Privacy Policy

Canopy AI is operated by IOTO Business Development + Consulting GmbH (Gasstrasse 4c, 22761 Hamburg, Germany). We are the data controller for your account details and for the running of the platform itself. When we store, read and validate the contracts, shipments and documents your organisation uploads, your organisation is the controller and we act as its processor, handling that content on its instructions and under a data processing agreement. Your organisation can withdraw our access to that content at any time from its company settings. For any privacy question, contact us at info@ioto.team.

We collect only the information needed to provide the service:

• Account data: your work email address, role and a hashed password. We do not collect your name. Passwords are stored only as salted argon2id hashes and are never visible to us.
• Contract and shipment data: the contract terms, shipment details and documents (invoices, bills of lading, certificates, packing lists) that you or your organisation upload for verification.
• Invitation and notice data: when you invite a colleague, or share a shipment with a counterparty, we store the email address you give us and a record of which addresses each invitation or shipment notice was sent to.
• Offer notices: when an offer is published to a company, a bid is placed or answered, or a buyer is nominated (or a nomination is accepted or ends), we email up to ten active admins of each company it concerns. The email names the product, origin and shipment period and links to the portal. It never carries a price, a volume or another company's name.
• Support requests: when you choose Contact a person in the AI assistant, or tap Send to support in the assistant on WhatsApp, we email your email address, your company name, the page you were on (in the portal), any note you add and that conversation to our support team so that a person can reply to you. A copy of that conversation stays in the support mailbox after you delete the chat in the portal; ask us at info@ioto.team to delete it.
• Demo requests: when you book a demo on our website, we collect your name, work email, company and any message you add. We use them only to reply to you and arrange the demo. The request is emailed to our team mailbox and is not stored in the platform; ask us at info@ioto.team to delete it from the mailbox.
• Usage and audit data: an append-only record of state-changing actions (who did what and when), kept for security and traceability.
• Technical data: standard server logs such as IP address, browser type and timestamps, used to operate and secure the platform.

We process this information to:

• provide document OCR, extraction and validation against your contracts;
• authenticate you and keep your session secure;
• maintain the audit trail and enforce access controls;
• share a shipment with a counterparty, and show an offer to the parties you select, when you choose to do so;
• answer a support request when you choose to send one to our support team with Contact a person, or with Send to support on WhatsApp;
• operate, monitor, troubleshoot and improve the service;
• comply with our legal obligations.

We do not sell your data, and we do not use your contract or document content to train our own or third-party models beyond what is strictly required to return your validation result.

Where GDPR applies, we process personal data on the basis of the performance of our contract with you, our legitimate interests in operating and securing the platform, and compliance with legal obligations. The optional analytics cookies on our public website are used only on the basis of your consent, which you can withdraw at any time from our Cookie Policy.

We rely on a small number of providers to run the platform, and we name them here:

• Mistral AI (France): reads uploaded documents for OCR and field extraction, and powers the in-product assistant. Content is sent over TLS. An uploaded document is deleted from Mistral once it has been read, and in any case within one hour.
• Hetzner (Germany): hosts the application, the database and the uploaded documents.
• Sentry (EU region): receives error reports from the platform, including an account identifier and the page an error occurred on. It does not receive your documents.
• Scaleway (France): delivers transactional email, which covers invitations, shipment handover notices, offer notices, password reset links, two-step verification notices, support requests and demo requests. A handover notice may carry a shipment certificate as a PDF attachment.
• Sinay (France), through its Safecube service: tracks a shipment's container from its container number, so the platform can show where the container is and when it is due. It receives only the container number, and returns the carrier, vessel, route, the container's position and its expected arrival. Sinay states that it stores this data on Google Cloud in Europe, and it sends its updates to us through its delivery provider, Svix.

Mistral AI, Hetzner, Sentry and Scaleway process data inside the European Union. If you link your WhatsApp number, Meta Platforms Ireland Limited also carries your WhatsApp messages with our assistant, as described in section 11. We have contractual safeguards in place with each of the other providers listed above. We do not yet have a data processing agreement with Sinay, and intend to put one in place. You can ask us for the current list at any time at info@ioto.team.

Separately, and only on our public website, Google Analytics measures visits if you have accepted analytics cookies. It runs on the public site alone and never on the signed-in platform, so no account, contract, shipment or document data is available to it. The service is provided by Google Ireland Limited, and any transfer of the data outside the European Economic Area relies on the European Commission's standard contractual clauses together with Google's certification under the EU-US Data Privacy Framework. Measurement data is retained for 14 months from collection, after which Google deletes it. That period does not restart when you visit again.

We keep contract data for as long as your organisation maintains an account. Shipments, their documents and the validation results derived from them are deleted automatically once they are older than your organisation's retention period, which is 365 days unless we have agreed a different one with you. Audit-log entries are append-only and retained for the life of the account. Database backups are kept for 30 days, and stored documents are copied hourly to a separate backup location that keeps earlier versions for 30 days, so data we delete at your request can persist in a backup for up to that long before it expires. You can request deletion of your data as described below.

Your conversations with the AI assistant are kept for 90 days after the last message in each conversation, or for your organisation's retention period if that is shorter, and are then deleted automatically. Only you can see your own conversations; nobody else in your organisation, including its administrators, can read them. You can delete any conversation yourself at any time from the assistant page, which removes it from our systems straight away, apart from database backups, which expire within 30 days, and any copy you sent to our support team with Contact a person or Send to support, which is kept as a support request as described below. Your conversations are not used to train AI models.

When you choose Contact a person, or Send to support on WhatsApp, we keep what you sent (your email address, company, the page you were on, your note and the chat you chose to share) as a support request, in order to answer it. Our legal basis is our legitimate interest in answering the people who ask us for help. The text of the request is deleted 90 days after the request is closed, or sooner if you ask or if your organisation's retention period is shorter, and a request with no status change for 60 days is closed automatically. We then keep a record of the request without any text (the reason, the topic, your company, whether it came from the portal or WhatsApp, and the dates) for up to 12 months. Deleting the chat does not delete the support request. We count, without any message text, where the assistant could not answer, to improve the service.

If your organisation is deleted, we keep the audit log of what was done in your account, including a record of the deletion itself, because we must be able to show how data was processed. Other organisations keep their own records of trades they did with you, such as a contract that names your company as their counterparty.

Each organisation's records are isolated from every other organisation's and are reachable only by its own users, unless you choose to share them as described in section 8. Stored documents, the database and its backups are encrypted at rest, and the separate copy of your documents is encrypted in the same way. Backups are kept off the application server, and restoring from them is tested. Every backup and copy job is checked automatically every 30 minutes, and a failure alerts us. The AI assistant is always labelled as AI, and nothing binding, such as issuing a contract, happens without a person approving it. We also apply role-based access control, encrypted transport, hashed credentials, optional two-step sign-in with an authenticator app, and magic-byte validation of uploaded files. No system is perfectly secure, but we take reasonable and appropriate measures to protect your information.

The platform lets you give another organisation access to a shipment, and lets you show an offer to parties you choose. When you do, that organisation sees only the fields covered by the access you granted, which depends on the role you gave it. A price, for example, is visible to a broker or a buyer but withheld from an observer.

Someone you invite by link can open the shipment without holding an account with us. Those links expire on their own, and you can revoke any access at any time from the shipment itself. We never give another organisation access to your data unless you grant it, and grants and the reads they allow are recorded in our audit trail.

Subject to applicable law, you may have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, and to lodge a complaint with a supervisory authority. Where we act as processor for content your organisation uploaded, we will pass your request to that organisation and help it respond. To exercise any of these rights, contact us at info@ioto.team.

A company admin can also do two things directly in Canopy AI, in Settings, in the Company group. Download all data gives one file with every document your organisation uploaded and its contracts, shipments, documents and check results as spreadsheets. Delete organization deletes your organisation and all of its data, including every user account, 14 days after you ask. Everyone is signed out when you ask, and during those 14 days only company admins can sign back in, to download the data or cancel the deletion. When the organisation is deleted, organisations you shared shipments with lose access to them. If you must keep trade documents by law, for example for tax purposes, download them first: we do not keep a copy for you.

We use a small number of strictly necessary cookies and browser storage to keep you signed in and to protect your account against password guessing, and optional analytics cookies on our public website that are set only if you accept them. See our Cookie Policy for details, including how to change your choice.

WhatsApp access is not switched on during the beta; the AI assistant is available in the portal. Once WhatsApp is switched on, the following applies.

If you link your WhatsApp number in Canopy AI, you can ask our AI assistant about your contracts and shipments over WhatsApp and approve its actions there. You are talking to an AI system, not a person. We only receive messages you send to our WhatsApp number and never see your other chats. Messages are carried by Meta Platforms Ireland Limited, which operates WhatsApp and processes them on our behalf. Meta stores the messages at rest in Germany and keeps them for up to 30 days; while they are being delivered they may also be processed in data centres in the United States, under the transfer safeguards Meta provides. Answers are produced by Mistral AI in France. We keep the link between your WhatsApp account and your Canopy AI account until you unlink it, and for at most 90 days, after which you link again. You can unlink at any time under Settings, WhatsApp. WhatsApp is optional: everything is also available in the portal, and you can reach a person at info@ioto.team.

We may update this policy from time to time. Material changes will be reflected by the “last updated” date above, and where appropriate we will notify you.

Questions about this policy or your data can be sent to info@ioto.team, or by post to IOTO Business Development + Consulting GmbH, Gasstrasse 4c, 22761 Hamburg, Germany.