Privacy Policy

1. Information We Collect

a. Information You Provide Directly

• Account data: name, email address, password (stored as a one-way bcrypt hash), and profile information.
• Organization data: company name, address, and related business information.
• Shipment and trade data: export case details, destination and origin countries, incoterms, product descriptions, HS codes, ECCN classifications, shipment values, document files (invoices, packing lists, certificates), counterparty names (buyers, suppliers, carriers), and, if you use the Duty Calculator, the resulting duty/tax/fee estimates.
• Billing data: payment card information (processed and stored by Stripe, Inc. — we do not store full card numbers), subscription history, and billing address.
• Communications: emails, support messages, and feedback you send us.

b. Information We Collect Automatically

• Usage data: pages visited, features used, clicks, timestamps, and in-app actions.
• Device and connection data: IP address, browser type and version, operating system, referring URL, and device identifiers.
• Log data: server logs generated when you access the Service, including error reports.
• Cookies and similar technologies: see Section 9 below.

c. Information From Third Parties

• OAuth providers: if you sign in with Google, we receive your name, email address, and profile picture from Google, subject to Google's privacy policy.
• Payment processors: Stripe provides us with limited payment confirmation data (last four digits of card, expiry, payment status).

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, maintain, and improve the Service;
• Create and manage your account and process your subscription and payments;
• Run compliance rule evaluations, denied-party screening, readiness scoring, and document processing features;
• Send transactional emails such as account verification, password resets, shipment notifications, and subscription receipts;
• Send service announcements, product updates, and security alerts;
• Provide customer support and respond to your inquiries;
• Monitor and analyze usage patterns to improve the Service and develop new features;
• Detect, prevent, and investigate fraud, abuse, and security incidents;
• Enforce our Terms of Service and other policies;
• Comply with legal obligations, including responding to lawful requests from government authorities; and
• Protect the rights, property, and safety of the Company, our users, and the public.

3. Legal Basis for Processing (EEA, UK, and Switzerland)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data under the following legal bases:

• Contract performance: to provide the Service you have subscribed to;
• Legitimate interests: to improve the Service, ensure security, detect fraud, and communicate about product updates, where these interests are not overridden by your rights;
• Legal obligation: to comply with applicable law, including responding to valid legal processes;
• Consent: for any processing activities where we have asked for and received your consent, such as optional marketing emails.

4. How We Share Your Information

We do not sell your personal information to third parties. We may share your information in the following circumstances:

a. Service Providers

We share data with third-party vendors who process data on our behalf and are contractually bound to protect it. These include:

• Supabase, Inc. — database hosting and file storage (EU/US regions);
• Stripe, Inc. — payment processing and subscription management;
• Resend, Inc. — transactional email delivery;
• Trigger.dev Ltd. — background job and workflow processing;
• Functional Software, Inc. (Sentry) — error monitoring and performance tracking;
• Vercel, Inc. — cloud hosting and content delivery;
• U.S. Department of Commerce (Trade.gov API) — denied-party screening data (counterparty names are submitted to this API to check against the Consolidated Screening List), and, for the Duty Calculator feature, product HS codes and origin countries are submitted to look up free-trade-agreement tariff rates for shipments to the United States.
• Zonos, Inc. — if you use the Duty Calculator feature on a shipment, item descriptions or HS codes, product value, and origin/destination countries are submitted to Zonos to calculate an estimated duty, tax, and fee amount. No customer or supplier personal information is submitted as part of this calculation.

b. Legal Requirements

We may disclose your information if required to do so by law or in good faith belief that such action is necessary to: comply with a legal obligation or valid legal process (such as a court order, subpoena, or government request); protect and defend our rights or property; prevent or investigate possible wrongdoing in connection with the Service; protect the personal safety of users or the public; or protect against legal liability.

c. Business Transfers

In the event of a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction, your information may be transferred as part of that transaction. We will notify you of any such transfer and any choices you may have regarding your information.

d. With Your Consent

We may share your information for any other purpose with your prior consent.

5. International Data Transfers

The Company is based in the United States. If you are located outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States and other countries whose data protection laws may differ from those of your country.

Where required by applicable law (including the GDPR), we rely on appropriate safeguards for such transfers, including the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Agreement (IDTA), or we transfer data to countries that have been determined to provide an adequate level of protection.

6. Data Retention

We retain your personal information for as long as necessary to provide the Service and to comply with our legal obligations. Specifically:

• Account data is retained for the duration of your account and for up to 90 days after account deletion, unless a longer retention period is required by law.
• Shipment and trade data is retained for the duration of your subscription and for up to 12 months after account closure, to allow for regulatory audit and dispute resolution purposes.
• Billing records are retained for at least 7 years as required by financial recordkeeping laws.
• Audit logs and security event data are retained for up to 2 years.
• Error monitoring data (Sentry) is retained in accordance with Sentry's data retention policies.

7. Your Rights and Choices

a. All Users

• Account information: you may update your account information at any time through your account settings.
• Marketing emails: you may opt out of marketing emails by clicking "unsubscribe" in any such email. You will continue to receive transactional emails.
• Account deletion: you may request deletion of your account through Settings → Account → Delete Account. We will delete or anonymize your personal data within 30 days, subject to legal retention requirements.

b. EEA, UK, and Swiss Residents (GDPR Rights)

Subject to applicable law, you have the right to:

• Access: request a copy of the personal data we hold about you;
• Rectification: request correction of inaccurate or incomplete personal data;
• Erasure: request deletion of your personal data under certain circumstances;
• Restriction: request that we restrict processing of your personal data;
• Portability: receive your personal data in a structured, machine-readable format;
• Objection: object to processing based on legitimate interests;
• Withdrawal of consent: withdraw consent at any time where processing is based on consent.

To exercise these rights, contact us at privacy@latitude10.tech. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

c. California Residents (CCPA/CPRA)

California residents have the right to: (i) know what personal information we collect, use, disclose, or sell; (ii) request deletion of personal information; (iii) opt out of the sale or sharing of personal information (we do not sell personal information); (iv) correct inaccurate personal information; and (v) non-discrimination for exercising CCPA rights.

To submit a California privacy request, email privacy@latitude10.tech or call the toll-free number listed on our website. We will verify your identity before processing your request.

8. Data Security

We implement technical and organizational security measures designed to protect your personal information against unauthorized access, disclosure, alteration, and destruction. These measures include:

• Encryption of data in transit using TLS 1.2 or higher;
• Encryption of data at rest by our infrastructure providers;
• Password hashing using bcrypt with an appropriate work factor;
• Row-level security on the database layer;
• Access controls limiting employee access to personal data on a need-to-know basis;
• Regular security monitoring through automated error and anomaly detection.

No method of transmission over the internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee absolute security. In the event of a data breach that affects your rights and freedoms, we will notify you and the relevant regulatory authorities as required by applicable law.

9. Cookies and Similar Technologies

We use cookies and similar tracking technologies to operate and improve the Service. The types of cookies we use include:

• Strictly necessary cookies: required for authentication sessions and core Service functionality. These cannot be disabled.
• Functional cookies: used to remember your preferences and settings.
• Analytics cookies: used to understand how users interact with the Service to improve features and performance.

You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of the Service.

10. Children's Privacy

The Service is not directed to children under the age of 16, and we do not knowingly collect personal information from children under 16. If we learn that we have inadvertently collected personal information from a child under 16, we will take steps to delete that information as soon as possible. If you believe we may have collected information from a child under 16, please contact us at privacy@latitude10.tech.

11. Push Notifications

If you opt in to push notifications through the Service's progressive web app features, we will collect your device's push subscription token and use it to deliver shipment status updates and compliance alerts. You may opt out at any time through your browser or device notification settings or through the Service's notification settings page.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will provide notice by email to your registered address and by updating the "Last updated" date at the top of this page. We encourage you to review this Privacy Policy periodically. Your continued use of the Service after the effective date of any changes constitutes your acceptance of the revised Privacy Policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our privacy team:

October Moon LLC, d/b/a Latitude 10
Attn: Privacy
Email: privacy@latitude10.tech
General inquiries: hello@latitude10.tech

If you are an EEA resident and believe we have not adequately addressed your concern, you have the right to lodge a complaint with your local supervisory authority.