This document is currently published in English only. Spanish and Chinese translations are pending.

iOrderSmart AI Use Policy

Why this document exists

iOrderSmart uses artificial intelligence — branded Nova on most deployments — to help you process documents, analyze regulatory and trade data, draft communications, and act on tasks inside the Platform. Many companies are now restricting or banning AI tools for their staff because they can't answer two questions: *where does our data actually go*, and *who is accountable when the AI gets something wrong*. This policy answers both, in plain language, and is kept current as our AI architecture evolves. It supplements — and is incorporated into — the Terms of Use (§9) and the Privacy Policy (§4).

This document describes the platform-level AI architecture. A Specific Service may publish its own AI notice with more detail specific to that deployment (for example, Importa México's Privacy Notice §4); where it does, that notice supplements this one for that service.

1. What "Nova" and AI Agents are

• Nova / AI skills — features that use a language model to analyze a document, answer a question, draft content, or perform a defined task (e.g., tariff classification support, compliance checks) when you invoke them.
• AI Agents — accounts provisioned on the Platform, on a company's authorization, that act with a degree of autonomy across chat, tasks, and documents — participating in the Platform in a manner similar to a human user, but as software acting under your company's instructions and oversight.
• Where you are interacting with an AI Agent rather than a human, the Platform identifies it as such. Do not represent an AI Agent as a human to a third party outside the Platform.

2. What data goes where

• Language model providers. AI requests are processed by third-party language-model providers. As of this writing, that is the Anthropic (Claude) API. Under Anthropic's current API terms, data you send through the API is not used to train Anthropic's models. Our architecture is designed to be model-agnostic and may route to additional or different providers over time (for cost, capability, or redundancy reasons); if we add or change a provider, we will update this section and, for material changes, notify Specific Service Controllers so they can inform their users.
• External data sources. For specific skills (e.g., regulatory lookups), the platform may query external government or public databases, or run a web search, strictly as needed to complete the requested task. This is limited to what the skill requires — we do not proactively search the web with your data outside a specific, user-initiated task.
• What we do not do. We do not sell your data to AI vendors or anyone else. We do not use your uploaded business documents to train a model we own or operate, without your separate, explicit consent.
• Memory. Some AI features retain context across sessions (for example, so an agent remembers your company's prior conversations or preferences) to make interactions more useful. This is a form of profiling. Where a Specific Service provides a control to clear or limit this memory, it will be described in your account settings or that service's own notice.

3. Accountability — who's responsible when AI is involved

• AI output is advisory, not a decision. Classification results, compliance flags, drafted analysis, or recommendations from Nova are informational. They do not constitute legal, tax, customs, or other professional advice, and do not replace your licensed customs broker, accountant, or attorney.
• Human-in-the-loop is required for regulated or high-stakes actions. Do not file a customs declaration, make a binding tariff classification, submit a regulatory filing, or take an equivalent legally consequential action based solely on AI output, without review by a qualified human professional.
• Your company is accountable for its AI Agents. If your company provisions or authorizes an AI Agent to act on its behalf, your company is responsible for that agent's actions on the Platform as if a trained employee had performed them — including maintaining appropriate review of what the agent does, especially for anything customer-facing or externally communicated (see §5).
• We do not guarantee AI accuracy. Language models can produce plausible-sounding but incorrect output ("hallucinations"), especially on fast-changing regulatory subject matter. Always verify high-stakes output independently.

4. What you should — and shouldn't — put into AI features

• Do use AI features for your own company's documents and data, or data you are authorized to process on a third party's behalf (for example, a supplier's spec sheet shared for a specific transaction).
• Don't upload another person's or company's confidential, sensitive, or personal data into an AI feature unless you have the right and a lawful basis to do so.
• Don't use AI output obtained through the Platform to train, fine-tune, or benchmark a separate, competing AI product or service.
• Don't attempt to extract, reverse-engineer, or probe the underlying models, prompts, or system instructions behind Nova.
• Don't automate consumption of AI features (e.g., scripted bulk requests) without authorization from us where volume limits or credits apply.

5. AI on external channels (WhatsApp, Telegram, SMS, email)

Where an AI Agent communicates through an external messaging channel on your company's behalf, your company is responsible for ensuring recipients have consented to be contacted through that channel, in line with applicable messaging and communications law (for example, anti-spam or telemarketing consent rules in the recipient's jurisdiction) and the policies of the channel itself (e.g., WhatsApp Business policy). We identify AI-originated messages as such where the channel and context allow it.

6. For enterprise customers and security teams

If your organization needs to evaluate our AI data handling before allowing staff to use the Platform, we can provide, on request:

• the current list of AI/model sub-processors and their data-retention and no-training terms;
• a description of what categories of your data reach an AI feature, and under what conditions;
• our incident-response process for an AI-related data or output issue.

Contact it@iordersmart.com to request this information, or to report a concern about how AI is handling your data.

7. Changes to this Policy

We will update this policy when our AI providers, capabilities, or data-handling practices change materially, and will note the effective date of the current version below. Continued use of AI features after such an update constitutes acceptance of the then-current policy, to the extent permitted by applicable law.

Version: Draft 1 · Last updated: 2026-09-01