TradeTrak1 Who we are
TradeTrak is operated as a unified export, import and customs operations platform comprising four product lines โ TradeTrak (for exporters), ImportTrak (for importers), CHA-Trak (for Customs House Agents and freight forwarders) and ComplyTrak (free, unlimited compliance validation bundled into all three), plus VaultTrak, our shared document vault. When this policy says "TradeTrak," "we," "us" or "our," it refers to all of these product lines together, since they run on one account and one underlying data platform.
We act as the Data Fiduciary (under India's DPDP Act, 2023) and, where GDPR applies, the Data Controller for the personal data described below. You can reach our team any time at support@tradetrak.in.
2 Data we collect
We collect only what is necessary to generate your trade documents, run compliance checks, calculate duty, manage your client jobs, and operate your account securely.
| Category | Examples | Collected when |
|---|---|---|
| Account & identity data | Name, email, phone number, password hash, Google sign-in ID, business role (exporter / importer / CHA) | Sign-up, login, profile updates |
| Business & trade data | Company name, IEC, GSTIN, address, bank details, shipment and invoice records, HS codes, consignee/supplier/client information | Creating shipments, generating documents, saving buyer/supplier/client masters |
| Document content | Commercial invoices, packing lists, Bills of Entry, Certificates of Origin, CHA service invoices you generate or upload | Document generation and VaultTrak storage |
| Payment data | Plan selected, billing cycle, payment status (card/UPI details are handled directly by Razorpay โ we never store full card numbers) | Subscribing or upgrading a plan |
| Usage & device data | Pages visited, documents generated, feature usage, IP address, browser type, approximate location | Automatically, via Google Analytics and Firebase Analytics |
| Support data | Support ticket messages, attachments, correspondence history | Raising a support ticket or emailing us |
We never ask for or store your full bank card number. Card and UPI payments are processed entirely by Razorpay, our PCI-DSS-compliant payment partner; TradeTrak only receives a payment status and reference ID.
3 How we use your data
- To generate accurate, compliant trade and customs documents on your behalf.
- To run ComplyTrak's rule-based IEC / GSTIN / IFSC / HS code validation.
- To calculate customs duty, landed cost, and CHA service billing.
- To power Gemini-based AI auto-fill suggestions from your own shipment history (your data is never used to train shared/public AI models).
- To process subscription payments and send billing receipts.
- To send transactional emails โ verification, receipts, alerts about document generation, LC/duty due-dates, and job status.
- To detect fraud, abuse, and prevent unauthorized account access.
- To improve the product, based on aggregated, anonymized usage patterns.
- To respond to support requests and legal obligations (e.g. tax, customs or law-enforcement requests under Indian law).
4 Legal basis for processing
Under the DPDP Act, 2023, we process your personal data on the basis of your consent (given at sign-up and via in-product consent notices) and, for certain limited purposes, legitimate uses such as fraud prevention and compliance with statutory obligations (e.g. GST, customs and tax record-keeping requirements). Where GDPR applies to you (for example, if you access TradeTrak from the EU/EEA), our legal bases also include performance of a contract with you and our legitimate interests in operating and securing the service.
7 Data retention
- Account data: retained while your account is active, and for up to 90 days after deletion to allow recovery.
- Trade & customs documents: retained for a minimum of 8 years where required by Indian GST, customs and DGFT record-keeping rules, even if you delete your account.
- Payment records: retained as required by Indian tax law (typically 8 years).
- Support tickets: retained for 3 years for quality and dispute-resolution purposes.
- Analytics data: retained in aggregated form indefinitely; raw device-level data is retained for up to 14 months.
8 How we protect your data
- Encryption in transit (TLS/HTTPS) for all traffic and at rest via Google Cloud/Firebase infrastructure.
- Role-based Firestore security rules so one user's data is never readable by another user's account.
- Razorpay payment signature verification (HMAC-SHA256) on every transaction โ no client-supplied payment data is trusted blindly.
- Firebase Authentication with support for Google sign-in and mobile OTP, in addition to email/password.
- Internal admin actions are logged to an immutable audit trail.
- Regular review of third-party processor security practices.
No system is 100% immune to risk. If we ever become aware of a data breach affecting your personal data, we will notify affected users and the relevant authority as required under applicable law.
9 Your rights
As a Data Principal under the DPDP Act (and, where applicable, under GDPR), you have the following rights over your personal data:
To exercise any of these rights, email support@tradetrak.in with the subject line matching the request (e.g. "Data Access Request," "Data Deletion Request"). We verify your identity before actioning any request and respond within 30 days.
10 International data transfers
TradeTrak's infrastructure runs primarily in Google Cloud's asia-south1 (Mumbai) region. Some processors we use (e.g. Google Gemini, SendGrid) may process data on servers outside India. Where this happens, we rely on our processors' standard contractual data-protection safeguards, consistent with DPDP Act and GDPR requirements for cross-border transfer.
11 Children's privacy
TradeTrak is a business-to-business platform intended for users who are at least 18 years old and authorized to act on behalf of a business entity. We do not knowingly collect personal data from children. If we learn that a child's data has been collected without appropriate consent, we will delete it promptly.
12 Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices, products (including new lines such as CHA-Trak), or legal requirements. Material changes will be notified via email or an in-product notice. The "Last updated" date at the top of this page always reflects the most current version.
13 Contact our Data Protection team
Questions about your data?
Our support team doubles as your first point of contact for privacy requests. For formal grievances, address your email to our Grievance Officer using the same inbox.