Privacy Policy

We run a privacy service, so we try to collect as little as we can and protect what we hold. This policy explains what Supplier Privacy (a service of VAR LLC) collects, why, and what you can ask us to do with it.

What we collect

When you run an Exposure Check or contact us

• The company name you enter, your email address and the page you submitted from
• Anything you write in a contact message

When you become a client

• Your name, email, phone number and job title, and those of the person who signs
• Your company's legal name, DBAs, affiliates, U.S. and past addresses, and EIN
• Your suppliers' names, countries and addresses
• Signed certifications, CBP acknowledgements and our filing records
• When you e-sign a certification: your typed name, the time, and the IP address and browser you signed from, kept as the signature's audit record
• Billing details, handled by our payment processor. We never see or store full card numbers.

When you visit the site

We use Plausible, a cookie-free analytics tool that doesn't collect personal data or track you across sites. We don't use ad pixels, third-party cookies or chat widgets. Logging in to your dashboard uses an essential session cookie.

If you arrive from one of our ads or a campaign link, or from another website, we keep that source (the campaign tags in the link, the ad's click ID and the referring site's name) in a first-party cookie for up to 90 days. Only our own server reads it. If you then request a report or buy a plan, we save the source with your request so we know which channels work. When the source was a Google ad, we may tell Google Ads that the click led to a sign-up or purchase, using that click ID only, never your name, email or company.

How we use it

• To research, prepare, submit, monitor and renew your confidentiality filings
• To send your Exposure Check report, status updates, leak alerts and renewal reminders
• To bill you and keep required business records
• To answer your questions

We don't sell your information or use it for advertising.

Who we share it with

• U.S. Customs and Border Protection, which receives the information in the requests you approve
• Service providers that process data for us under contract: Vercel (hosting), Supabase (database and file storage), Stripe (payments), Resend (email) and ImportYeti (the company name you enter, to look up public shipment counts)
• Authorities, if the law requires it

How we protect it

• EINs are encrypted at the column level
• Database row-level security keeps each client's records separate
• Staff access requires multi-factor sign-in, and access to sensitive data is logged
• Signed documents are kept in private storage, never public links

How long we keep it

We keep client records while your plan is active and for as long as needed for legal and accounting purposes afterward. Exposure Check and contact submissions are kept until you ask us to delete them or they're no longer needed.

Your choices

You can ask us to show, correct or delete the information we hold about you. Email hello@supplierprivacy.com or use the contact form with the topic "Data or privacy request". We'll confirm your identity before acting on it. Deleting your data doesn't withdraw a confidentiality request already granted by CBP.

Children

The service is for businesses and isn't directed at anyone under 18.

Changes

If we change this policy in a way that matters, we'll update the date above and email active clients.