Privacy Policy

Last updated: 28 September 2026.

Commodities.tz ("we", "us") operates the commodities.tz network of websites: commodities.tz, vanilla.tz, clove.tz, coffeebean.tz, cacao.tz, cashews.tz, cardamom.tz, honey.tz, spices.tz and markets.tz. It is one platform and one database behind these ten addresses — an account, RFQ, or saved item is the same record regardless of which domain you were on when you created it. This policy explains, in practical terms, what we actually collect, why, how long we keep it, and how to exercise your rights over it.

Account registration and email verification

Registering an account collects your name, email address, and password (stored only as a one-way cryptographic hash — we cannot read it back). Company, country and "primary interest" are optional. We send a verification link to confirm you control the email address you registered; the link expires after 24 hours and the underlying token is stored only as a one-way hash, never in plain form. Your account works identically no matter which of the ten domains you log in from.

Profile information, saved items and alerts

Logged-in buyers can save directory listings or data views ("saved items") and subscribe to notifications about new market data ("alerts" — always a plain "new data is available" notice, never a real-time or threshold price alert). These are visible only to you in your account area and are used only to serve that feature back to you.

Weekly Intelligence Digest

Subscribing to our weekly digest only requires your email address. If that address doesn't already have a Commodities.tz account, we email you a confirmation link first — nothing is created or subscribed until you click it, so we never create an account under an email address unless the person who controls it actually confirms it. Once confirmed, a minimal account exists behind the scenes so we can reuse the same secure, audited infrastructure as full account registration, rather than a separate anonymous mailing list — but no password is set, no other account feature is enabled, and you are never asked to log in. We store your email address, a subscription flag, and the date we last sent you an issue. We only send an issue when there is genuinely new published analysis, market data or trade data that week; we do not send a filler email if there isn't. Every issue includes a one-click unsubscribe link that requires no login and takes effect immediately. Digest subscription is entirely independent of a full buyer/supplier account — subscribing does not register you for RFQs, alerts, or supplier features, and having a full account does not require digest subscription.

Requests for quotes (RFQs)

Submitting an RFQ collects the sourcing details you provide (commodity, quantity, destination, specification, timing) plus your name, company, email, and phone number. We store every RFQ in our database immediately, before attempting to email our team, so a submission is never lost to an email delivery failure. If you were logged in when you submitted it, the RFQ is linked to your account so you can track its status from your account area; if you submitted it while logged out, it is not retroactively linked to any account you may separately hold, even if the email address matches.

We also record which of the ten domains, which page, and (where present) which marketing link or campaign parameter (UTM) led to the submission — see "Attribution" below. Internally, our team adds a private commercial assessment to a submitted RFQ (an estimate of buyer type, purchase readiness, priority, and working notes). This internal assessment, and any internal commercial notes, outcome record, or follow-up date, are never shown to you or to any supplier — you see only a simplified status (Submitted / Under Review / In Progress / Closed).

Sharing information with suppliers

We do not broadcast your RFQ to every supplier in our directory, and we do not disclose your contact details to a supplier automatically. When our team decides an RFQ is a good match for a specific supplier, we may share a limited, de-identified version of it with that supplier's account — commodity, grade, quantity, destination country, incoterm and required delivery date only. Your name, company, email, phone number, message, and our internal notes are never included in what a supplier can see. A supplier can respond (interested / not interested / need more information) to that shared opportunity, and our team follows up with you directly — a supplier is never given a channel to contact you directly through this platform. We are describing this because it is something this platform actually does today, not a hypothetical future possibility, and we would rather be precise about it than claim we "never share" your information when a controlled, de-identified form of sharing is part of how sourcing requests get matched to suppliers.

Supplier profiles, claims and verification

If you submit a claim to represent an existing supplier listing, we collect your name, position, business email, phone, and any evidence you provide, and store it to review the claim. An approved claim, once linked to your registered account by our team, gives that account access to a "Supplier Workspace" where you can propose edits to a fixed set of profile fields (subject to our review) and respond to shared sourcing opportunities for that supplier. Verification evidence and status (Listed / Source-confirmed / Verified — see our Methodology) are maintained by our team and, where they relate to a business record rather than you personally, may remain part of the public supplier directory even if your own account is later deleted.

If your account's access to a supplier profile is revoked by our team, this only removes your account's ability to manage that listing — the supplier's public profile, its verification status, and its claim/verification history are never deleted as a result.

Attribution (where a request or registration came from)

To understand which pages and campaigns generate genuine interest, we record, at the point you submit an RFQ, register, or submit a supplier claim: which of the ten domains and page you were on, the referring page (if any), and any marketing campaign parameters (utm_source/medium/campaign/content/term) present in the page's URL. Where technically available, we also record the earliest of these "touches" we can identify for your browser via a first-party cookie (set on whichever of our ten domains you visited first, valid for 90 days) — for example, if you first read an article on vanilla.tz and later submitted an RFQ on commodities.tz. Because our ten domains are separate, independent web addresses, a cookie set on one is not automatically readable by another; where our own navigation links you between them, we use a short-lived, cryptographically signed link parameter (valid for 10 minutes, single-purpose) to carry that first-visit information across, rather than any cross-site tracking mechanism. This parameter carries no personal information — only the page, referrer and campaign values described above.

This attribution data is informational business analytics, not verified identity — it can be affected by browser privacy settings, ad blockers, or a visitor's own actions, and we treat it accordingly. We do not use it to build a profile of you across other websites, and we do not fingerprint devices.

Audit logs and email delivery logs

We keep an internal, admin-only audit log of security- and account-relevant actions (registration, login, password reset, alert changes, supplier-link changes, deletion requests, and similar) recording who did it, when, and a hashed form of the IP address involved — never the action's full content. We also keep a short-lived internal queue of outbound account emails (verification, digests) to make sending reliable; the email body itself is not retained once sent.

Analytics and cookies

Where enabled on a given portal, we use Google Analytics 4 with IP anonymisation to understand aggregate site and feature usage (for example, that an RFQ was submitted, or a supplier claim started) — never to identify you individually, and never sent alongside your name, email, or the content of what you submitted. We use only the cookies necessary for login sessions and the first-party attribution cookie described above, plus analytics cookies where GA4 is active. We do not run third-party advertising cookies.

Data retention

We distinguish your account identity from the business records associated with it. Saved items, alerts, and email-verification tokens exist only as long as your account is active and are deleted if you delete your account. RFQs, supplier claims, and their outcomes are retained as business records for as long as reasonably necessary — including after an account is deleted, in which case the personal contact fields on them (name, email, phone) are anonymized while the commercial content (commodity, quantity, status, outcome) is kept, consistent with ordinary business record-keeping.

Account deletion

You can request deletion of your account at any time from your account page, after re-entering your password to confirm. Requesting deletion deletes your saved items, alerts, and verification tokens, and anonymizes your account's identity (name, email, password) so you can no longer log in; any RFQs you submitted are retained as business records with their personal contact fields anonymized, as described above. If your account currently manages a linked supplier profile, we review the request first (rather than processing it immediately) so that supplier listing is not left without anyone able to manage it unexpectedly; we will follow up with you.

Your rights

Beyond self-service account deletion, you may request access to, correction of, or deletion of personal information you have submitted to us by contacting us via our Contact page. We do not sell personal information to third parties.

Contact

Questions about this policy, or a data request, can be directed to us via our Contact page.