How client data is handled

The short version

• The free tools that handle a matter store nothing about it. A CBP notice or a client document is read once on the server for its fields and discarded. The package is assembled in the browser and downloaded once; there is no stored copy.
• The questionnaire path sends no document anywhere. The hold type, the deadline and the evidence checklist all work from answered questions.
• The paid records store what was typed, because a record that can be returned to has to. Retention periods are in the Privacy Policy, section 4.
• No accounts, no tracking cookies. Analytics are anonymous per-tab events: which pages are viewed, how far down a page is scrolled, and which step of which tool is reached, never a name, a document or an IP address.

Tool by tool

For each tool: what leaves the browser and where it goes, then what any record holds afterwards.

Customs-hold check — upload path (free)

What is sent, and where

• The CBP notice is uploaded only after an explicit consent step. The server reads it into a fixed set of fields through Anthropic's Claude API, then discards the file and the response. Nothing about the notice is written to a log; an error log carries the error name only.
• The hold type and the response deadline are computed by deterministic code from those fields. The model reads words on a page; it does not classify the hold or set a date.
• Supporting documents, if any are added, go through a second consent step and the same read-then-discard path. Each is read for its key fields, matched to an evidence category, and discarded.
• The response package is assembled in the browser and downloaded once. There is no stored copy and no re-access after the download session.

What is kept

• A consent record: the time, which consent screen, the Terms version, the connection's IP address and browser user-agent. No content from the notice or the documents.
• Anonymous step events: which step of the tool a browser session reached. A random per-tab id, never a name, an IP address or any content.
• On a package purchase only: the email address given at checkout and the Stripe payment reference. No case detail. The download token expires after 7 days and cannot be re-issued.

Customs-hold check — questionnaire path (free)

What is sent, and where

• No document leaves the browser. The hold type, the deadline, the cited evidence checklist and the pathway suggestion are all computed from answered questions.
• The documents step can be skipped; the result still renders in full. Documents are needed only to be included in the package.

What is kept

• Anonymous step events only. No consent record is written, because nothing is uploaded; one is written later only if documents are added for the package.

The document check and the CPC check (free)

What is sent, and where

• Each document added is read for its fields through Anthropic's Claude API behind a consent step, matched to its document type, cross-checked against the others, and discarded.
• The handoff package is assembled in the browser and downloaded once.

What is kept

• A consent record and anonymous step events, as above. On a package purchase, the checkout email and payment reference only.

Certificate check (free)

What is sent, and where

• The answers are matched against the questionnaire rules on the server, and an HS code that came with the product (from a product page or a report) is matched against the local snapshot of CPSC's flagged-code list. Neither goes to an AI provider.
• The product words typed in the product box — on the front page, on the plan, or in the check — are the one exception. When the built-in word list cannot match them, those words, and nothing else, are sent to Anthropic's Claude API to suggest which product type to tick. The suggestion arrives unticked and can be changed. The words are not stored and not logged.

What is kept

• The answers, the product description as typed, any HS code that came with the product, the outcome and the snapshot version, so the check can be audited. No name, no email, no company.
• An assent record for the Terms checkbox: the time, the Terms version, the connection's IP address and browser user-agent.
• Only if "Send me this plan" is used, after the answer (on the check or on the plan): the email address, when the form was sent, which page it was sent from and a short code computed from the plan, kept until the one-click unsubscribe in the email. The plan PDF goes to that address through Resend; its contents are not stored with the address.

The free checks from an AI assistant (the MCP server, free)

What is sent, and where

• An assistant such as ChatGPT, Claude or Perplexity can send only what each check takes: the product words and the answers given, the sales channels, a supplier name, or the answers to the customs-hold check's questions about a notice (and, for a forced-labor hold, the notice date). No document can be sent this way, and the customs-hold answers are worked out by code on the server, with no AI provider involved.
• The product words follow the same path as on the site: matched against the built-in word list, and sent to Anthropic's Claude API, words only, when the list cannot match them. A supplier name is matched against the stored government-list snapshots, and looked up in GLEIF's public company registry for a parent company. It is never sent to a web search.
• The conversation itself stays with the assistant's provider, under that provider's terms.

What is kept

• No check record and no report: the product words, the answers, the channels and a notice date are not kept. The registry's public answer for a supplier name is kept for 24 hours, keyed by that name, so the registry is not asked twice; this is the same cache the site's own supplier check uses.
• A per-hour request counter keyed by the calling connection's IP address, used to cap requests and deleted with the old counters.
• One anonymous count row per request: which check, whether it finished, and which assistant sent it. Nothing that was asked or answered is in it.

Supplier on a blacklist? (free answer, paid record)

What is sent, and where

• The typed supplier name and its country may be sent to Anthropic's Claude API with a web-search tool, only when the free corporate registries return nothing, to look for a public page for that company. Nothing else about the request is sent.
• After payment, the fixed verdicts and cited findings are sent to Anthropic's Claude API to write one narrative paragraph around them. The verdicts are produced by deterministic code before that call and cannot be changed by it.

What is kept

• The supplier name and address (and, on a report made before 2026-09-26, the product and HS code), each check's verdict with its citations and snapshot version, and the email address given at checkout. This is the report record, kept so its owner can return to it: 12 months, with the access link expiring after 60 days (Privacy Policy, section 4).
• An assent record at checkout, as above, and the Stripe payment reference. Transaction records are kept for 7 years for tax purposes.

Need the certificate in your own name? (paid)

What is sent, and where

• Nothing goes to an AI provider when the fields are typed; the submitted details are formatted against CPSC's published CSV schema on the server.
• If a certificate, test report or invoice is added on the first step to pre-fill the fields (optional), that document goes to this Service's server and then to Anthropic's Claude API for one read into the form's fields, and is then discarded — the same read-then-discard path as the document tools. The read values are marked on the form until checked, and only the fields as submitted become part of the record.

What is kept

• The filing details as submitted and the checkout email, kept as the filing record on the same 12-month and 60-day terms. The CSV, its companion README and — where the record can carry one — the certificate draft are also sent as email attachments through Resend. An added document itself is never kept.

The AI provider

One provider, Anthropic’s Claude API, is used for five things. It reads a notice or a document into fields (the three document tools). It writes the narrative paragraph of a paid screening report. It looks up a public page for a supplier name when the free registries find nothing. And it suggests which product type to tick from the words typed in a product box, when the built-in word list cannot match them. In every case the model reads; deterministic code decides. The hold type, the deadline and every verdict are computed before any model is called and cannot be changed by one. A suggested product type is not an answer either: it arrives unticked, and the check runs on what was ticked.

On this side, nothing sent to the provider is logged, and only one thing is stored: the result of a supplier web search, saved under the name and country and reused for 30 days. On the provider’s side, Anthropic’s commercial API terms state that inputs and outputs are not used to train its models, and its retention of API traffic is set by its published policy at anthropic.com/legal/commercial-terms. The Service runs on those standard terms; a separate zero-retention arrangement with the provider has not been put in place. A firm whose policy requires one should use the questionnaire path, which sends nothing to the provider at all.

Using the tools with nothing uploaded

The customs-hold check runs to a full result from its questionnaire: choose “Answer a few questions instead” on the first screen, answer them, and skip the documents step. The hold type, the deadline, the cited evidence checklist and the pathway the notice leans toward all render. Documents are needed only when the assembled package should contain them, and adding them is a separate, later choice behind its own consent step.

The certificate check asks for product attributes (no customs code) and nothing that identifies a client. The supplier check needs a supplier name by definition; that is the one tool where the typed name is part of a stored record.

Where records live and who can reach them

Paid records are stored in a Supabase (PostgreSQL) database, encrypted at rest, on infrastructure in the United States. A record is reachable only through its own access link, a high-entropy token that expires and is re-issued by email verification; the human-readable report ID opens nothing. The database’s privileged key is never exposed to a browser. The services that touch data are named in the Privacy Policy, section 5: Stripe, Resend, Anthropic, Supabase and Vercel.

For a compliance review

The questions a firm’s review of a generative-AI tool typically asks (Model Rule 1.6(c); ABA Formal Opinion 512, 2024), each answered in one line.

Where does client information go?

For a document added to any tool — the free document tools, or the Filing's optional pre-fill: to this Service's server, then to Anthropic's Claude API for one read, then nowhere — it is discarded. The same path, and the same discard, for the product words typed in a product box when the built-in word list cannot match them. For the paid records: to a Supabase database, encrypted at rest.

Is a notice or a document retained?

No. Not on the server, not in a log, not in a backup. The package that contains them is built in the browser and downloaded once.

Is anything used to train a model?

No. This Service trains nothing. Anthropic's commercial API terms state that inputs and outputs sent through the API are not used to train its models; Anthropic's own retention of API traffic is set by its published policy.

Who at the vendor can see a matter?

Nobody sees a notice or a document; they are never stored. Paid records are reachable only through their own expiring access link; the database's privileged key is never exposed to a browser.

Can the tools be used without disclosing anything?

Yes. The customs-hold check's questionnaire path produces the hold type, the deadline and the checklist with no document uploaded and no client identified. The certificate check needs only product attributes; it asks for no customs code.

Is there a written statement for the file?

This page, dated above, is that statement. Questions from a firm's compliance review go to support@tiana-co.com and are answered by the person who built the Service.

Questions and requests

Requests to delete a paid record, and questions from a compliance review, go to support@tiana-co.com and are answered within 30 days, as the Privacy Policy states. There is nothing to delete for a free document tool, because nothing was kept.