Privacy Policy

1. Who we are

Codici is operated by codi.ci. References to "we", "us", or "our" in this policy refer to the operator of this platform.

2. What data we collect

Account data

When you create an account we collect your name and email address. If you belong to an organization account, we also store your role within that account.

Lookup data

We keep a record of every lookup: the product description you submit, the classification we return, and the underlying response we receive from our classification partner. We do this so that the basis of a classification can be established later — customs matters are frequently reviewed long after the event, and a classification you relied on should be evidenced rather than reconstructed from memory.

These records are held for 7 years from the date of the lookup and are stored so that any later alteration is detectable.

What we do not do with them. These records exist to evidence classifications. That is their only purpose, and we hold ourselves to the following:

• They are not analysed. We do not mine, profile or aggregate the content of your lookups, and we do not build reports about you, your products or your trade from them.
• They are not used to train any model, ours or anyone else's.
• They are not sold, rented or shared. The only party that ever receives a product description is our classification partner, at the moment you make the lookup and in order to answer it. The stored record itself is never sent anywhere.
• They are not read as a matter of course. Access is limited to authorised Codici staff and only where there is a reason: you have asked us for support, a classification is in dispute, or we are legally required to. Every such access is recorded against the member of staff who made it.

Whether you can see your own past lookups in the portal is a separate, optional setting. Your company administrator can switch Keep requests on, after which lookups become visible in your history; it is off unless someone turns it on. Switching it off deletes that history and it cannot be restored.

Payment data

We do not take payments through this platform and never handle your card details. Subscriptions are invoiced separately, and we store only the billing name, address and email you give us for that purpose.

Usage and technical data

We log each lookup against your account (user or API key, originating IP address, timestamp) for billing, rate-limiting and security purposes, together with a record of administrative actions taken on your account.

3. How we use your data

• To provide the service: process lookups, apply your plan allowance, and prepare invoices.
• To evidence classifications: keep a verifiable record of each lookup, as described in section 2.
• To communicate with you: account and sign-in emails, plan or allowance notices, and service updates.
• To improve the service: analyze aggregate usage patterns (never individual lookup content).
• To comply with legal obligations.

4. Data sharing

We share your product descriptions with our classification technology partner solely to perform the classification you requested, at the moment you request it. That partner processes this data under its own privacy policy.

Beyond that, nothing leaves us. The lookup records described in section 2 are never transmitted to any third party, and we do not sell your data to anyone.

5. Data retention

We retain usage metadata for as long as your account is active, plus 12 months after account closure. Lookup records, as described in section 2, are retained for 7 years from the date of the lookup, after which they are deleted.

Billing records are retained for 7 years to comply with financial regulations.

6. Your rights

Under GDPR (if applicable to you), you have the right to access, correct, or delete your personal data; to restrict or object to processing; and to data portability. To exercise these rights, contact us via the contact page.

7. Cookies

We use a single session cookie to keep you logged in. We do not use tracking or advertising cookies.

8. Security

Passwords are stored as bcrypt hashes. API keys are stored as SHA-256 hashes; the raw key is shown only once. All traffic is encrypted via HTTPS.

9. Changes to this policy

We may update this policy from time to time. We will notify registered users of material changes by email.

10. Contact

For privacy questions, please use our contact form.