Privacy policy

When you create an account we store your email address, an authentication identifier and the profile details you choose to add: name, role, country, notification preferences and communication settings.

Authentication may be handled by an identity provider you choose (for example Google or Apple). In that case we receive your email address and basic profile details from that provider — not your password.

If you register an organisation we store its name, supply-chain role, countries of operation, capabilities, contact details and the documents you submit for verification.

Verification evidence — identity documents, company registration, trade references — is used solely to assess and record verification status. It is visible to the Lithos verification team and is not published on your public organisation profile.

Material you publish — listings, buyer requirements and industry opportunities — is stored with your organisation record. What each visitor can see is governed by your visibility settings and by their verification status. Anonymous visitors see a restricted preview.

Introductions are permission-based. When you request one, we share the details of your request with the receiving organisation so it can accept or decline. Messages exchanged after an introduction is accepted are stored so both parties keep a record. We also send transactional email: sign-in, verification decisions, introduction requests and notifications you have enabled.

Lithos is designed to protect existing commercial relationships. We do not publish who trades with whom. Counterparty activity, deal rooms and negotiation history are visible only to the organisations involved and, where required to provide support, to authorised Lithos staff.

Where a member reports a problem with a transaction arranged through Lithos, authorised staff may access the related deal room records — messages, agreed terms, documents and status history — in order to respond to the report, provide the record to the parties, and decide any platform or account action. We do this on the basis of our legitimate interest in the safe operation of the network. We do not arbitrate disputes and we do not use these records for any other purpose.

We use first-party cookies required for sign-in and session persistence; these are strictly necessary and are not optional. We also collect aggregate, non-identifying usage data to understand which parts of the network are used and to improve the product. Separately, we advertise Lithos on Google Search. Analytics and advertising cookies set by Google are used only to measure whether an advertisement led to a genuine trade application, and only after you agree on the consent notice. Until you choose, advertising and analytics storage are disabled. Refusing costs you no functionality, and you can change your choice by clearing site data for this domain.

Authentication, database and file storage are provided by our hosting platform. Transactional email is delivered by a third-party email provider. Lithos does not currently process payments between members, so no card or bank details are collected from members through the platform. A payment provider is retained for Lithos's own account administration and testing; we never store full card details. The current list of processors is available on request.

Account and organisation data is retained while your account is active. When you request deletion we begin a grace period before removal, and retain the limited records we are legally required to keep — for example transaction and tax records. See the account deletion flow in your account settings for the current periods.

You can edit your profile, organisation and notification preferences at any time from your account. To request a copy of your data or delete your account, use the deletion tools in your account settings or contact us at privacy@lithosmarket.com. We respond within 30 days.

Privacy questions: privacy@lithosmarket.com.