Privacy Policy

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the member states, as well as other data protection provisions, is:

Intrastat-ai
(Operator: Clemens Strobl)
Petronillaweg 6
3141 Kapelln
Austria
Email: clemens.strobl@hotmail.de
Website: www.intrastat-ai.com

2.1 Server Log Files (Hosting)

Our website is hosted externally (Koyeb). The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These include, among others:

• Browser type and version
• Operating system used
• Referrer URL
• Hostname of the accessing computer
• Time of the server request
• IP address

This data is not merged with other data sources. The collection of this data is based on Art. 6(1)(f) GDPR. We have a legitimate interest in the technically error-free presentation and optimization of our website – the server log files must be collected for this purpose.

2.2 Account Registration and Authentication (Supabase)

To use our service, you must register. For this, we collect at least your email address and a password. We use the service Supabase for managing user accounts and authentication.

• Purpose: Authentication, account management, securing the login process.
• Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

2.3 Locally Stored Data (Cookies & localStorage)

To provide our services, we store the following entries in your browser's local storage. All entries are technically necessary; no marketing or tracking cookies are set.

You can restrict or prevent the setting of cookies in your browser settings at any time. You can delete localStorage entries via the developer console (F12) or in your browser's privacy settings.

2.4 Web Analytics (Umami, cookie-free)

We use the analytics software Umami, which we operate ourselves on our own infrastructure (Koyeb). Umami operates without cookies and does not collect personal data: only page views, referrers, browser type, device type, and country (based on anonymized IP evaluation) are recorded. No data is disclosed to third parties.

• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the statistical analysis of usage).

2.5 Free Commodity Code Search (Rate Limiting & Logging)

For the publicly accessible, free commodity code search (CN8 code finder), we store your IP address for up to 24 hours in a cache (Redis, provider: Upstash) to enforce usage limits. In addition, the search terms entered are logged together with the IP address in our database to prevent abuse. You may request deletion of these log entries at any time by email.

• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in preventing abuse and ensuring fair provision of the free offering).

2.6 Contact Form (Resend)

If you write to us via the contact form, we process your name, email address, and message in order to handle your request. The message is sent to us via the email service Resend.

• Legal basis: Art. 6(1)(f) GDPR (handling your inquiry); Art. 6(1)(b) GDPR where a contract is being initiated.

The core of our tool is the AI-powered analysis of item descriptions (primarily PDF invoices) to determine CN codes, net mass, and country of origin.

3.1 Data Storage

• Documents (PDFs, photos) that you upload for analysis are stored only while processing and any possible retry of the job, encrypted in our database (provider: Neon, server location Frankfurt/EU). We automatically delete the raw file after the job completes, is rejected, or permanently fails.
• The extracted reporting data remains available in the job for review and export. You may delete your jobs and the data stored with them in the tool at any time; you may request the complete deletion of any remaining copies at any time by email.

3.2 AI Models & API Usage

To analyze free text from invoices and CSV files, we use API interfaces to third-party language and vector models. AI inference is performed through the Requesty LLM gateway in Microsoft Azure, Germany West Central region. For vector embeddings used in semantic search, we use HostYourAI. Processing takes place in the European Union.

• No AI training with your data: We integrate these models exclusively via commercial B2B APIs. Under the terms of use of the API providers used, data transmitted via the API is not used to train the public language models.
• Data minimization: We transmit to the AI interfaces only the item descriptions or extracted raw text, but not your login credentials or other account information.
• Website retrieval: For analysis purposes, the tool may also retrieve the publicly accessible full text of websites found in search results.
• Legal basis: Art. 6(1)(b) GDPR (the analysis of the data is the specific contractual purpose of our service).

3.3 Web Search (Brave / Tavily)

To determine the net mass and country of origin of goods, the tool performs automated web searches. In doing so, item descriptions as well as brand and supplier names from your invoices may be transmitted in search queries to the search providers Brave Search (default) and Tavily (fallback). The same applies to search terms you enter in the public CN8 code finder.

• Legal basis: Art. 6(1)(b) GDPR.

3.4 Geocoding & Distance Calculation (OpenStreetMap / OSRM)

To calculate the statistical value, location data (supplier and customer location) from your invoices is transmitted to the geocoding service Nominatim (nominatim.openstreetmap.org, OpenStreetMap Foundation) and the public routing service OSRM (router.project-osrm.org). Only place names are transmitted, never names or addresses of natural persons.

• Legal basis: Art. 6(1)(b) GDPR.

We use the following external service providers, which may process personal data on our behalf or as independent controllers:

The service providers named in this section process data in the European Union. We are happy to provide further information and the respective privacy notices upon request.

• Account data: until your account is deleted.
• Uploaded documents and analysis data: until you delete the respective job or request deletion by email.
• IP addresses for rate limiting (Redis): maximum 24 hours.
• Logs of the public commodity code search: until deleted upon your request.
• Server log files: in accordance with the retention periods of the hosting provider.

Under the GDPR, you have the following rights regarding your personal data:

1. Right of access (Art. 15 GDPR): You have the right to request information about the personal data we process about you.
2. Right to rectification (Art. 16 GDPR): You have the right to request the immediate correction of inaccurate personal data or the completion of incomplete personal data stored with us.
3. Right to erasure (Art. 17 GDPR): You have the right to request the deletion of the personal data stored with us ("right to be forgotten").
4. Right to restriction of processing (Art. 18 GDPR).
5. Right to data portability (Art. 20 GDPR).
6. Right to object (Art. 21 GDPR): If your personal data is processed on the basis of legitimate interests pursuant to Art. 6(1)(f) GDPR, you have the right to object.
7. Right to lodge a complaint with a supervisory authority (Art. 77 GDPR): You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates the GDPR. In Austria, this is the Datenschutzbehörde (Austrian Data Protection Authority), Barichgasse 40–42, 1030 Vienna, email: dsb@dsb.gv.at.

If you wish to exercise your right of withdrawal or objection, an email to the address given under point 1 is sufficient.

We reserve the right to amend this privacy policy from time to time so that it always complies with current legal requirements or to implement changes to our services in the privacy policy (e.g. when introducing new features). The new privacy policy will then apply to your renewed visit.