Tariff WatchThe short version. The public rate pages set no cookies and run no analytics. If you create an account, we hold your email and the product data you upload, and we use it only to compute your duty exposure and tell you when a rate that affects you changes. We do not sell it, we do not use it to train models, and we do not connect to your ERP or your broker’s systems.
Who we are
Tariff Watch is operated by Attoscale LLC. For questions about this policy or about data we hold, write to conor@attoscale.io.
The public site
The rate pages, the map, the changelog and the public JSON endpoints are readable without an account. We set no cookies on them and run no analytics or advertising scripts.
Our hosting provider records ordinary server logs for requests, including IP address, user agent, path and timestamp. We use those to keep the service running, to enforce the rate limit on the public endpoints, and to count page requests in aggregate so we know which pages to keep accurate. Logs age out on a short rolling window.
What we hold if you have an account
- Account details. Your email address, a hashed password or your identity provider’s identifier, your company name, and the members of your account.
- Product and supplier data you upload. SKUs, descriptions, classifications, countries of origin, unit costs, volumes and bills of material. This is commercially sensitive and we treat it that way.
- Entry data you upload. Entry summary exports, which include entry numbers, dates, classifications, values and duty paid. Used to reconcile projected against paid duty and to identify recoverable duty.
- Billing status. Your plan, subscription state and renewal date. Card details go directly to Stripe and never reach our servers.
Uploading without an account
You can upload a product list from the map and see your exposure without creating an account. That upload is held against a random token, is never joined to a person, and is deleted automatically after 24 hours unless you create an account and claim it. We built it that way deliberately: an anonymous convenience should not quietly become a permanent store of other companies’ product lists.
Why we process it
| Purpose | Data | Basis (GDPR) |
|---|---|---|
| Operate the service and compute exposure | Account details, uploaded product and entry data | Performance of a contract |
| Send alerts when a rate affecting you changes | Email, portfolio contents | Performance of a contract |
| Billing and collection | Email, plan, Stripe customer reference | Performance of a contract |
| Keep the service running and secure | Server logs, request metadata | Legitimate interests |
| Improve accuracy of the rate data | Aggregate page counts, never per-customer product data | Legitimate interests |
Processors
We use a small number of providers, each acting on our behalf under contract and each receiving only what it needs:
| Provider | Purpose | What it receives |
|---|---|---|
| Vercel | Hosting, edge delivery, short-lived request logs | Request metadata |
| Supabase | Database and authentication | Account details and uploaded data |
| Stripe | Payments and subscription management | Email, plan, payment details supplied directly to Stripe |
| Anthropic | Extraction of structured rate changes from published government documents, and classification suggestions | Public source documents; for a suggestion, the product description you ask us to classify |
On that last row, to be precise about a thing customers reasonably worry about: we do not send your portfolio to a model. The extraction step reads government publications, which are public. The classification suggestion sends only the one product description you asked us to classify, is labelled a suggestion everywhere it appears, and is never treated as a classification.
What we do not do
- No advertising, no advertising trackers, no third-party analytics on the public site.
- We never sell personal information, and we do not share it for cross-context behavioural advertising as California law defines those terms.
- We do not use your uploaded product, supplier or entry data to train models, ours or anyone else’s.
- We do not connect to your ERP, your broker, or ACE. All data enters by file upload, which is a deliberate design decision, not a missing feature.
Retention
Account data and uploads are kept while your account is open. If you delete an item, a portfolio or an upload, it is removed from active systems promptly and from backups within 35 days. If you close your account, we delete your data within 30 days, except records we must keep for tax and accounting purposes, which are retained for the period the law requires. Anonymous uploads expire after 24 hours. Server logs age out on a short rolling window.
Security
Traffic travels over TLS. Data is encrypted at rest. Each customer’s data is isolated at the database level by row-level security tied to account membership, rather than by application code remembering to filter, so a query that forgot a condition returns nothing rather than someone else’s product list. Access to production data is limited to those who need it. No system is perfectly secure; if a breach affects your data we will tell you and the relevant regulators as the law requires.
Your rights
You can export your data at any time from the application. Wherever you live, including under the CCPA and CPRA in California and the GDPR in the EEA and UK, you may ask what we hold, ask for a copy, ask us to correct or delete it, object to processing, or complain to your supervisory authority. Write to conor@attoscale.io and we will respond within 30 days. We will never discriminate against you for exercising these rights.
Data is processed on servers in the United States. If you are in the EEA or UK, transfers rely on the standard contractual clauses in our agreements with the processors listed above.
Children
This is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 18.
Changes
If this policy changes materially we will update this page with a new date and, for account holders, give notice by email before the change takes effect.
Contact
Attoscale LLC · conor@attoscale.io