Privacy policy

Who we are

TariffTrust is operated by TariffTrust EI, France (“we”). We decide how the data of accounts, billing, the emails written to our addresses and this website is used. For the content a customer puts in its workspace, the support requests made from it included, we act on the customer's behalf, as set out in the data processing addendum. TariffTrust is a service for businesses: it is not directed to consumers or to children. Questions and requests about your data: privacy@tarifftrust.com.

What we collect

• Your account: your email address, your name if you give it, your password (stored only as a one-way hash), your two-factor authentication settings, the workspaces you belong to and your role in each, the email addresses of the people you invite, and the version of the terms of sale you accepted.
• Your workspace: what you enter and save: codes, origins, values, quantities, answers, estimates, declarations, portfolios and tracked products, labels and references, share links, conversations with the assistant, support requests and error reports, your workspace's name, brand and default answers.
• Billing: your subscription, its status and invoices. Payments are made with Stripe: we never receive your card number.
• Use and security: the requests counted against your quotas, a log of the actions taken in your workspace and by whom, the emails we send you, and technical logs of requests (time, method, response status and, after an error, the address requested), kept 30 days. Your IP address is not recorded: limits on repeated requests use a one-way hash of it, kept two days.
• Trade updates by email: the address you subscribe with. Never confirmed, it is deleted 30 days after its confirmation link expired; after you unsubscribe, it is kept, marked as unsubscribed, only so that nothing more is sent to it.
• Audience measurement (in Europe, only if you accept it): the pages you visit and how you reached them (search engine, link, campaign), your browser, device and approximate location, and the steps you take on the site (an estimate, a saved estimate, a trial started, a click on a call to action). Signed in, a pseudonymous identifier (never your email) and your workspace's plan and role go with them.

Why we use it

• To provide the service you subscribe to: estimates, saved results, proof bundles, alerts, the assistant and support (performance of our contract).
• To bill your subscription and keep accounting records (contract and legal obligation).
• To keep the service secure, prevent abuse and fix errors (our legitimate interest).
• To send the emails the service needs: verification, invitations, quota and renewal notices, alerts on your tracked products (contract).
• To send the trade updates digest, only if you subscribed to it (your consent, which you may withdraw at any time).
• To understand how TariffTrust is found and used, and improve it, with Google Analytics: in the European Union, the EEA, the United Kingdom and Switzerland, only if you accept it (your consent); elsewhere, until you turn it off (our legitimate interest, which you may object to at any time).
• To measure our advertising, with advertising cookies: only if you turn them on (your consent), never while you are signed in, and never for a browser that sends Global Privacy Control.

We do not sell personal data. We share it with Google for advertising only if you turn advertising cookies on.

The assistant and AI

The research assistant is an AI. To answer, it sends your question, the earlier messages of the conversation and the results of the estimates it runs to the AI provider of the model the assistant uses, OpenAI or Anthropic. They process it under their API terms, which do not allow them to use it to train their models. The reading of official tariff texts by AI models involves no data of yours.

Who receives it

Only the service providers that run TariffTrust for us, each bound by contract to use the data only to provide their service to us:

Stripe also uses payment data as an independent controller, for fraud prevention and its legal obligations, under its own privacy policy.

Google (Google Analytics, United States, certified under the EU–US Data Privacy Framework) receives the audience measurement data described above, in Europe only with your consent; if you turn advertising cookies on, Google may also use it for its advertising services.

We may also disclose data when the law requires it, or to protect the rights and safety of our users or of TariffTrust.

Where it is kept

TariffTrust and its data are hosted in the United States, by the providers listed above; our mailboxes are in France. These transfers out of the European Union rely on the European Commission's standard contractual clauses in our contracts with them, or on their certification under the EU–US Data Privacy Framework; a copy of these clauses is available from privacy@tarifftrust.com. For the content of a customer's workspace, our data processing addendum sets out the same.

How long we keep it

• What your workspace saves is kept as long as the workspace exists, unless an owner or administrator deletes it; so are its audit log, its assistant conversations and its support requests. A workspace without a subscription for three years is deleted, its owners told by email a month before; a workspace whose plan was never chosen holds nothing and is deleted 30 days after its creation. Your account is kept until you delete it; deleting it leaves your email where it names the author of what you saved in a workspace, which is that workspace's.
• Records of sent emails: 30 days; notifications: 90 days; detailed usage events: 400 days; the rows of finished imports and research: 30 days; sign-in sessions: two weeks.
• Audience measurement data is kept 14 months in Google Analytics; its cookies last at most 13 months.
• Invoices are kept as long as accounting and tax law require.
• When an account has had a free trial, a one-way fingerprint of its email address (lowercased, without what a “+” adds to it and, for Gmail, without dots) is kept with the day the trial started, even after the account is deleted, so that the trial is offered once per person. It does not give back the address; it only tells whether an address signing up again already had a trial.
• Database backups are kept seven days, and the earlier versions of the files that hold your data seven days at most: deleted data leaves them within that time. A recovery copy made when we rebuild the production environment is kept until we delete it.

Cookies

The cookies TariffTrust needs to work are always on. In the European Union, the EEA, the United Kingdom and Switzerland, the others are set only if you accept them, in the banner shown on your first visit, where refusing is as easy as accepting. Elsewhere, audience measurement is on until you turn it off, as a short notice says on your first visit; advertising cookies are set only if you turn them on. Everywhere, you can change your choice at any time from “Cookie settings”, at the bottom of every page. Where you are is read from your browser's time zone. Your browser also remembers a few interface choices on your device, such as how you enter a value or where the menu was scrolled.

A browser that sends Global Privacy Control is never given advertising cookies. With advertising cookies on, Google may collect information about your visits here and on other sites over time. “Do Not Track” signals change nothing to what we collect.

How we protect it

Connections are encrypted (HTTPS only), and so is data at rest. Passwords and API keys are stored only as one-way hashes; two-factor authentication is available to every user and required for our administrators. Access to production data is limited to the people who operate the service. To report a vulnerability, write to security@tarifftrust.com (see our security.txt).

Your rights

You may ask to access, correct, export or delete your personal data, to restrict or object to its use, and to withdraw a consent you gave. Much of it you can do yourself: your account page changes or deletes your account, an owner deletes the workspace, and its saved results export at any time: by its members while it is subscribed, by its owner even without a subscription. For anything else, write to privacy@tarifftrust.com: we answer within 30 days. If your workspace's owner is a customer of ours, we may refer your request about its content to them. You may also complain to a data protection authority: in France, the CNIL (cnil.fr); elsewhere in the European Union or in the United Kingdom, that of your country. Residents of California and of other US states have the rights their state's law gives them: we do not sell personal information, and share it for advertising only if you turn advertising cookies on; Global Privacy Control is honored as an opt-out.

Changes

We update this policy when what we do changes. A material change is announced by email or in the workspace before it applies; the date at the top of this page is that of the version in force.