What we collect.
What we do with it.
This notice covers importable.io. It names every field the two forms collect, every company that touches a submission, how long each thing is kept, and how to get a copy or get it deleted. Storage on your device is a separate page: cookies and local storage.
Who is responsible.
Importable BV, Rotterdam, Netherlands, is the controller for personal data collected through this site. Write to privacy@importable.io for anything in this notice, including a request to see, correct or delete what we hold. That mailbox is monitored by a named person, not a queue. Registered company details and every other contact route are on the About page.
We sell to buyers in the United Kingdom and buy from cooperatives in the European Union. UK GDPR and EU GDPR both apply, and this notice is written to satisfy both.
What the two forms collect.
There are two forms on this site and no others. Neither creates an account. Neither asks for a password. Both are answered by a person, by email.
Trial request — /chains
| Field | Status | Limit |
|---|---|---|
| Kitchen or buyer | Required | 200 characters |
| Required | A valid address | |
| SKU to trial | Required | 200 characters |
| Target weekly volume | Optional | 100 characters |
| Preferred delivery day | Optional | Tuesday, Friday or either. Tuesday is preselected |
| Notes | Optional | 2,000 characters of free text |
Cooperative enquiry — /coops
| Field | Status | Limit |
|---|---|---|
| Cooperative | Required | 200 characters |
| Required | A valid address | |
| Country | Optional | 100 characters |
| Members | Optional | 50 characters |
| SKUs | Optional | 300 characters |
| Message | Optional | 3,000 characters of free text |
The last field on each form is free text. It holds whatever you type — the cooperative form asks for a phone number in it. Anything you put there arrives in the email and stays in the thread.
Both forms carry one hidden field, named hp_company. It is a spam trap. A browser leaves it empty. A submission that fills it is discarded and no email is sent. The cooperative form carries a second hidden field that labels the enquiry as onboarding. Neither describes you.
What happens to a submission.
- The fields are rendered into an email and sent through Resend to an Importable inbox. If email delivery is not configured on the deployment serving you, no email is sent and your answers are not written anywhere: the server log records the reference code and which fields you filled in, and nothing else.
- The reply-to address on that email is the address you gave. A reply goes straight back to you and nowhere else.
- Nothing is written to a database. This site has no user table, no session, no profile, and no record of you between visits.
- A reference code is generated for each submission and shown back to you. Quote it and we can find your thread in one search.
- The serving instance keeps a SHA-256 of your submission in memory, so a second click returns the first reference code instead of sending a duplicate email. The replay window is ten minutes. The value held against that hash is the reference code and the delivery result, not your answers, and none of it survives a restart of that instance.
Technical data, and its limits.
Your IP address.Read from the proxy headers on every post to the two form endpoints and to the violation-report endpoint. Used to count requests in a rolling sixty-second window — eight form posts, thirty reports. The counter lives in the serving instance’s memory. It is not written to disk, not put in the email, and not sent to analytics.
Error reports. When code on the server throws, a report goes to Sentry with the message and the stack. Reports raised by the two form endpoints carry three tags: the vendor, the endpoint and the reference code. Your answers are not attached to them. URLs in those reports are reduced before they are sent, so a trade identifier cannot ride along. Sentry is not sent your IP address, and no session recording runs. The browser-side reporter is not wired up on this site, so an error in your browser is not reported at all.
Policy-violation reports. If your browser blocks a resource on one of these pages, it posts a short report to this site naming the directive and the blocked origin. That report is logged and forwarded to Sentry.
Evidence-pack and verification pages are never measured. Those URLs carry a trade identifier or an artefact hash in the path. No analytics loads on them and they send no-referrer, so the URL does not travel to the next page either. The full list is on the cookies page.
Analytics is off.
The site is built to run Google Analytics 4 behind a consent banner. No measurement ID is configured, so no analytics script loads, no consent banner appears, and no analytics record exists. When that changes, storage stays denied until you accept, every advertising category stays denied whatever you answer, and the route list analytics is allowed to name is a closed set that contains no identifier-bearing URL.
The forms are wired to report that a form was started, completed or failed. Those reports carry a fixed vocabulary — which door, which channel, which surface — and never a field value, never your email address, never your free text. They are refused outright unless you have accepted, and today they go nowhere at all.
The mechanics — the exact defaults, the storage key, the cookies Google would set — are on the cookies page.
Lawful basis, per purpose.
| Purpose | Basis | Reasoning |
|---|---|---|
| Answering a trial request or a cooperative enquiry | Legitimate interest | You asked a business question and we answer it. Where the enquiry turns into a trade, the same data is processed to take steps at your request before a contract. |
| Rate limiting and the spam trap | Legitimate interest | A public endpoint that anyone can post to has to be defensible. Counting requests per address is the cheapest defence that works. |
| Error reports and policy-violation reports | Legitimate interest | Knowing that a page broke, and where, is how it gets fixed. |
| Analytics | Consent | Given in the banner, refused in the banner, withdrawn in the banner. Nothing is measured without it — and nothing is measured today, because the tag is off. |
Where the basis is legitimate interest you can object. Say so and we stop, unless we can show a reason that overrides yours — and for an enquiry we did not solicit, we cannot.
Who else touches it.
| Processor | What it does | Status |
|---|---|---|
| Vercel | Hosts and serves the site. Every request reaches Vercel first. | In use |
| Resend | Delivers the email that carries your form submission to an Importable inbox. | In use |
| Sentry | Receives error reports and content-security-policy violation reports. | In use |
| Google Analytics | Would measure page traffic behind the consent banner. | Not active — no measurement ID is configured, so no script loads |
Named in the stack, receiving nothing. The codebase carries database schema, object-storage configuration and a background-job endpoint. None of them is connected to the live site. No form submission reaches any of them, and no advertising network, data broker or customer-data platform is in this chain at all.
We do not sell personal data. We do not share a submission with a third party for their own purposes.
Where the data goes.
Importable BV is established in the Netherlands. The processors above are United States companies operating European regions. Where personal data is transferred outside the United Kingdom or the European Economic Area, the transfer runs under the data processing agreement we hold with that processor. Ask which agreement covers a named processor and we will tell you.
How long each thing is kept.
| What | Kept for |
|---|---|
| The email carrying your submission, and the thread that follows | 3 years from the last reply |
| Rate-limit counter (address plus a count) | 60 seconds, then swept from memory |
| Replay guard (a hash of the submission plus the reference code) | 10 minutes for the check; in memory only, lost on restart |
| Error reports at Sentry | 90 days |
| Policy-violation reports | 30 days |
| Your answer to the consent banner | Stays in your browser until you clear site data |
| Analytics records | None exist. No tag, no data |
This notice covers the website. Data held under a trading relationship — buyer and cooperative records, and the signed evidence packs themselves — is governed by the terms of that relationship and by the audit and tax obligations attached to it. A pack names its cooperative, its inspector and its hub by design; that is what the pack is for, and it is not deleted on request.
Your rights, and how to use them.
Under UK GDPR and EU GDPR you can ask us for any of the following.
- A copy of the personal data we hold about you.
- Correction of anything wrong in it.
- Deletion of it.
- Restriction of what we do with it while a dispute is open.
- A portable copy, in a machine-readable format.
- An objection to any processing that rests on legitimate interest.
- Withdrawal of consent, at any time. Withdrawal does not undo what happened before it.
How. Write to privacy@importable.io. Include the reference code from your submission if you have one — it is the fastest way to find the right thread. A deletion request is acknowledged within 72 hours and answered within 30 days, with the reasoning for anything retained.
If we get it wrong. You can complain to a supervisory authority. In the United Kingdom that is the Information Commissioner’s Office. In the Netherlands it is the Autoriteit Persoonsgegevens. You can also complain to the authority in your own EU member state.
When this notice changes.
It changes when the site changes, in the same release. The date below is the last publication.