Privacy Policy
Effective 27 September 2026 · support@vectelos.com
Vectelos is operated by Amplified Engineering Pty Ltd (Australia).
This policy covers vectelos.com, the application at app.vectelos.com,
the API at api.vectelos.com, and the Vectelos Duty MCP server at
mcp.vectelos.com (§10). It explains what we collect, why, and the
choices you have.
One thing is worth knowing up front:
- We do not keep your trade documents. Uploads are processed in memory and discarded, and the analysis we produce is cleared the moment you download it — within 30 minutes at most (up to 24 hours if you drive the API from your own system, so a batch can be collected). Details in §2.
1. Account information
When you create a free account we store:
- Your email address, and a one-way hash of your password (we never store the password itself).
- Your plan, your monthly analysis credit balance, and hashed digests of any API keys you generate (the key itself is shown once and never stored).
- Standard server logs — timestamps, request paths, error types, and a short non-reversible hash of your account ID for troubleshooting. Logs do not contain your email or the contents of your documents.
2. Documents you upload ("Zero Doc Store")
When you submit an invoice, quotation, or proforma for analysis:
- The file is held in memory only for as long as the analysis runs, then discarded. It is never written to disk and never used to train any model.
- The result of the analysis (line items, classifications, duty estimate) is held only for the working session — so a poll can find it, so the PDF can be rendered, and so you can correct a line. It is cleared the moment you download the PDF, and when you start a new analysis. An infrastructure retention policy deletes anything still there within 30 minutes of your last action. Closing the tab ends it. We keep no copy.
- If you call the API with an API key — typically an ERP or other system of yours submitting documents on your behalf — that result is kept for up to 24 hours instead, and is not cleared by the next submission. A machine caller submits a batch and collects the answers afterwards; a 30-minute single-shot window would silently lose them. The uploaded documents themselves are still never stored, at any window.
- The downloadable PDF is generated on demand from that stored result and streamed to you — it is not itself kept.
3. Accuracy feedback
If you flag a classification or supply a correction, we store the tariff facts of that line — the code, the rate, the origin country — so we can review and improve the engine. These records carry no account identifier, no job identifier, and no shipment detail, and cannot be traced back to you or your business even by us. A line-item description is included only if you explicitly tick the box to send it.
4. Retention
| Data | Kept for |
|---|---|
| Uploaded documents | Not stored — discarded after processing |
| Analysis results (signed in through the website) | The working session only — cleared on PDF download / new analysis, ≤ 30 min in all cases |
| Analysis results (your own system, via API key) | ≤ 24 h, so a batch can be collected |
| Generated PDFs | Not stored — rendered on request and streamed |
| Account (email, plan, credits) | Until you delete the account |
| Server logs | Rolling ~30–90 days |
| Accuracy-feedback records (§3) | Retained (already anonymous) |
| MCP server data | See §10 |
5. Your choices and rights
We automatically honour the Global Privacy Control signal if your browser sends one.
California residents may contact us below to opt out of the “sale” or “sharing” of personal information for targeted advertising under the CCPA/CPRA.
6. Security
Data is encrypted in transit (TLS) and at rest by Google Cloud at the
us-central1 zone.
7. Children
Vectelos is a business tool and is not directed to anyone under 18. We do not knowingly collect information from children.
8. Changes
If we change this policy we will update the effective date above and, for material changes, notify account holders by email. Continued use after a change means you accept the updated policy.
9. Contact
Amplified Engineering Pty Ltd — support@vectelos.com
10. Vectelos Duty MCP server (mcp.vectelos.com)
The MCP server computes US import duty for an AI agent you connect to it. It is a separate
account from app.vectelos.com. It sees only what your agent sends it as tool
arguments: tariff codes, countries of origin, customs values, quantities and dates. It has
no access to your conversation, your agent's memory or your files.
What we store
- Your account: your email address and whether it is verified, as reported by our sign-in provider, and your balance of checks (each pack's size, what remains and when it expires).
- A one-way hash of your email address, so the free checks are granted once per address.
- A record of each charge: the account, how many checks, and which pack they were drawn from. It carries none of the codes, values, quantities or duties. It exists so that a repeated identical request is not charged twice, and it is deleted after 24 hours.
- Personal access tokens: a one-way hash of each token (never the token itself), the name you gave it, when it was created and the month it was last used.
- Rate-limit counters per account, deleted within minutes.
- If you buy checks: your Stripe customer ID and the IDs of the payments that credited your account. Card details are entered on Stripe's page and never reach us.
What we do not store
The codes, countries, values and quantities you send, and the duties we return, are processed in memory to compute the answer and then discarded. They are not written to a database or to logs, and they are never used to train any model.
Logs
Server logs record the tool called, the number of lines, the checks charged, the outcome and the name of the AI client (for example Claude Code). They contain no email, no account ID and no request contents, and roll off after about 30 days.
Service providers
| Provider | Role | What it receives |
|---|---|---|
| WorkOS | Sign-in (email code) | Your email address |
| Stripe | Payments, when you buy checks | Your email address, billing address and card |
Google Cloud (us-central1) | Hosting and database | The data above, encrypted in transit and at rest |
We do not sell or share this data for advertising.
Retention and deletion
| Data | Kept for |
|---|---|
| Tool arguments and results | Not stored |
| Charge records | 24 hours |
| Rate-limit counters | Minutes |
| Account, balance, token hashes | Until you ask us to delete the account |
| Email hash for the free grant | Retained after deletion, so free checks stay once per address |
| Payment records | As long as tax and accounting law requires |
| Server logs | About 30 days |
To delete your MCP account, email support@vectelos.com from the address you signed in with. Revoking a token or disconnecting your agent takes effect at once and needs no request.