing; to have what was already received deleted as well, write to the address above.
14. Changes
We may update this policy as the service changes. The current version always lives at this address, and the date at the top says when it last changed.