This document is currently published in English only. Spanish and Chinese translations are pending.

iOrderSmart Privacy Policy

Highlights

• iOrderSmart is a business-to-business supply-chain and trade platform. We are not a social network and do not run third-party advertising — there is no ad-tech section in this policy because we don't have one.
• We collect account, company, document, and usage data needed to run the Platform: registration details, company profile, the files you upload (purchase orders, sourcing docs, QC/inspection records, shipment and customs documents), and technical/session data.
• The Platform includes AI features (branded Nova on most deployments). AI processing of your data is described in full in §4 and in the companion AI Use Policy — read that document if AI usage is your main concern.
• We do not sell, rent, or otherwise provide your personal or company information to third parties for marketing purposes.
• Who is the "Controller" of your data depends on which deployment (Specific Service) you use. See §1. If you use a branded deployment with its own Privacy Notice (for example, Importa México), that notice is the legally binding one for your relationship — this document is the general platform-level baseline it builds on.

1. Who this policy covers, and who is the Controller

This Privacy Policy is published by Tech4Trade Limited, a company incorporated in Hong Kong (Certificate of Incorporation No. 2148310, dated September 24, 2014), which owns and licenses the iOrderSmart software (the "Platform").

iOrderSmart is deployed through branded, region-specific Specific Services operated by other members of the iOrderSmart Group (for example, Importa México, operated by Soluciones Integrales G1S, S. de R.L. de C.V., representing GIS Holdings Limited, Hong Kong). For each Specific Service:

• the operating entity named in that service's own Privacy Notice is your Controller — your direct counterparty and the party primarily responsible for your personal data; and
• Tech4Trade Limited (and, where applicable, its local technical-support affiliate) acts as a processor, providing and maintaining the underlying software under the Controller's instructions.

If a Specific Service you use has its own published Privacy Notice, that notice is the legally binding document for your relationship and prevails over this general policy on any point specific to that service (contact details, local legal basis, regional rights such as Mexico's ARCO rights or the EU's GDPR rights, retention periods tied to local law, and similar). Where no Specific Service notice exists, or on matters not addressed there, this policy applies, with Tech4Trade Limited as the responsible party.

How to find your Controller: check the footer of the site you registered on, or contact it@iordersmart.com and we will direct you to the correct entity and notice.

2. What information we collect

Depending on how you use the Platform, we may process:

• Identification and account data — name, email, company, country, and password at registration.
• Company and role data — company legal/trade name, tax ID, industry, your role (e.g., Main Contact / Admin / Regular user), and related company profile fields.
• Payment and tax/invoicing data — billing details and, where a Specific Service issues local tax invoices (e.g., Mexico's CFDI), the tax data required to do so.
• Operational documents — the files and records you create or upload to run your business on the Platform: products, sourcing records, purchase orders, QC/inspection requests and reports, sales orders, shipment and customs documents (e.g., pedimentos, certificates, spec sheets, product photos), and similar. These may contain personal data of third parties (your contacts, colleagues, or counterparties) — see §3 on your obligations regarding that data.
• Communications — messages, chat (including with AI Agents), tasks, and notifications you send or receive through the Platform.
• Connections and contacts — information about business contacts you add, invite, or connect with through the Platform, viewable by others connected to your company as configured by your account's permissions.
• Usage and technical data — IP address, browser and device type, operating system, session and activity logs, and similar data automatically generated by using a website or application.
• Cookies — we use cookies and similar technologies necessary for authentication, session management, and core site functionality. We do not use third-party advertising cookies. Any additional, non-essential cookies (e.g., analytics) will be disclosed here and, where required, subject to your consent.

We do not intentionally collect sensitive personal data. If a document you upload contains a third party's personal or sensitive data, you represent that you are authorized to share it with us for the purposes described in this policy.

3. Your obligations regarding data you provide

• You are responsible for the accuracy of the information you provide and for keeping your account credentials confidential.
• If you upload, enter, or share information about other people or companies (contacts, counterparties, colleagues), you represent that you have the right to do so and that your use complies with applicable data-protection law.
• Do not use the Platform to spam, harass, abuse, or otherwise violate these Terms or this Policy, or to submit information you believe could be injurious or unlawful.

4. Use of Artificial Intelligence

The Platform's AI features (branded Nova on most deployments) process the text, documents, and data you submit to them. In summary:

• AI requests are routed to one or more third-party language-model providers. As of this writing, that includes the Anthropic (Claude) API; the architecture is designed to support additional or alternative providers over time. Under Anthropic's current API terms, data sent through the API is not used to train Anthropic's models. We will keep this section, and the companion AI Use Policy, current if that changes or if additional providers are added.
• For certain skills, your data may be sent to or queried against external regulatory or informational sources (for example, government trade/customs databases or web search) strictly as necessary to perform the requested task.
• AI Agents provisioned as platform "users" (see the Terms of Use, §9) may read and act on data you or your company have made available to them, within the permissions your company configures.
• The Platform may retain conversational or usage history to improve AI features and to give an AI Agent persistent context about your company across sessions (a form of profiling). Where a Specific Service offers a way to limit or opt out of this, it will be described in that service's own notice or in your account settings.
• AI-generated output is advisory only and does not constitute legal, tax, or customs advice — see the Terms of Use §9 and the AI Use Policy for the full disclaimer and your responsibilities.

Full detail — including current model providers, retention, and how to raise a concern about AI data handling — is in the standalone AI Use Policy, which forms part of this Privacy Policy by reference.

5. Why we use your information (purposes)

• To provide the service: create and administer your account and company; authenticate you; operate the collaboration, document, sourcing, QC, and AI features you use; process payments and issue required invoices; send service communications (verification, alerts, operational notices).
• To improve the service: understand usage patterns, diagnose issues, and develop new features, using aggregated or de-identified data where feasible.
• Optional communications: with your consent (or, in permitted jurisdictions, on an opt-out basis), we may send product updates or relevant announcements. You can opt out at any time — see §7.

We do not sell, rent, or otherwise provide your personally identifiable information to third parties for marketing purposes.

6. Who we share your information with

We share data only as necessary to provide the Platform, with recipients acting under confidentiality and security obligations:

• Platform and technical-support providers within the iOrderSmart Group (Tech4Trade Limited and its local technical-support affiliates), to operate and maintain the Platform.
• AI and processing providers (e.g., Anthropic), to run AI features — see §4.
• Payment processors and, where applicable, authorized invoicing providers, to process payments and issue tax invoices.
• Messaging and notification providers, for email, push, or other notifications.
• Other Users you connect with or invite to a project, company, or document, according to the permissions you configure (for example, a customs broker, supplier, or carrier you add to a shipment).
• Authorities, when required by law, subpoena, or other valid legal process, or as necessary to protect the rights, property, or safety of the iOrderSmart Group, its Users, or the public.
• A successor entity, in the event of a reorganization, merger, or sale of assets, subject to that entity continuing to honor the commitments in this policy for previously collected data.

We do not sell your personal data.

7. Your rights and choices

Depending on where you or your company are located, you may have some or all of the following rights over your personal data, exercisable by contacting us (§10) or your Specific Service's Controller:

• Access, rectify, or delete the personal data we hold about you.
• Object to, or restrict, processing, and withdraw consent you previously gave (withdrawal is not retroactive).
• Data portability, where applicable.
• Mexico (LFPDPPP): the rights of Access, Rectification, Cancellation, and Opposition ("ARCO"), exercised as described in the Controller's Privacy Notice.
• EEA/UK (GDPR): the rights above, plus the right to lodge a complaint with your local supervisory authority. Where we transfer personal data outside the EEA/UK (for example, to Hong Kong or to a US-based AI provider), we rely on appropriate safeguards such as Standard Contractual Clauses.
• US state privacy laws (e.g., CCPA/CPRA and similar): the right to know what personal information is collected, to request deletion, and to opt out of "sale" or "sharing" of personal information — we do not sell personal information, and do not share it for cross-context behavioral advertising, so there is nothing to opt out of on that front, but you may still exercise your other rights.

We will respond to a verified request within the timeframe required by applicable law (for example, 30 days under Mexican law absent an extension).

You can review and update most account and company information directly from your account settings. You may close your account at any time by contacting us; we will delete or de-identify your data within a reasonable period, except data we are required to retain by law (for example, tax, customs, or accounting retention obligations) or that is necessary to resolve disputes or enforce our agreements.

8. Children

Our services are intended for business use by adults. We do not knowingly collect personal data from minors under 18, and ask that minors not submit personal information to us or use the Platform.

9. Security

We apply administrative, technical, and physical safeguards appropriate to the sensitivity of the data involved, including role-based access control, encryption in transit for sensitive data, and regular review of our systems for vulnerabilities. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. You are responsible for safeguarding your account credentials and for controlling who has access to your email and messaging accounts. Emails, chat, and similar messages within the Platform are not end-to-end encrypted; avoid sending highly sensitive information (e.g., full payment card numbers) through these channels.

10. Changes to this Policy; how to contact us

We may update this Privacy Policy to reflect legal, operational, or product changes. Material changes will be posted here, and, where required, notified by email or an in-product notice. Continued use of the Platform after such notice constitutes acceptance of the updated policy, to the extent permitted by applicable law.

Questions, requests, or complaints about this Policy: it@iordersmart.com, or the contact address published by the relevant Specific Service (see §1).