PRIVACY POLICY

Last Updated: August 4, 2026

This Privacy Policy describes how Glasswaves, LLC (“Company,” “we,” “us,” or “our”) collects, uses, stores, and discloses information when you access or use Tariff Code Compliance, including our website, applications, integrations, and related services (collectively, the “Services”).

The Services may include, but are not limited to:

  • Our public website at www.tariffcodecompliance.com
  • Contact and early-access request forms
  • Integrations with third-party platforms (e.g., e-commerce platforms such as Shopify)
  • Any associated applications, APIs, or tools

This is the umbrella privacy notice for the Tariff Code Compliance Services. Provisions that refer specifically to Agent, Explorer, or MCP features apply only when you use those features. If you use the Tariff Code Compliance Shopify application, the versioned Shopify-specific privacy policy presented in that application also applies to your use of the Shopify application. Where that application-specific policy addresses a Shopify feature or data practice more specifically, it governs that Shopify-specific use.

This Privacy Policy applies solely to business users, merchants, and authorized representatives interacting with the Services.

1. Information We Collect

1.1 Information from Integrated Platforms (e.g., Shopify)

When you install or use the Services through an integrated platform such as Shopify, we may receive and store information made available by that platform, subject to your permissions and the platform’s policies.

Store-level information

  • Store name
  • Store domain
  • Platform-specific store or account identifiers (e.g., Shopify shop ID)

Product and catalog data

  • Products and variants
  • Product titles, descriptions, and metadata
  • Prices, SKUs, and inventory-related attributes

Order or end-customer data

  • We do not actively query for end-customer or order data unless required for a specific feature you enable.
  • Some platforms may make limited end-customer or order data available to applications by default, depending on platform behavior and permissions.
  • Any such data is used solely to operate the Services and is not sold or independently commercialized.

1.2 Account, Contact, and Prospect Information

We may collect information that you provide directly to us, including through contact forms, early-access requests, account creation, or platform integrations, such as:

  • Name
  • Work email address
  • Company name
  • Industry or business context
  • Free-text messages or inquiries you submit

Where the Services are accessed via an integrated platform, we may also receive limited authorized user information provided by that platform (e.g., name and email address).

1.3 Billing Information

Billing for certain Services may be handled by third-party platforms or payment processors (e.g., Shopify).

We do not collect or store payment card numbers or other sensitive payment credentials directly, except to the extent required to support billing records or compliance.

1.4 Cookies and Similar Technologies

We use cookies or similar technologies for:

  • Authentication
  • Session management
  • Analytics about visits, referrals, searches, feature use, and conversions
  • Site functionality and performance monitoring

We do not use cookies for advertising, retargeting, or cross-site behavioral tracking.

1.5 Agent, Explorer, and MCP Inputs (Agent and Explorer Features Only)

When you connect Tariff Code Compliance to an AI assistant through the Model Context Protocol (MCP), the assistant platform controls the conversation and selects the inputs sent to our tools. We receive only the MCP tool inputs the client sends. We do not automatically receive the full conversation or a full product description that remains in the assistant platform.

If the client selects product text, a search term, a tariff code, or another fact as a tool input, we process that selected input to provide the requested knowledge-graph result. Agent and Explorer classification inputs are intended for business product and tariff information, not personal information. Do not send personal information, credentials, authentication secrets, or unrelated data through those inputs.

For security, reliability, plan administration, and measurement of private/custom integrations, we may record operational metadata such as account and request identifiers, tool action, tariff system and version, result status, duration, client and protocol information, and usage tier. Accepted MCP calls may produce usage events in Metronome. The current beta plan does not impose a customer charge or enforced usage limit, but these events may support usage-based pricing, limits, or enforcement under a future or different plan and applicable terms.

We may collect and retain reasonable service-interaction context, including full page and referrer URLs, paths, query strings and fragments, searches, product and classification inputs, tariff systems and versions, tariff codes, graph identifiers, tool inputs and results, account and request identifiers, campaign and client metadata, and feature-use events. Operational logs and analytics may contain this context when it helps us understand, operate, support, secure, or improve the Services.

We may use service-interaction and usage information at the event, account, and aggregate levels to understand adoption, improve the Services, provide onboarding and support, identify accounts and topics that may benefit from TCC products or services, support customer-success and sales activity, and send permitted first-party business communications. This may include product, search, classification, URL, referral, campaign, tool, result, frequency, and recency context.

Google Analytics and Vercel Analytics may receive the page, referrer, query-string, fragment, campaign, search, classification, destination, and custom-event properties that we configure the Services to send. We do not intentionally send credentials or authentication secrets to analytics providers.

2. How We Use Information

We use the information we collect to:

  • Provide, operate, and maintain the Services
  • Process and analyze product, catalog, and classification-related data
  • Respond to inquiries and support requests
  • Improve accuracy, performance, and reliability
  • Monitor usage, prevent abuse, and ensure platform integrity
  • Perform internal analytics and reporting
  • Analyze first-party account activation, feature adoption, usage frequency, and product engagement
  • Understand product, tariff, classification, search, referral, and campaign interests
  • Identify businesses and use cases that may benefit from TCC products or services
  • Provide relevant onboarding, customer-success, support, product-update, and other permitted business communications

We may also use information, including merchant or business data, to:

  • Develop aggregated, anonymized, or de-identified datasets
  • Train and improve internal models, systems, and workflows
  • Generate benchmarks, insights, and derivative outputs

Such use is designed not to identify you, your business, or your end customers.

We do not sell identifiable personal or merchant data.

3. Data Sharing and Disclosure

We may share information only as necessary to operate the Services, including with:

  • Cloud infrastructure and hosting providers, including Amazon Web Services and Vercel
  • Identity and authentication providers, including Auth0
  • Usage-metering providers, including Metronome
  • Analytics providers, including Google Analytics and Vercel Analytics
  • Subprocessors supporting reliability, security, communications, or AI-assisted functionality
  • Service providers acting on our behalf under confidentiality and data protection obligations

We do not share data with advertising networks or data brokers.

We may disclose information where required to:

  • Comply with applicable laws, regulations, or legal processes
  • Respond to lawful requests from public authorities
  • Enforce our Terms of Service or protect our legal rights
  • Facilitate a merger, acquisition, or asset sale involving the Company

4. Data Retention

Retention depends on the category and purpose of the information:

  • MCP application and operational logs are generally retained for no more than 90 days.
  • Google Analytics event-level data is generally retained for no more than 14 months. Vercel analytics and performance data is generally available for 1 to 24 months depending on the service plan and may be retained longer by the provider under its terms.
  • Account, entitlement, usage, support, and business records are retained for the duration of the account or business relationship and afterward only as reasonably necessary for security, audit, dispute-resolution, legal, and legitimate business-record purposes.
  • Aggregated or de-identified information that no longer identifies a user or business may be retained for product analysis and improvement.

Data may be retained in active, archived, or de-identified form. We delete or anonymize data when it is no longer reasonably required, unless continued retention is permitted or required by law or platform rules.

5. Data Deletion and User Rights

We honor applicable data protection laws, including GDPR and CCPA where applicable.

Depending on how you interact with the Services, you may request access to or deletion of certain personal data by:

  • Uninstalling an integrated application (where applicable), which may trigger platform-managed deletion processes, and/or
  • Contacting us using the information below

You may opt out of promotional emails through the unsubscribe instructions in the message or by contacting us. You may also ask us to stop using account-level usage metadata to select first-party marketing or sales communications. These choices do not prevent processing that is necessary to provide, secure, troubleshoot, or measure the Services, or to comply with law.

Certain data may be retained where legally required or permitted.

6. International Data Transfers

Our infrastructure is primarily hosted in the United States.

If you are located outside the United States, you acknowledge that your information may be transferred to, processed, and stored in the United States or other jurisdictions where we or our service providers operate.

7. Security

We implement reasonable administrative, technical, and organizational safeguards designed to protect information from unauthorized access, disclosure, or misuse.

No system is 100% secure, and we cannot guarantee absolute security.

8. Children’s Privacy

The Services are designed for business users and authorized representatives and are not directed to children under the age of 13.

We do not knowingly collect personal information from children under 13. Users under 18 should use the Services only when permitted by applicable law and any required parent, guardian, school, or organizational authorization.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

Material changes will be communicated through the Services or other appropriate means. Continued use of the Services after an update constitutes acceptance of the revised Privacy Policy.

10. Contact Information

If you have questions about this Privacy Policy or our data practices, you may contact us at:

Glasswaves, LLC 131 Continental Dr, Suite 305 Newark, DE 19713 United States

Email: legal@glasswaves.ai