Privacy Policy

Effective: March 2026 · Harmonized Trade Systems LLC · Greenwood Village, CO 80111

1. Who We Are

LandedHTS is a product of Harmonized Trade Systems LLC, headquartered in Greenwood Village, Colorado 80111. This policy applies to landedhts.com, app.landedhts.com, and all related services.

2. Data We Collect

Account Data

When you create an account: email address, hashed password, company name, and subscription tier.

Calculation Data

HTS codes, country of origin, transaction values, and calculation results. All calculation data is tenant-scoped and isolated.

Contact and Waitlist

Name, email, company, and message content submitted through contact and waitlist forms. IP addresses are hashed with a secret salt before storage — we never store raw IP addresses.

Analytics

We use self-hosted Plausible Analytics. Plausible is cookieless, does not use fingerprinting, does not collect personal data, and is fully GDPR compliant. No data is sent to third parties. All analytics data is stored on our own infrastructure.

3. Legal Basis for Processing (GDPR)

• Contract performance: Account data and calculation data are necessary to provide our services.
• Consent: Waitlist and marketing communications require explicit opt-in consent.
• Legitimate interest: Anonymous, cookieless analytics to improve our service.

4. How We Use Your Data

• To provide tariff calculation services
• To process IEEPA refund assessments and claims
• To respond to contact form inquiries
• To send product updates (only with consent, unsubscribe anytime)
• To improve our service through anonymous analytics

5. Data Sharing

We do not sell, rent, or share your personal data with third parties. Data is processed only by our own infrastructure on Amazon Web Services (AWS) in the United States (us-east-2, Ohio).

6. Data Security

• All data encrypted in transit (TLS 1.2+) and at rest (AES-256)
• Row-level security in PostgreSQL for complete tenant isolation
• Passwords hashed with bcrypt (10+ rounds)
• IP addresses hashed with SHA-256 + secret salt
• JWT access tokens expire in 15 minutes
• No tracking cookies on any page

7. Data Retention

Account data: retained while your account is active, deleted upon account deletion request. Calculation data: retained for 7 years for audit compliance. Contact form data: retained for 2 years. Waitlist data: retained until you unsubscribe or request deletion.

8. Your Rights

All Users

• Request access to your personal data
• Request correction of inaccurate data
• Request deletion of your account and data
• Withdraw consent for marketing communications

European Economic Area (GDPR)

• Right to data portability
• Right to restrict processing
• Right to object to processing
• Right to lodge a complaint with your supervisory authority

California Residents (CCPA)

• Right to know what data is collected
• Right to delete personal information
• Right to opt-out of sale of personal information (we do not sell data)
• Right to non-discrimination for exercising privacy rights

9. Cookies

We do not use tracking cookies. Our analytics tool (Plausible) is entirely cookieless. Session authentication uses httpOnly secure cookies for refresh tokens only.

10. Children

Our services are not directed to children under 16. We do not knowingly collect personal data from children.

11. Changes

We may update this policy from time to time. Material changes will be communicated via email to registered users.

12. Contact

For privacy-related requests, use the contact form with the subject "Privacy Request."