Privacy Policy

1. Information We Collect

Account Information

• Email address (for login and notifications)
• Password (hashed with bcrypt, never stored in plain text)
• Subscription tier and billing history
• Account creation date

API Usage Data

When you call API endpoints, we log the following for billing, rate limiting, and abuse prevention:

• API key identifier (not the key itself)
• Endpoint called and timestamp
• Credit cost and remaining balance
• Response status (success/error) and latency
• IP address (for security and rate limiting)

We do not log the full request or response payload. Product descriptions, HS codes, and trade data you send are processed in memory and discarded.

Widget Usage Data

When end users interact with embedded widgets on your site, we collect the same API-level log data above. We do not collect personally identifiable information about your end users.

Automatically Collected Data

• Browser type and version (developer portal only)
• Pages visited and session duration
• Error logs for debugging

2. How We Use Your Information

• API billing: Tracking credit consumption and calculating overage charges
• Rate limiting: Enforcing per-minute and per-tier request limits
• Account management: Authentication, subscription management, and support
• Platform improvement: Aggregate usage patterns to prioritize features and optimize performance
• Security: Detecting and preventing fraudulent, abusive, or unauthorized API access
• Legal compliance: Meeting regulatory requirements and responding to valid legal requests

3. What We Do NOT Do

• We do not sell your data to third parties under any circumstances
• We do not log request payloads — product descriptions and HS codes are processed in memory, not stored
• We do not use your data to train AI models — neither ours nor any third-party model
• We do not share your API usage patterns, query history, or business data with competitors
• We do not provide your information to marketing or advertising companies

4. Data Retention

• API request logs: 90 days, then automatically deleted
• Account information: Retained while your account is active
• Billing records: Retained as required by financial and tax regulations (typically 7 years)
• Usage analytics: Aggregated and anonymized, retained indefinitely
• Account deletion: Personal data removed within 30 days of account closure, except where retention is required by law

5. Data Security

• Encryption in transit: All data transmitted via HTTPS/TLS
• Encryption at rest: Database encrypted at rest via Supabase
• Password security: Hashed with bcrypt, never stored in plain text
• API keys: Stored as hashed values; the plain-text key is shown only once at creation
• Row-level security: Supabase PostgreSQL policies ensure users can only access their own data
• Infrastructure: Hosted on Vercel (application, Montreal region) and Supabase (database, Canada Central region), both with enterprise-grade security and Canadian data residency

6. Third-Party Services

• Supabase: Database and authentication hosting (Canada Central region)
• Vercel: Application hosting and edge deployment (Montreal, Canada)
• Stripe: Payment processing. We never see or store your full card number. Stripe processes billing data only, not trade data
• AI inference: HS classification is processed via cloud AI services. Requests are stateless — product descriptions are processed for the request and not retained by inference providers

Each provider has its own privacy policy and security certifications. We share only the minimum data necessary for them to deliver their service.

7. Your Rights

• Access: Request a copy of personal data we hold about you
• Correction: Update or correct your account information
• Deletion: Close your account and request deletion of personal data within 30 days
• Portability: Export your account and usage data in standard formats
• Opt-out: Unsubscribe from marketing emails at any time (transactional emails required for service continue)

To exercise any of these rights, email us at privacy@triangle-trade-intel.site with subject line: "Privacy Request — [Request Type]"

8. Cookies

• Essential cookies: Session authentication and security (required for the platform to function)
• Functional cookies: Language preferences and UI state
• Analytics: Aggregate page-level usage data (no individual tracking)

We do not use third-party advertising cookies, tracking pixels, or behavioral profiling.

9. Legal Disclosures

We may disclose information if required by law, including:

• Valid subpoenas, court orders, or legal process
• Law enforcement investigations with appropriate legal authority
• Protection of our rights, property, or safety

We will notify you of legal disclosure requests where permitted by law.

10. International Users

The platform covers tariff intelligence for 9 markets: United States, Mexico, Canada, EU, Brazil, Japan, India, Vietnam, and CPTPP. Users worldwide may access the platform. Your data is processed and stored in Canada. For users in the European Economic Area and United Kingdom, Canada has been granted an adequacy decision by the European Commission under GDPR, meaning your data benefits from equivalent protection without requiring additional transfer safeguards.

11. Children's Privacy

This platform is for business use by adults. We do not knowingly collect information from anyone under 18. If you believe a minor has provided us with personal information, contact us immediately.

12. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes via email at least 14 days before they take effect. Continued use after changes constitutes acceptance.

13. Contact

For privacy questions or to exercise your data rights:
Email: privacy@triangle-trade-intel.site
Subject: Privacy Request — [Your Request Type]