Privacy Policy

Who we are and who this covers

Customs Declare is operated by Growth Data, 14 Meeshea Street, Race Course, Accra, Ghana (“we”, “us”), which is responsible for the personal data described here. This policy covers people who use the platform with a login (workspace members), people who start signing up, visitors to customsdeclare.com, and anyone who emails us.

What we collect

• Account data: email address, first and last name, role, and -- for password accounts -- a one-way hash of your password (never the password itself). If you sign in with Google, we store Google’s identifier for your account, never your Google password.
• Signup and acceptance records: the versions of our Terms of Service and this Privacy Policy you accepted when signing up, and when you accepted them.
• Workspace data: company name, contact name and email, and the country your workspace signed up from. That country is resolved automatically from your sign-up IP address and is used only to apply regional pricing.
• Documents and shipment data: invoices, packing lists and the data extracted from them (shipper, consignee, goods, values, HS codes, declarations), whether they arrive through the dashboard, the API or a mailbox you connect. These can include personal data about your trading partners and contacts; you’re responsible for having the right to share it with us.
• Integration settings: credentials for services you connect (QuickBooks, NetSuite, an email mailbox) and webhook signing secrets, stored encrypted.
• Billing data: your plan, prepaid balance, and payment references from Paystack. We never see or store your full card number.
• Technical data: IP address, browser type and requested page address in our server access logs; IP addresses held briefly in memory to enforce rate limits; sign-in times; and the cookies described in our Cookie Policy. What you type into the public HS code finder or duty calculator isn’t linked to an account, but it forms part of the requested address and so appears in those logs.

How and why we use it

• To provide the service you signed up for (performing our contract with you): accounts, document processing, declarations, integrations, billing and service emails.
• To keep the platform secure and working (our legitimate interests): preventing abuse, rate limiting, access logs, backups and troubleshooting.
• To meet legal obligations, such as keeping filed declarations and billing records for the required periods.
• To record your acceptance of our Terms of Service and this policy.

We don’t sell personal data, don’t use it for advertising, and don’t run analytics or tracking on this site.

Who we share it with

These subprocessors handle data on our behalf, each for a specific purpose:

• Cloudflare -- delivers and protects our website and API. All traffic to them passes through Cloudflare’s network, including your IP address.
• Hetzner -- hosts our servers, database, uploaded-document storage and backups, in Falkenstein, Germany.
• Anthropic (Claude API) -- reads uploaded document content to extract and validate shipment and customs data.
• Paystack -- processes subscription and Pay-Per-Use payments.
• Mailgun -- delivers our emails (verification, password reset, invitations, notifications, receipts), from its US region.
• Google -- only if you choose “Continue with Google”; handles that sign-in step.
• ipwho.is -- resolves your sign-up IP address to a country for regional pricing; we don’t store the raw IP address.

If you connect QuickBooks (Intuit), NetSuite (Oracle), an email mailbox or a webhook endpoint, data is exchanged with that service at your direction and under its own terms and privacy policy.

Where a subprocessor processes data outside your country, we rely on Standard Contractual Clauses (SCCs) as the transfer safeguard.

How long we keep it

• Filed customs declarations: 5 years after filing, to cover destination-country record-keeping requirements.
• Account and workspace data: while your workspace is active. After a deletion request, we complete full erasure within 30 days, except filed declarations still inside their retention period.
• Unfinished signups: if you start signing up but don’t finish, the details you entered are kept until you sign up again with the same email or ask us to delete them.
• Server access logs: up to 90 days.
• Database backups: 4 days.

Security

Traffic is encrypted in transit, workspaces are isolated from each other at the database layer, and integration credentials are encrypted at rest. Our Security page describes the measures in place.

Your rights

You can download a copy of the personal data tied to your account, or request deletion of your account, at any time from Account → Privacy & data while signed in. A deletion request removes your access immediately; because some records may fall under the retention periods above, full erasure is completed after a manual check rather than instantly. Depending on where you live, you may also have rights to correct, restrict or object to processing of your data -- contact us to exercise them. You can also complain to a data protection authority, such as Ghana’s Data Protection Commission or the authority where you live.

Children

Customs Declare is a business tool and is not directed at, or knowingly used by, children.

Changes to this policy

We may update this policy as our services or the law change. Every update is published here with a new “Last updated” date, and we tell workspace admins about material changes before they take effect. New signups accept the version in force when they sign up.

Contact

Questions about this policy: support@customsdeclare.com.