Privacy Notice

1. Data we collect

• Account: your name, email address, password (stored only as a salted hash), company name, role and language preference.
• Workspace content: files you upload (for example purchase orders, invoices, packing lists, L/C texts), data extracted from them, products, counterparties (names, addresses and contact details of your buyers and suppliers), shipments, generated documents, notes and payment records you enter.
• Usage and security data: IP address and request details for security and rate limiting, and an audit log of actions in your workspace (who did what, and when).
• Billing: your plan and subscription status. Payment and billing details are collected by Paddle.com; we do not receive full card numbers.

2. Why we use it

• To provide the Service under our Terms: accounts, document extraction, review, generation and checks.
• To keep the Service secure: authentication, preventing abuse and investigating incidents.
• To bill paid plans and to answer your requests.
• To meet legal obligations.

We do not sell personal data, do not show advertising and do not use your content to train AI models.

3. Data about your business contacts

Documents you upload may contain personal data of other people, such as contact persons at your buyers or suppliers. We process that data on your behalf, only to provide the Service to you. You are responsible for having a lawful basis to share it with us.

4. Service providers and transfers abroad

• SSD Nodes — server hosting in Tokyo, Japan. Stores all account and workspace data (application, database and uploaded files) for as long as described in section 5.
• Cloudflare, Inc. — R2 object storage for encrypted backup copies of the database and uploaded files, kept for 30 days.
• Korea Customs Service (UNI-PASS Open API) — when you use the clearance status lookup, the B/L, cargo management or export declaration number is sent to look up the status.
• OpenAI — only when AI features are enabled for the Service and you use them: extracted document text or shipment data needed for the request is sent over an encrypted connection to generate the suggestion.
• Paddle.com — our reseller and merchant of record: when you buy a paid plan, Paddle processes your name, email, billing address, payment details and tax information to take the payment, issue invoices and meet tax obligations.

These transfers happen over encrypted connections when the data is stored or the feature is used. If you do not want your data transferred abroad, you may stop using the Service and ask us to delete your account; note that the Service cannot be provided without hosting.

5. How long we keep data

• Account and workspace data: while your account is active. After you ask us to delete your account or workspace, it is deleted within 30 days, except where the law requires longer retention (for example tax and accounting records).
• Original uploaded files: deleted after your workspace's retention period (365 days by default; an admin can change it). Extracted data and the audit log stay with the workspace.
• Backups: 30 days.
• Application logs: rotated automatically and kept for a short period.

6. Cookies and local storage

• tp_session — keeps you signed in (HttpOnly, expires after 12 hours).
• tp_csrf — protects forms against cross-site request forgery.
• tp_lang — remembers your language (1 year; also kept in your browser's local storage).

We do not use advertising or third-party analytics cookies.

7. Security

Connections use HTTPS. Passwords are stored as salted hashes. Every request is checked against your workspace membership so other companies cannot see your data. Server access is limited to the operator using SSH keys, and backups are stored in encrypted object storage.

8. Your rights

Under the Data Privacy Act you have the right to be informed, to access your personal data, to object to its processing, to have it corrected, erased or blocked, to data portability (shipment data can also be exported as CSV in the app) and to claim damages. Users in other countries have the rights given by their local law. Send requests to ladeoadmin@gmail.com from your account email; we respond promptly, normally within 15 days. You may also complain to the National Privacy Commission of the Philippines (privacy.gov.ph); users in Korea may also contact the Personal Information Protection Commission (privacy.go.kr, 182).

9. Data Protection Officer and contact

Our Data Protection Officer handles privacy questions and requests: ladeoadmin@gmail.com

10. Changes

We will post updates to this notice here and tell account owners about material changes before they take effect.