Privacy Policy

1. Information we collect

Account information: your email address and a securely hashed version of your password (we never store your password in plain text). Organization information: the name of the organization you register.

Shipment and customs data: import and export records you upload, including entry numbers, HTS codes, SKUs, quantities, duty amounts, dates, ports, and destination countries ("Customer Data").

Billing information: to invoice you, we share your email address and organization name with our payment processor, Stripe. We do not receive or store your full payment card details; those are handled directly by Stripe.

Support and feedback: any bug reports or feature requests you submit through the Service, along with your account email.

Usage and log data: standard web server logs (such as IP address and timestamps) generated by our hosting provider.

2. How we use information

• To provide and operate the Service, including calculating eligibility and potential drawback refunds from the Customer Data you submit.
• To authenticate your account and keep it secure, including rate-limiting repeated failed login attempts.
• To send transactional email, such as password reset links and, if you submit feedback, an internal notification of your submission.
• To bill you for contingency fees on finalized claims.
• To respond to support requests and improve the Service.

3. Who we share information with

We do not sell your information. We share information with the following service providers, each of whom processes it only to provide their service to us:

• Stripe, Inc. - payment processing and invoicing.
• Resend - transactional email delivery (password resets, feedback notifications).
• Neon (via our hosting provider) - database hosting for the Service.
• Vercel Inc. - application hosting.

We may also disclose information if required by law, to protect our rights, or in connection with a merger, acquisition, or sale of assets, in which case we will provide notice where required.

4. Data retention

We retain your account and Customer Data for as long as your account is active. If you close your account, we will delete or anonymize your data within a reasonable period, except where we are required to retain it for legal, tax, or audit purposes (for example, financial records related to invoiced fees).

5. Security

We use industry-standard measures to protect your information, including encrypted connections (HTTPS/TLS), bcrypt password hashing, session-based authentication with httpOnly cookies, and rate-limiting on login attempts. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

6. Your choices and rights

You can access, correct, or request deletion of your account information at any time by contacting info@bdsalesinc.ca. Depending on where you are located, you may have additional rights under applicable privacy law (such as the right to request a copy of your data). We will respond to verified requests within a reasonable time.

7. Cookies

The Service uses a single essential session cookie to keep you logged in. We do not currently use third-party advertising or analytics cookies.

8. Children's privacy

The Service is intended for business use and is not directed at children. We do not knowingly collect information from children under 16.

9. International data transfers

Our infrastructure providers may process and store data in the United States and other countries. By using the Service, you consent to this transfer and processing.

10. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice (such as by email or an in-app notice).

11. Contact

Questions about this Privacy Policy, or requests regarding your data, can be sent to info@bdsalesinc.ca.

DrawbackIQ is operated by Buckshot Digital Sales Inc.