Privacy Policy
Effective Date: August 18, 2026
Last Updated: August 21, 2026
Andrade Trade Tech LLC, a California limited liability company ("Company," "we," "us") operates andradetradetech.com and the Andrade Trade Tech platform (together, the "Service"). This Privacy Policy explains what information we collect, how we use and share it, and the choices and rights available to you.
This Policy applies to visitors to our website and to users of the Service. It does not apply to information you submit to CBP, your customs broker, or any third party outside our Service.
1. Information We Collect
1.1 Information you provide directly
| Category | Examples |
|---|---|
| Account information | Name, business email, company name, job title, password (hashed) |
| Billing information | Billing name/address; card details are entered directly into and processed by Stripe — we do not store full card numbers |
| Catalog & entry data ("Client Data") | Item descriptions, HTS codes as you declare them, country of origin, value/volume figures, ACE/7501 entry-summary data you upload. This is generally business data, but may incidentally include names or contact details of your personnel (e.g., a supplier contact) |
| Communications | Support requests, survey responses, correspondence with us |
1.2 Information collected automatically
- Usage data: pages viewed, features used, timestamps, referring URLs
- Device/log data: IP address, browser type, operating system, device identifiers
- Cookies and similar technologies: see Section 6
1.3 Information from third parties
- Payment confirmation status from Stripe (we do not receive your full card number)
- We do not receive product-usage analytics from third-party analytics providers. Product analytics are collected directly by our Service as described below.
- Vercel's built-in bot/attack protection
2. How We Use Information
We use the information above to:
- Provide, maintain, and secure the Service (e.g., authenticate accounts, run duty-stack calculations, match reference-data changes to your catalog, generate alerts and reports)
- Process subscription payments and manage billing
- Provide customer support
- Send Service-related communications (billing notices, alert digests, security notices) and, with your consent where required, marketing communications
- Monitor, debug, and improve the Service, including analyzing aggregated/de-identified usage patterns
- Detect, prevent, and respond to fraud, abuse, or security incidents
- Comply with legal obligations (e.g., tax, accounting)
We do not use your Client Data (catalog items, HTS codes, entry data) to train third-party AI models beyond the specific processing needed to categorize and summarize public reference materials (CSMS messages, rulings, tariff actions) — never to assign, suggest, or evaluate the correctness of a code for your items.
3. How We Share Information
We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
We share information only as follows:
- Service providers, under contract, to operate the Service:
- Supabase — database hosting and authentication
- Vercel — application hosting and built-in bot/attack protection
- Stripe — payment processing
- Resend — transactional email and alert delivery
- Anthropic (Claude API) — used to categorize and summarize public reference material (CSMS messages, rulings, tariff notices) for the reference layer of the Service; not used to process or generate output about your specific catalog items' HTS classification
- Legal and safety: where required to comply with law, respond to lawful requests, or protect the rights, property, or safety of the Company, our users, or others
- Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to standard confidentiality protections
- With your direction: e.g., if you use an export feature to send a findings packet to your own broker
4. Data Security
We use industry-standard safeguards, including encryption in transit, row-level security controls restricting data access by account, and access controls limiting internal access to Client Data on a need-to-know basis. No system is completely secure; we cannot guarantee absolute security.
5. Data Retention
- Account data: retained while your account is active, and for a reasonable period after closure for legal, tax, and dispute-resolution purposes.
- Client Data: retained per your subscription and export needs; upon account closure, retained for 30 days to allow export, then deleted or de-identified, except where longer retention is required by law.
- Billing records: retained as required by tax and accounting law.
6. Cookies and Tracking Technologies
We use cookies and similar technologies for:
- Essential functions (authentication, session management)
- Bot/fraud protection (Vercel's built-in bot/attack protection)
- Internal product analytics — collected directly by our Service and stored in our Supabase database to understand page and feature usage. The analytics cookie contains a random identifier only. We do not use browser fingerprinting, store raw IP addresses in analytics tables, retain full referring URLs, or record search terms as analytics properties. Query strings and URL fragments are removed before page paths are stored.
Analytics cookies are first-party cookies set by andradetradetech.com. Raw analytics records are retained for up to 13 months. We honor enabled browser Do Not Track and Global Privacy Control signals for product analytics. You can also disable analytics and delete the analytics history associated with your current browser using the control at the bottom of this page. Disabling analytics does not affect essential authentication or security cookies.
We do not sell or share personal information for cross-context behavioral advertising. We currently do not use third-party advertising or analytics cookies.
7. Your Privacy Rights
7.1 California residents (CCPA/CPRA)
If you are a California resident, you have the right, subject to certain exceptions, to:
- Know/Access — request the categories and specific pieces of personal information we have collected about you, the sources, purposes, and categories of third parties with whom it's shared
- Delete — request deletion of personal information we've collected from you
- Correct — request correction of inaccurate personal information
- Opt out of sale/sharing — we do not sell or share personal information, so there is currently nothing to opt out of; if this changes, we will update this Policy and provide an opt-out mechanism
- Limit use of sensitive personal information — we do not use sensitive personal information for purposes beyond providing the Service
- Non-discrimination — we will not deny goods/services, charge different prices, or provide a different level of service because you exercised a privacy right
How to exercise these rights: email support@andradetradetech.com with your request. We may need to verify your identity (typically by confirming account details) before processing a request that involves your data. An authorized agent may submit a request on your behalf with appropriate proof of authorization. We will respond within 45 days, with a possible 45-day extension where permitted by law — this statutory timeline governs formal rights requests under this section (it is separate from the 30-day general response target described in Section 12 for other privacy questions).
Notice at Collection (California):
| Category | Purpose | Shared With | Sold/Shared for Ads? |
|---|---|---|---|
| Identifiers (name, email, IP) | Account, support, security | Supabase, Vercel, Stripe, email provider | No |
| Commercial info (billing, subscription tier) | Billing, account management | Stripe | No |
| Client Data (catalog/entry business data) | Provide the Service | Supabase, Vercel, Anthropic (reference-layer processing only) | No |
| Internet/network activity | Security, product improvement | Supabase, Vercel | No |
| Professional info (job title, company) | Account context, support | Supabase | No |
7.2 Other jurisdictions
The Service currently serves U.S.-based customers only, and we do not currently apply rights frameworks from other states (e.g., Virginia, Colorado, Connecticut) or outside the U.S. If that changes, we will update this Policy with the applicable rights sections.
8. Children's Privacy
The Service is intended for business use by adults and is not directed to children under 18. We do not knowingly collect personal information from children.
9. International Data Transfers
The Service and our infrastructure providers are based in the United States, and the Service currently serves U.S.-based customers only. There are no international data transfers at this time. If that changes, we will update this Policy with applicable cross-border transfer disclosures.
10. Third-Party Links
The Service links to official government sources (CBP, USITC, Federal Register, USTR). Those sites have their own privacy practices, which we do not control.
11. Changes to This Policy
We may update this Policy from time to time. Material changes will be communicated via email or in-app notice at least 14 days before taking effect. The "Last Updated" date above reflects the most recent revision.
12. Contact Us
Questions or requests regarding this Policy or your personal information:
Andrade Trade Tech LLC
support@andradetradetech.com
For general privacy questions, we aim to respond within 30 days. Formal requests to know, delete, correct, etc. under Section 7 are handled on the 45-day statutory timeline described there.