Privacy Policy

1.Data controller & scope

TradeOS is an independent product operated from Vietnam ("TradeOS", "we"). Questions about personal data: hello@tradeos.vn.

This policy follows Vietnam's Decree 13/2023/ND-CP on Personal Data Protection (PDPD), and applies the EU GDPR for data subjects in the European Union (e.g. importing partners).

2.Data we collect

We collect the following categories:

• Account information — email, display name, organization (via our authentication provider, Clerk).
• Business data you submit — product descriptions, declared HS codes, shipment values, destinations, invoices/documents uploaded for analysis.
• Classification & analysis history — HS results, FTA analysis, C/O drafts, monitored HS watchlists and alert email addresses.
• Billing information — plan and subscription status (processed by Lemon Squeezy; we do not store card numbers).
• Technical & usage data — access logs, IP address, device/browser type, feature-usage metrics, session cookies.

3.How we collect it

Directly from you when you register, submit data, or contact us; automatically when you use the service (logs, cookies); and from third parties you authorize — the authentication (Clerk) and billing (Lemon Squeezy) providers.

4.Purposes & legal bases

We process data to:

• Provide the service — run classification, FTA analysis, C/O drafting, and alerts (basis: performance of a contract).
• Operate & improve — security, debugging, aggregate analytics, quality (legitimate interest).
• Billing — manage plans and invoices (performance of a contract).
• Legal compliance — meet accounting, tax, and lawful authority requests (legal obligation).
• Communicate — compliance alerts and service notices to the email you provide (consent / legitimate interest).

5.AI (agent) processing & automated decisions

TradeOS is an agent-style service: we use Anthropic's Claude large-language-model API to classify HS codes, analyze FTA duties, draft C/O forms, and analyze the Official Gazette. Data you submit is transmitted to Anthropic solely to perform the task and return results.

We do NOT use your data to train our own models. Under Anthropic's commercial terms, data sent via the API is not used to train their models.

AI outputs are DECISION SUPPORT — not legal, customs, or tax advice — and may contain errors. No decision with legal effect is made solely by automated means: you review and decide before any official filing.

6.Sharing & disclosure

We do NOT sell personal data. We share data only with: (a) the sub-processors listed below, under contract and only to run the service; (b) authorities where required by law; (c) a successor in a merger or acquisition (with prior notice).

7.Sub-processors

We rely on the following providers to operate the service:

• Anthropic — AI processing (classification, analysis, drafting) — USA.
• Supabase — database (PostgreSQL), storage — international.
• Clerk — authentication & account management — USA.
• Lemon Squeezy — billing & Merchant of Record — USA.
• Resend — transactional & alert email — USA.
• Vercel — frontend hosting & CDN — global.
• Railway — application server hosting — USA.
• Upstash — cache (Redis) — global.
• Cloudflare (Turnstile) — bot protection — global.

8.International transfers

Some providers host outside Vietnam (mainly in the USA). By using the service you understand and agree that data may be processed in these countries, with contractual safeguards. For the PDPD, cross-border transfers are made with an appropriate impact assessment.

9.Data retention

We keep data while your account is active. After you close your account, personal data is deleted or anonymized within roughly 90 days, EXCEPT records we are required by law to keep longer (e.g. accounting/tax records under Vietnamese law). Technical logs are typically retained for about 12 months.

You may request export or deletion of your organization's data at any time.

10.Security

Data is transmitted over TLS and encrypted at rest by our providers. Each organization is isolated with Row-Level Security (RLS) by org_id; access is controlled through Clerk authentication. No method is perfectly secure, but we apply reasonable, industry-standard measures.

11.Data-breach notification

If we become aware of a security incident affecting personal data, we notify affected users and the competent authority without undue delay, consistent with the GDPR (within 72 hours to the supervisory authority) and Decree 13/2023/ND-CP (notification to the Cybersecurity Department — A05).

12.Your rights

Subject to applicable law (PDPD/GDPR), you may:

• Access and obtain a copy of your personal data.
• Rectify inaccurate data.
• Erase your data ("right to be forgotten").
• Restrict or object to processing.
• Port your data (receive it in a structured format).
• Withdraw consent at any time.
• Complain to a competent data-protection authority (Vietnam: Cybersecurity Department — A05, Ministry of Public Security; EU: your local supervisory authority).

13.Cookies & tracking

We use essential cookies for sign-in/session (via Clerk) and to store preferences (language). We do NOT use third-party advertising cookies or cross-site tracking.

14.Children

The service is for business users and is not directed at children under 16. We do not knowingly collect children's data; if discovered, we delete it.

15.Changes to this policy

We may update this policy. For material changes we will notify you via the service or email and update the effective date at the top.

16.Contact & complaints

For data-rights requests or complaints: email hello@tradeos.vn (TradeOS, Vietnam). We respond within the time limits set by law.

17.Governing law

This policy is governed by the laws of Vietnam, in particular Decree 13/2023/ND-CP; the GDPR applies additionally for EU data subjects.