How Straightforward ITC Handles Your Information

1. Our Privacy Commitments

Straightforward ITC is built for businesses and professionals who work with commercially sensitive trade information. In this policy, “Personal Data” means information about an identifiable person, and “Customer Content” means the answers, documents, and other materials you submit to the Service, together with the reports generated from them.

1. 1We do not sell Personal Data or Customer Content, and we do not use or share them for targeted or cross-context behavioral advertising.
2. 2We do not commercialize customer-identifiable invoices, product data, supplier information, bills of materials, manufacturing processes, customs information, or compliance findings, and we do not use identifiable Customer Content to train artificial-intelligence models for other customers.
3. 3We do not submit your information to U.S. Customs and Border Protection or another government agency unless you expressly ask us to or the law requires it. The anonymous searches of CBP’s public rulings database described in Section 4 are not submissions.
4. 4You keep your rights in what you submit. We use it only to provide the Service as described in this policy.
5. 5We keep information only for the periods described in Section 6. Saved reports are kept for 14 days from the date you save them. Uploaded files are kept for 72 hours after upload; if you save a report that uses them, they are kept with that report for its 14 days instead, or until you delete the report.

We may use aggregated or de-identified information that cannot reasonably identify you, your company, or a specific product, shipment, supplier, or transaction to understand and improve the Service. We will not attempt to re-identify it.

2. Information We Collect

2.1 Your Account

Your email address; your name and company name, if you provide them; your password, which our authentication provider stores only in hashed form; your two-factor authentication settings (one-time email codes are stored only as a hash); the date and versions of the Terms of Use and this Privacy Policy you accepted; your report credits and their history; and sign-in and security events.

2.2 Customer Content and Uploaded Files

What you enter and upload depends on the tool: for example product, material, supplier, shipment, origin, valuation, and classification details, your answers to questionnaires, and documents such as invoices, specifications, ACE reports, and product catalogs. Customer Content can include commercially sensitive information and Personal Data about people connected to a transaction. You are responsible for having the right to submit it.

Please do not upload sensitive personal information the Service does not need, such as Social Security, passport, driver’s-license, or personal tax numbers; full bank-account or card numbers; health or biometric information; or information about children. Redact it from trade documents where you can. We may delete or decline to process such information.

We store a generated report when needed to show it to you, let you download it, keep it if you choose Save Report, fix errors, or answer a support request.

2.3 Payments

Payments are handled by Stripe on its own checkout page, and we never receive your full card number or security code. We send Stripe only an internal account identifier, and we store the checkout and event identifiers, the credit pack, the credits granted, and the purchase date. We can see limited details of each transaction in our Stripe account — the amount, status, card brand and last four digits, and billing details you gave Stripe — but we do not copy them into our systems.

2.4 Messages and Demo Requests

When you contact us or request a demo, we receive your name, email address, message, anything you attach, and, if you are signed in, the account it was sent from. A demo request also includes your company name, your phone number if you give it, and your preferred date and time with your time zone.

2.5 Technical Information

Our hosting and database providers record technical details of each request, such as IP address, browser and device type, the page requested, the time, and errors. The Service itself records sign-in and two-factor events, which tool generated a report and the credits it used, upload records (file name, type, size, and time), and rate-limit records used to prevent abuse, which for contact-form messages and demo requests sent without signing in include your IP address.

We use Vercel Web Analytics, provided by our hosting provider, to count visits. It does not use cookies. For each page view it records the page (without its query string, and with report and record IDs removed), the referring site, your browser, operating system, and device type, and your approximate location (country), and it counts unique visitors with an identifier derived from your request that changes daily and is not stored. We see only aggregate statistics. We do not use advertising or session-recording tools, we do not track which buttons or links you click, and we do not collect precise location.

When something in the Service fails, an error report is sent to Sentry, our error-monitoring provider. It contains the error message (with email addresses removed and long messages shortened), where in our code the error happened, the page or request involved (without its query string, and with report and record IDs removed), and technical details of our server or of your browser and operating system. We configure it to exclude your name, email address, account identifier, IP address, cookies, the contents of your requests, Customer Content, and uploaded files. Error reports from your browser are passed through our own server, so Sentry does not receive your IP address or the location derived from it.

2.6 Cookies and Browser Storage

We set only the cookies needed to keep you signed in and secure your session, so we do not ask for cookie consent; blocking them prevents signing in. We do not use advertising or tracking cookies or pixels, and our visitor analytics uses no cookies.

Some tools keep your answers, drafts, and completed reports in your browser so a refresh or a later visit does not lose your work. The Opportunity Scanners never keep attached catalog PDFs there: refreshing the same tab keeps them attached (a reference to each file is held in that tab until you close it), and they are never carried into a new scan. These browser copies stay on your device until the Service, you, or your browser clears them, so clear this site’s browser storage when you finish on a shared device.

Videos are shown as a preview image from our own site, and nothing loads from YouTube until you press play (see Section 12).

2.7 Information From Others

We receive sign-in and security events from our authentication provider, payment confirmations from our payment processor, public government data such as the Harmonized Tariff Schedule and CBP’s public rulings database, and the content of public websites you ask an Opportunity Scanner to review.

3. How We Use Information

We use the information described above to:

• —Provide the Service: create and secure your account, process your answers and documents, apply rules-based checks and public trade data, run AI-assisted analysis, and generate, save, and download reports
• —Send account, security, purchase, and policy-change messages
• —Keep the Service secure and prevent fraud and abuse
• —Fix errors and improve the Service, including by reviewing aggregate visitor statistics; where this requires looking at Customer Content, access is limited to what is needed
• —Process payments and keep business, accounting, and tax records
• —Comply with the law, respond to lawful requests, and protect our rights and the rights of others

We do not currently send marketing emails. If we start, we will do so only where the law permits, and every marketing email will include a way to unsubscribe.

4. Artificial Intelligence

Our tools combine the facts and documents you provide with rules-based logic, public trade data, and artificial intelligence. When a report needs it, the relevant part of your Customer Content is sent to OpenAI, our AI provider. An uploaded document is sent with that request — for Word files and for product catalogs uploaded to an Opportunity Scanner, the text extracted from it. We do not use OpenAI’s file storage or ask OpenAI to keep a copy. ACE spreadsheets are read by our own code, and only a summary of what it finds goes into a report request.

OpenAI processes this information to generate the result and, under its business terms, to maintain security, prevent abuse, and comply with the law.

The HTS Code Sanity Check may search CBP’s public rulings database (CROSS) to see how similar products have been classified. These searches use short search terms, such as product keywords or tariff codes, generated from the product information you provide. They are sent from our servers without your name, email address, or account details (although a search term may include a product or brand name you entered) and only retrieve public rulings. They are not a filing or submission to CBP, although CBP, which operates the database, may record the search terms it receives.

The Service provides analysis and information. We do not use Personal Data to make solely automated decisions with legal or similarly significant effects on a person. You remain responsible for reviewing reports and making your own business, customs, legal, and compliance decisions.

5. How We Share Information

We use these service providers to operate the Service. Each may use the information only to provide its service to us:

• —Vercel — hosting and visitor analytics: all information passing through the Service, request logs, and the page-view details described in Section 2.5
• —Supabase — database, sign-in, and file storage: account information, Customer Content, uploaded files, and saved reports
• —OpenAI — AI-assisted analysis: the parts of Customer Content and uploaded documents a report needs
• —Stripe — payments: what you enter at checkout, and your internal account identifier
• —Sentry — error monitoring: the error reports described in Section 2.5
• —Resend — email delivery: your email address and the message being sent, including contact-form messages and demo requests forwarded to us
• —YouTube (Google) — embedded videos, only after you press play (see Section 12)

Each provider’s processing locations and privacy and security information are available on request at contact@straightforward-itc.com. We will update this list when our providers change.

Otherwise, we share information only:

• —When you ask us to
• —With professional advisers, such as accountants, auditors, and attorneys, who are bound by confidentiality
• —When the law requires it, or when needed to protect the Service, our users, or others; where lawful and appropriate, we will tell you before disclosing Customer Content in response to a government request
• —In a merger, acquisition, financing, or sale of all or part of our business, where the recipient must handle it consistently with this policy and the law, and we will give any notice the law requires before your information becomes subject to materially different practices

Straightforward ITC is not affiliated with CBP or any other government agency, and we do not send them Customer Content or reports, apart from the anonymous rulings searches described in Section 4.

We do not offer shared organization accounts. If you use the Service for your employer, your employer may have rights to what you submit for it under its own policies.

We have not sold Personal Data or shared it for cross-context behavioral advertising in the past 12 months, and we do not do so. If that ever changes, we will update this policy and provide any required opt-out first.

6. Data Retention

We keep information only as long as needed for the purposes in this policy, for the periods below.

6.1 Your Account

Account information is kept while your account exists. You can delete your account from the Account page. Deletion is immediate and permanent: we first delete your uploaded documents, then your account, profile, saved reports, report credits and the purchase records in our database, two-factor settings, and usage records. If the documents cannot all be deleted, the account is not deleted and you can try again.

Some information remains after deletion: contact-form messages, demo requests, and our email copies of them (kept as described in Section 6.4, no longer linked to your account); Stripe’s records of your transactions; records and logs kept by our authentication, hosting, database, error-monitoring, and email providers; and anything kept in your own browser (see Section 2.6).

6.2 Saved Reports

When you save a report, it is available in your account, with the answers used to generate it, for 14 days from the date you saved it. Viewing, downloading, or reopening it does not extend this period. If you edit a saved report and save it again, the edited version becomes a new report with its own 14-day period, and the earlier version is removed. You can delete a saved report sooner from your Saved Reports list.

Saved reports are kept for 14 days from the date you save them. After that, a saved report becomes inaccessible and is permanently deleted from our active production systems by an automated daily cleanup, generally within the following 24 hours. Documents attached to a saved report are kept for as long as the report and become inaccessible when it expires. If you delete a saved report sooner, the documents that only it used become inaccessible immediately and are deleted by the same daily cleanup.

The Service is not a records repository. Download or print any report you want to keep, and keep the records the law requires of you, such as under 19 U.S.C. § 1508 and 19 C.F.R. Part 163.

You can download or print a report without saving it to your account. It will not appear in your Saved Reports unless you choose Save Report. A temporary server copy of a generated report is kept to support retries and is normally cleared within about two hours after generation. HTS Code Sanity Check analysis data used between steps is normally deleted within about 26 hours. Some tools also keep drafts or completed reports in your browser until they are cleared by the Service, by you, or by your browser. Uploaded files are kept for 72 hours after upload; if you save a report that uses them, they are kept with that report for its 14 days instead, or until you delete the report. Leaving the tool or closing the page does not delete them sooner.

6.3 Uploaded Files

Uploaded files are kept for 72 hours after upload; if you save a report that uses them, they are kept with that report for its 14 days instead, or until you delete the report. This covers every kind of upload, including supporting documents, images, product catalogs, and ACE spreadsheets. If you edit a saved report and save it again, the documents it still uses follow the new report. Once a document is inaccessible it can no longer be opened, downloaded, or used to generate a report, and the file and its upload record are permanently deleted from our active production systems by an automated daily cleanup, generally within the following 24 hours. Re-attaching an existing document does not restart its 72-hour period. You can remove documents sooner within tools that offer that option. Keep your own copies of important documents.

When you delete your account, we first permanently delete all of your uploaded documents from storage. If that step can't be completed, your account is not deleted and you can try again.

6.4 Other Records

• —Rate-limit records, including the IP address of anyone who sends a contact-form message or demo request without signing in, are deleted after 7 days. Two-factor sign-in codes are deleted 7 days after they are created, expired sign-in verification sessions 7 days after they expire, and records of two-factor recovery actions after 12 months.
• —Records of which reports you generated and the credits used are kept while your account exists, as your billing history.
• —Contact-form messages and demo requests are deleted from our database three years after we receive them. Email copies, and emails you send us directly, are kept for up to three years after the matter is resolved.
• —Accounting and tax records derived from your purchases may be kept for up to seven years, or longer if the law requires.
• —Logs kept by our authentication, hosting, database, error-monitoring, email, and payment providers follow those providers’ own practices.

We may keep information longer when the law requires it or when it is needed for an audit, a legal claim, or a fraud or security investigation, and we delete or de-identify it when that need ends. We do not keep separate backups of our database, so information deleted from it is not kept in backups we control.

7. Security

We protect information with database access rules that limit each user to their own account, reports, and files; two-factor authentication available for every account; encrypted connections; encryption at rest provided by our infrastructure providers; private storage for uploaded files; server-side handling of payments and application secrets; security logging; and limited personnel access.

No system is completely secure, and we cannot guarantee that unauthorized access will never occur. Please use a unique password, keep your sign-in details private, sign out of shared devices, and tell us promptly about any suspected unauthorized access. If a security incident affects Personal Data, we will investigate and give the notifications the law requires.

8. Your Choices and Privacy Rights

From your account you can update your name and company, change your password, turn two-factor authentication on or off, download or delete saved reports, remove uploaded documents in tools that offer it, and delete your account. You can clear drafts kept in your browser by clearing this site’s browser storage.

Depending on where you live, you may also have the right to know what Personal Data we hold and how we use it; to access, correct, or delete it; to receive a portable copy; to object to or restrict certain processing; to withdraw consent; and to appeal our decision on a request. We will not discriminate against you for exercising these rights.

To make a request, email contact@straightforward-itc.com and say which account or email address it concerns. We may need to verify your identity, usually through your account email address, and we will not ask for more than is reasonably necessary. Where the law allows, you may use an authorized agent; we may ask for proof that the agent is authorized and verify your identity directly. If we deny your request and the law gives you a right to appeal, reply to our decision or email us with the subject line “Privacy Request Appeal.” We respond within the periods the law requires.

9. U.S. State Privacy Disclosures

This section applies only to the extent a U.S. state privacy law, such as the California Consumer Privacy Act, applies to us.

In the past 12 months we may have collected these categories of Personal Data: identifiers (such as name, email address, phone number if you give one, account identifier, and IP address); customer records (contact and company details, and billing details you give Stripe); commercial information (purchases, credits, and report use); internet activity (browser and device information, pages requested and visited, referring sites, sign-in events, and records of reports and uploads); approximate location that our hosting provider may derive from IP addresses, which we do not use; professional information (company name, if provided); and communications you send us. Customer Content may contain other categories, depending on what you submit. We do not create profiles or inferences about individuals. Sources, purposes, and recipients are described in Sections 2, 3, and 5.

We do not sell or share Personal Data, including that of anyone under 16, and we have not done so in the past 12 months. We do not use sensitive Personal Data to infer characteristics about anyone. For these reasons we do not offer a “Do Not Sell or Share” link or process opt-out preference signals such as the Global Privacy Control; if our practices change, we will add the required opt-outs first.

California residents may ask to know, access, delete, or correct their Personal Information using the process in Section 8. We confirm receipt within 10 business days and respond within 45 days, which we may extend once by another 45 days with notice. We do not disclose Personal Information to third parties for their own direct marketing, so California’s “Shine the Light” law does not require further disclosures.

10. European Economic Area, United Kingdom, and Switzerland

Where the GDPR, the UK GDPR, or Swiss data-protection law applies, the controller is Straightforward International Trade Compliance LLC, doing business as Straightforward ITC or SITC, reachable at contact@straightforward-itc.com. We have not yet published a mailing address.

We process Personal Data to perform our contract with you (your account, reports, purchases, and support), for our legitimate interests (securing, debugging, and improving the Service and running our business, weighed against your rights), to meet legal obligations (such as tax, accounting, and lawful requests), and with your consent where we ask for it, which you can withdraw at any time.

In addition to the rights in Section 8, you may object to direct marketing and complain to the data-protection authority where you live or work. We have not appointed a Data Protection Officer or an EEA or UK representative.

We are based in the United States, and we and our providers may process information there and in other countries. Where required, we use an approved transfer mechanism, such as Standard Contractual Clauses or the UK International Data Transfer Addendum. We do not claim membership in any privacy certification or data-transfer framework.

11. Children’s Privacy

The Service is for businesses and professionals and is not directed to children. You must be at least 18 years old and legally able to enter into a binding agreement to create an account. If we learn that we collected Personal Data directly from a child under 13, we will delete it.

12. Third-Party Links and Embedded Videos

The Service links to government websites, tariff and rulings databases, and other third-party services. Their own privacy policies govern what they collect, and a link does not mean we endorse them.

Our videos are hosted on YouTube, a Google service. Each video is shown as a preview image from our own site, and nothing loads from YouTube until you press play. The video then plays from youtube-nocookie.com, YouTube’s privacy-enhanced mode, and YouTube and Google may collect information such as your IP address, device and browser details, and how you interact with the video, and may use cookies for video functionality, analytics, personalization, and advertising. We do not control that collection.

For more information, see Google’s Privacy Policy.

13. Changes to This Privacy Policy

We will post any update to this policy here and change the “Last Updated” date. If a change materially reduces protections for Customer Content or expands how we use Personal Data, we will also ask you to review and accept the updated policy the next time you sign in, notify you by email or on the website, or ask for your consent where the law requires.