1. Controller

The controller for personal data processed via trafort.com and Trafort Workspace (trafort.com/app) is the provider named in the Impressum ("we"). Contact for all data protection matters: hi@trafort.com.

2. Visiting the website

Hosting. The website is hosted by Netlify, Inc. (USA). When you open a page, your browser transmits technical data (IP address, time, page, browser) that the host processes to deliver the page and protect it against attacks (Art. 6(1)(f) GDPR).

Fonts and scripts are served from our own domain. We do not load Google Fonts or other third-party fonts.

Analytics. We use Umami, a privacy-friendly analytics service. It counts visits in anonymous, aggregated form, sets no cookies and does not identify you (Art. 6(1)(f) GDPR). On blog articles we additionally count, without cookies, page views, read-throughs and clicks on the calculation button. In the tariff lookup and on the HS code pages we likewise count, without cookies, searches and opened codes (search text, code, language) to see which goods are in demand; please do not enter personal data in the search field. We do not store IP addresses: to count each reader only once per day we use a one-way hash of the IP address and browser together with a daily random value that is deleted after two days. The counts are stored with Supabase in Frankfurt (EU) (Art. 6(1)(f) GDPR).

Local storage. The site sets no marketing or tracking cookies. In your browser's local storage we keep only what the site needs to work: your chosen language and currency and, in the Workspace, your login session. This is strictly necessary for the service you request and needs no consent (§ 25(2) TDDDG).

3. Forms, email and Telegram

When you use a form (enquiry, supplier check, quote, partner request, newsletter, cancellation), we receive the data you enter, such as name, email, company and your message. Form submissions are stored by Netlify and forwarded to our internal Telegram chat so that we can respond quickly. If you write to us by email or to our Telegram bot, we process your message and, for Telegram, your profile data (name, username, ID, language). Purpose: answering your request, preparing and performing contracts (Art. 6(1)(b) GDPR).

Newsletter. If you subscribe, we use your email address to send trade news (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the link in every email or by writing to hi@trafort.com.

4. Trafort Workspace account

To use the Workspace you register with your email address and a password. We process: email address, password (stored only as a hash), plan and subscription status, saved analyses, your supplier search history and records of AI requests (type, time, cost – not their content). Purpose: providing the Workspace under the Terms (Art. 6(1)(b) GDPR). The database is operated by Supabase, Inc.; our project is hosted in the EU region Frankfurt (Germany). Account emails (confirmation, password reset) and confirmations of cancellations are sent via our email provider Brevo (France).

5. AI functions

For photo recognition, assistant questions and supplier search, the content you submit (photo, question, product description, previous messages of the conversation) is sent to Anthropic PBC (USA) and processed by its AI model Claude to produce the answer. For supplier search the AI also searches public websites. We do not store your photos or assistant questions; we store the results of supplier searches so that you can see them in your history. Under its commercial terms Anthropic does not use this data to train its models. Purpose: providing the AI functions you request (Art. 6(1)(b) GDPR). Please do not upload photos of people or documents containing personal data. AI answers are suggestions; we make no decisions with legal or similarly significant effect based solely on automated processing (Art. 22 GDPR).

6. Payments

Paid plans are paid via Stripe (Stripe Payments Europe, Ltd., Ireland, and its affiliates). Stripe processes your payment details (card details are entered directly with Stripe; we never see the full card number). We receive your name, email, billing address, any tax ID you provide, the payment and subscription status and the time and version of the terms you accepted. Purpose: contract performance and statutory accounting (Art. 6(1)(b) and (c) GDPR). Stripe also processes data as an independent controller, for example for fraud prevention; see Stripe's privacy policy at stripe.com/privacy.

7. Recipients and transfers outside the EU

We use the service providers named above (Netlify, Umami, Supabase, Brevo, Anthropic, Stripe, Telegram) as processors or, where stated, as independent controllers. Some of them are located in the USA or process data there. Transfers are based on the EU adequacy decision for the EU–US Data Privacy Framework where the provider is certified, otherwise on the EU standard contractual clauses (Art. 46 GDPR). We do not sell personal data.

8. Storage period

Account data: until you delete your account or ask us to delete it, then within 30 days, unless statutory retention applies. Enquiries and correspondence: up to 24 months after the last contact. Newsletter: until you unsubscribe. Invoices and payment records: for the periods required by tax and commercial law (in Germany up to 10 years). Technical server logs: as short as the host allows.

9. Your rights

You have the right to access, rectification, erasure, restriction of processing and data portability, the right to object to processing based on Art. 6(1)(f) GDPR, and the right to withdraw consent at any time with effect for the future. To delete your Workspace account, email hi@trafort.com from your account's email address. You may also lodge a complaint with a data protection supervisory authority. We respond within 30 days.

10. Changes

We update this policy when our services or the law change. The current version is always available on this page.