Privacy Policy

Bulugo Ltd is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, share and protect personal data when you use our website, platform, APIs, MCP tools, chat-based services and related services.

Bulugo Ltd is a company registered in England and Wales with company number 11184003. Our registered office is 278 Northfield Avenue, London, England, W5 4UB. Bulugo Ltd is the controller of personal data processed under this Privacy Policy, except where we state otherwise or process data on behalf of another controller under separate terms.

1. Personal data we collect

We may collect and process the following categories of personal data:

• Identity and contact data: name, work email address, telephone number, company name, job title, country, address and business contact details.
• Account and access data: username, account settings, authorised users, login details, security events and access permissions.
• Business and lead data: quote requests, port requirements, vessel information, product interests, supplier capabilities, buyer requirements, lead history, introductions, messages and related commercial information.
• Chat and communications data: messages, attachments, voice notes, metadata and other communications sent through website forms, email, WhatsApp, Telegram or other integrated messaging channels.
• API, MCP and usage data: API keys, MCP credentials, calls, request metadata, feature usage, logs, rate-limit information, device identifiers and interaction history.
• Technical data: IP address, browser type and version, operating system, time zone, device information, referral source, pages visited, errors, session data and cookie identifiers.
• Marketing data: communication preferences, campaign engagement, survey responses and event interactions.
• Billing data: billing contact details, invoices and payment status if paid services apply. If we use a payment provider such as Stripe, it may process payment details under its own terms. Bulugo does not intend to store full card numbers.
• Compliance data: information reasonably needed for onboarding, security, fraud prevention, sanctions, KYC, AML or legal compliance checks.

We do not intentionally collect special-category personal data, such as health, political opinion, religious belief, racial or ethnic origin or similar sensitive information. Please do not submit such information unless specifically requested and lawful.

2. How we collect data

We collect personal data when you visit the website, create an account, request access, submit an enquiry, quote request, lead, message or form, use the Platform, chat services, APIs or MCP tools, communicate with us, or when another buyer, supplier, colleague, partner, service provider or third party provides information about you.

3. How we use personal data

We use personal data to:

• provide, operate, maintain and secure the Services;
• create accounts, manage access and authenticate users;
• receive, process, route and share leads, quote requests, introductions and related messages;
• help buyers and suppliers discover each other through hard-coded platform matching rules and filters;
• operate chatbot workflows, including receiving messages, interpreting requests, collecting information and routing enquiries;
• provide APIs, MCP tools, indicative market data, insights, alerts and service updates;
• respond to enquiries and support requests;
• monitor usage, improve the website, Platform, APIs, MCP tools, chatbot handling and user experience;
• maintain records, audit trails, logs and evidence of communications;
• detect, prevent and investigate fraud, abuse, security incidents and misuse;
• comply with legal, regulatory, tax, accounting, sanctions, KYC, AML and compliance obligations;
• enforce our terms, protect our rights and manage disputes;
• send marketing communications where permitted by law and honour opt-out requests.

4. Lawful bases

Depending on the context, we rely on one or more lawful bases, including contract, legitimate interests, consent and legal obligation. Where you are personnel of a buyer, supplier, partner or other business user, we generally process your business contact data for legitimate interests connected with providing and operating the Services.

5. Chatbot and automated processing

Bulugo may use AI in its chatbot handler to interpret messages, draft responses, extract structured details from conversations, classify requests and support service workflows.

Bulugo's buyer-supplier matching is not AI decision making. Matching is performed by hard-coded platform rules and filters. MCP tooling may allow you or your own AI agent to interact with Bulugo, but that agent is controlled by you and is not Bulugo's agent.

Bulugo does not intend to make legally significant decisions about individuals solely by automated means without appropriate human involvement where required by law.

6. Sharing personal data

We may share personal data with:

• Buyers and suppliers: where needed to pass leads, introductions, quote requests, messages or relevant commercial information.
• Service providers: hosting, infrastructure, analytics, CRM, email, messaging, support, security, chatbot, data, payment and professional service providers.
• Group companies and business partners: where relevant to operating, improving or expanding the Services.
• Professional advisers and insurers: lawyers, accountants, auditors, consultants and insurers.
• Authorities and courts: where required by law, regulation, legal process, court order or competent authority.
• Transaction parties: in connection with a merger, investment, financing, acquisition, restructuring or sale of all or part of our business or assets.

We do not sell personal data to third parties. Where we pass lead or contact information to a buyer or supplier, that recipient may become an independent controller for its own use of the data.

7. International transfers

Personal data may be processed in the United Kingdom, the European Economic Area, the United States and other countries where Bulugo, its users or service providers operate. Where required, we use appropriate safeguards such as adequacy regulations, standard contractual clauses, transfer risk assessments or other lawful transfer mechanisms.

8. Security

We use reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration and disclosure. No internet transmission or system can be guaranteed completely secure. You are responsible for keeping account credentials, API keys, MCP credentials and devices secure.

9. Retention

We keep personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including service delivery, audit, legal, regulatory, accounting, security and dispute purposes.

Indicative retention periods are:

• account and business contact data: for the life of the account or relationship, plus up to 2 years;
• lead, quote request and transaction-related records: up to 7 years where needed for legal, tax, audit or dispute reasons;
• chat and support communications: up to 2 years, unless a longer period is needed for legal, security or dispute reasons;
• technical, usage and security logs: typically up to 12 months, unless needed for investigation or compliance;
• marketing data: until you opt out or the data is no longer needed.

10. Marketing

We may send service messages and, where permitted, marketing communications about Bulugo services, insights and updates. You can opt out of marketing at any time by using unsubscribe links or contacting us. Even if you opt out of marketing, we may still send service, security, legal or transactional messages.

11. Cookies

We use cookies and similar technologies where they are needed to run the website or Platform, remember choices, understand usage, support integrations or protect the service. See our Cookie Policy for more information.

12. Third-party links and platforms

The website and Services may link to or integrate with third-party websites, messaging platforms, payment providers, analytics tools or other services. Those third parties have their own privacy practices. Bulugo is not responsible for their privacy policies or handling of personal data.

13. Your rights

Depending on applicable law, you may have rights to access your personal data, correct inaccurate data, request deletion, restrict or object to processing, receive data in a portable format, withdraw consent where processing is based on consent, object to direct marketing, and complain to a supervisory authority. In the UK, the supervisory authority is the Information Commissioner's Office.

To exercise your rights, contact us using the details below. We may need to verify your identity before responding.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page. Where appropriate, we may notify you by email or other reasonable means.

15. Contact

Questions, comments and rights requests should be sent to:

Bulugo Ltd
278 Northfield Avenue
London
England
W5 4UB
Email: privacy@bulugo.com