Privacy Policy

Who is responsible

Anchor Point AI Consulting LLC, a Florida limited liability company, operates Export Control Studio and is responsible for the personal information described here.

What we collect

Account information: your name and verified email address from sign-in (Clerk), and your account identifier.

What you save: saved cases, guided-review drafts, product and party profiles, transaction templates, share links (with the recipient’s email address), feedback reports, and API-key metadata. API keys are stored only as hashes.

What you screen: classification, destination, party names, countries and answers you enter. Ordinary searches are processed to return a result and are not saved unless you save a review. For item-and-country checks we also keep a daily count of which classification and destination were checked (for example, 5A992.c to Germany), with no account, name or network address attached, for 90 days, to see how the service is used. Party names are never recorded in these counts. Party names are sent to the U.S. government’s Consolidated Screening List service (trade.gov) to search the lists; its handling of those requests is outside our control.

Billing information: if you subscribe, Stripe processes your payment details. We keep your Stripe customer and subscription identifiers, plan, status and billing dates, not your card number.

Operational information: our hosting, sign-in and payment providers process technical information such as IP addresses and request logs to run and secure their services. To limit requests, including the free checks you can run without an account, we keep a one-way hash of your network address, keyed with a secret held separately from that data, with a request count for up to two days.

How we use it

To provide the Service and your saved records, secure accounts and prevent abuse (including per-minute limits), process subscriptions, answer support requests, and meet legal obligations. We count how many checks of each type run each day, as totals that are not linked to you or to what you entered. We also count how many different visitors and accounts ran checks each day, from the request counts described above, as totals only. When an account is created, its email address and sign-up time are emailed to the operator so we can welcome new users and spot abuse, and they appear again in a daily summary email; those emails are kept in the operator’s email account (Gmail) under its retention. A message sent with the contact form (your email address, the name you give, and your message) is emailed to the operator the same way and is not stored on the Service. When you describe an item in words on the Find the ECCN page, those words may be sent to Cloudflare Workers AI to suggest official Commerce Control List text with a similar meaning; they are used only to return the suggestions and are not stored on the Service. We do not sell personal information, do not share it for cross-context behavioral advertising, and do not use it for advertising.

Cookies and browser storage

We use the sign-in provider’s session cookies to keep you signed in. Guided-review progress is also kept in your browser’s session storage for the current tab. We do not use analytics, advertising or tracking cookies. To count visits we use Cloudflare Web Analytics, which sets no cookies and does not track you across sites; it records page views with general browser, device, referring-site and country details.

Who processes it for us

Cloudflare (hosting, database, file storage, visit counts, alert email delivery and AI search suggestions), Clerk (sign-in), Stripe (payments), Google (the operator’s email) and the trade.gov screening service (party searches). Each processes information under its own terms. We do not promise a specific hosting region or provider log-retention period.

How long we keep it

Saved records are kept while your account is open. If a subscription lapses, records stay readable and exportable for 90 days.

When you close your account, API keys and share links are revoked immediately and saved cases, profiles, templates and shares are permanently deleted 30 days later; you can cancel the closure during those 30 days. Your sign-in account is then deleted. Revoked API-key records and feedback reports are kept for 1 year for accountability, then deleted. Deleted data may remain in encrypted database backups for up to 30 days.

Temporary AES audit downloads expire after one hour and are removed by hourly cleanup; delays can postpone physical deletion.

Your choices and rights

You can download a copy of your data and close your account from your account page, and delete individual records from your workspace at any time. To ask about other privacy rights that may apply to you, contact us at the address below.

Security

Records are tied to your account with server-side ownership checks, API keys are hashed, and connections are encrypted. No system is perfectly secure; tell us promptly if you suspect unauthorized access.

Children

The Service is for business use and is not directed to children under 16.

Changes

We will post changes here and, for material changes, notify you by email or in the Service before they take effect.

Contact

Privacy questions and requests: support@exportcontrolstudio.com. See also the Terms of Service.