How client data is handled

The short version

• The free tools that handle a matter store nothing about it. A CBP notice or a client document is read once on the server for its fields and discarded. The package is assembled in the browser and downloaded once; there is no stored copy.
• The questionnaire path sends no document anywhere. The hold type, the deadline and the evidence checklist all work from answered questions.
• The paid records store what was typed, because a record that can be returned to has to. Retention periods are in the Privacy Policy, section 4.
• No accounts, no tracking cookies. Analytics are anonymous per-tab step events: which step of which tool, never a name, a document or an IP address.

Tool by tool

For each tool: what leaves the browser and where it goes, then what any record holds afterwards.

Detention Decoder — upload path (free)

What is sent, and where

• The CBP notice is uploaded only after an explicit consent step. The server reads it into a fixed set of fields through Anthropic's Claude API, then discards the file and the response. Nothing about the notice is written to a log; an error log carries the error name only.
• The hold type and the response deadline are computed by deterministic code from those fields. The model reads words on a page; it does not classify the hold or set a date.
• Supporting documents, if any are added, go through a second consent step and the same read-then-discard path. Each is read for its key fields, matched to an evidence category, and discarded.
• The response package is assembled in the browser and downloaded once. There is no stored copy and no re-access after the download session.

What is kept

• A consent record: the time, which consent screen, the Terms version, the connection's IP address and browser user-agent. No content from the notice or the documents.
• Anonymous step events: which step of the tool a browser session reached. A random per-tab id, never a name, an IP address or any content.
• On a package purchase only: the email address given at checkout and the Stripe payment reference. No case detail. The download token expires after 7 days and cannot be re-issued.

Detention Decoder — questionnaire path (free)

What is sent, and where

• No document leaves the browser. The hold type, the deadline, the cited evidence checklist and the pathway suggestion are all computed from answered questions.
• The documents step can be skipped; the result still renders in full. Documents are needed only to be included in the package.

What is kept

• Anonymous step events only. No consent record is written, because nothing is uploaded; one is written later only if documents are added for the package.

Broker-Ready Doc Check and CPC Readiness Check (free)

What is sent, and where

• Each document added is read for its fields through Anthropic's Claude API behind a consent step, matched to its document type, cross-checked against the others, and discarded.
• The handoff package is assembled in the browser and downloaded once.

What is kept

• A consent record and anonymous step events, as above. On a package purchase, the checkout email and payment reference only.

Compliance Requirement Check (free)

What is sent, and where

• Nothing goes to an AI provider. The HS code and the answers are matched against the local snapshot of CPSC's flagged-code list and the questionnaire rules.

What is kept

• The HS code, the product description as typed, the answers, the outcome and the snapshot version, so the check can be audited. No name, no email, no company.
• An assent record for the Terms checkbox: the time, the Terms version, the connection's IP address and browser user-agent.

Screen a Supplier (paid)

What is sent, and where

• The typed supplier name and its country may be sent to Anthropic's Claude API with a web-search tool, only when the free corporate registries return nothing, to look for a public page for that company. Nothing else about the request is sent.
• After payment, the fixed verdicts and cited findings are sent to Anthropic's Claude API to write one narrative paragraph around them. The verdicts are produced by deterministic code before that call and cannot be changed by it.

What is kept

• The supplier name and address, the product and HS code, each check's verdict with its citations and snapshot version, and the email address given at checkout. This is the report record, kept so its owner can return to it: 12 months, with the access link expiring after 60 days (Privacy Policy, section 4).
• An assent record at checkout, as above, and the Stripe payment reference. Transaction records are kept for 7 years for tax purposes.

CPSC Product Registry Filing (paid)

What is sent, and where

• Nothing goes to an AI provider when the fields are typed; the submitted details are formatted against CPSC's published CSV schema on the server.
• If a certificate, test report or invoice is added on the first step to pre-fill the fields (optional), that document goes to this Service's server and then to Anthropic's Claude API for one read into the form's fields, and is then discarded — the same read-then-discard path as the document tools. The read values are marked on the form until checked, and only the fields as submitted become part of the record.

What is kept

• The filing details as submitted and the checkout email, kept as the filing record on the same 12-month and 60-day terms. The CSV, its companion README and — where the record can carry one — the certificate draft are also sent as email attachments through Resend. An added document itself is never kept.

The AI provider

One provider, Anthropic’s Claude API, is used for four things: reading a notice or a document into fields (the three document tools), writing the narrative paragraph of a paid screening report, and looking up a public page for a supplier name when the free registries find nothing. In every case the model reads; deterministic code decides. The hold type, the deadline and every verdict are computed before any model is called and cannot be changed by one.

On this side, nothing sent to the provider is stored or logged. On the provider’s side, Anthropic’s commercial API terms state that inputs and outputs are not used to train its models, and its retention of API traffic is set by its published policy at anthropic.com/legal/commercial-terms. The Service runs on those standard terms; a separate zero-retention arrangement with the provider has not been put in place. A firm whose policy requires one should use the questionnaire path, which sends nothing to the provider at all.

Using the tools with nothing uploaded

The Detention Decoder runs to a full result from its questionnaire: choose “Answer a few questions instead” on the first screen, answer them, and skip the documents step. The hold type, the deadline, the cited evidence checklist and the pathway the notice leans toward all render. Documents are needed only when the assembled package should contain them, and adding them is a separate, later choice behind its own consent step.

The Compliance Requirement Check asks for an HS code and product attributes and nothing that identifies a client. Screen a Supplier needs a supplier name by definition; that is the one tool where the typed name is part of a stored record.

Where records live and who can reach them

Paid records are stored in a Supabase (PostgreSQL) database, encrypted at rest, on infrastructure in the United States. A record is reachable only through its own access link, a high-entropy token that expires and is re-issued by email verification; the human-readable report ID opens nothing. The database’s privileged key is never exposed to a browser. The services that touch data are named in the Privacy Policy, section 5: Stripe, Resend, Anthropic, Supabase and Vercel.

For a compliance review

The questions a firm’s review of a generative-AI tool typically asks (Model Rule 1.6(c); ABA Formal Opinion 512, 2024), each answered in one line.

Where does client information go?

For a document added to any tool — the free document tools, or the Filing's optional pre-fill: to this Service's server, then to Anthropic's Claude API for one read, then nowhere — it is discarded. For the paid records: to a Supabase database, encrypted at rest.

Is a notice or a document retained?

No. Not on the server, not in a log, not in a backup. The package that contains them is built in the browser and downloaded once.

Is anything used to train a model?

No. This Service trains nothing. Anthropic's commercial API terms state that inputs and outputs sent through the API are not used to train its models; Anthropic's own retention of API traffic is set by its published policy.

Who at the vendor can see a matter?

Nobody sees a notice or a document; they are never stored. Paid records are reachable only through their own expiring access link; the database's privileged key is never exposed to a browser.

Can the tools be used without disclosing anything?

Yes. The Detention Decoder's questionnaire path produces the hold type, the deadline and the checklist with no document uploaded and no client identified. The Compliance Requirement Check needs only an HS code and product attributes.

Is there a written statement for the file?

This page, dated above, is that statement. Questions from a firm's compliance review go to support@tiana-co.com and are answered by the person who built the Service.

Questions and requests

Requests to delete a paid record, and questions from a compliance review, go to support@tiana-co.com and are answered within 30 days, as the Privacy Policy states. There is nothing to delete for a free document tool, because nothing was kept.