Skip to content
Customs Check
Sign upCreate an account

Privacy policy

This page describes the data processed when you use the free customs file checker and, on accounts where it is enabled, the customs filing service: why the data is processed and how long it is kept.

Updated Oct 30, 2026

Data controller

The data controller is the sole proprietorship that publishes Customs Check, described in the legal notice. For any question about your data or to exercise your rights, write to the address at the bottom of this page or use the help center.

For the declarations, contacts, products and documents you enter about your own clients, suppliers or goods, you are the controller and Customs Check acts as your processor, as described in the terms of sale.

Data processed

  • The information entered in a check (countries, company, goods, values, documents ticked).
  • The files you choose to upload (PDF, JPG, PNG).
  • Your email address and, if you provide them, your company and job title, when you request the PDF report.
  • Account data (email, name) if you create an account.
  • Sign-in data: the IP address and browser of each session, kept with the session (which expires after 7 days without activity) and, if you turn on two-step verification, its secret and your backup codes.
  • The content of the customs declarations you prepare or file (parties, EORI numbers, goods, values, attached documents), your address book, your product catalogue and the mandates you record.
  • The messages exchanged with customs about your filings (registration, acceptance, control, release, rejection).
  • The log of webhook deliveries (references and states of your filings, sent to the address you give), kept for 30 days.
  • The email addresses and roles of the team members you invite, if you use a team workspace.
  • Billing data (subscription, credits, invoices). Card details are handled by Stripe and never reach our servers.
  • Usage events (pages viewed, check steps) linked to an anonymous identifier.
  • The email address and message you send from the help center or the chat window, with the page you write from.

Purposes

  • Running the check and producing the report.
  • Keeping a history of your checks, and the files attached to them, if you have an account.
  • Filing your declarations with French customs when you ask us to, and tracking their status.
  • Letting the members of your team work in a shared workspace.
  • Managing payments, credits and invoices.
  • Measuring use of the service and identifying the most frequent errors, as statistics.
  • Sending you tips, only if you have agreed to it.
  • Answering your help requests.

Legal bases

  • Running the check, producing the report and sending it to you: performance of the service you request (Article 6(1)(b) GDPR).
  • Keeping your account and the history of your checks: performance of the service linked to your account (Article 6(1)(b) GDPR).
  • Filing your declarations with customs, team workspaces and billing: performance of the contract you enter into (Article 6(1)(b) GDPR). Keeping invoices: legal obligation (Article 6(1)(c) GDPR).
  • Answering your help requests: our legitimate interest in replying to you (Article 6(1)(f) GDPR).
  • Internal usage statistics and protecting the service against abuse: our legitimate interest in improving and securing the service (Article 6(1)(f) GDPR).
  • Audience measurement with Google Analytics and tips by email: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time.

Retention periods

  • Uploaded files: expire after 24 hours, permanently deleted within 48 hours at the latest, unless they are attached to a check saved in your account.
  • Files attached to a check saved in your account: until you delete them, or until the account is deleted.
  • Content of a check made without an account: deleted after 72 hours; only the type of check, the score and the types of issues are kept, without identifying data.
  • Checks linked to an account: until the account is deleted.
  • Customs declarations, the messages exchanged with customs and the filing PDF: until the account is deleted. Customs rules require you to keep your own copy of your declarations, generally for at least three years (Article 51 of the Union Customs Code): export it before deleting your account.
  • Invoices and accounting records of purchases: ten years, as required by accounting law.
  • Administration and security logs: three years.
  • Emails left to receive a report: 3 years from the last contact.
  • Help requests and our replies: 12 months after the last exchange.

Cookies

The site uses a technical cookie that links your checks to your browser (12 months), a language preference cookie, a cookie recording your audience-measurement choice (6 months) and the cookies needed to sign in to your account. These cookies are necessary for the service to work and do not require your consent.

On the free tools, one more cookie counts the day's uses for visitors without an account, so that the daily free limit can apply: it holds a date and a number, no identifier, and expires at midnight UTC.

Google Analytics measurement is enabled only with your consent, requested on your first visit: it sets the “_ga” cookie. You can change your mind at any time through the “Cookies” link in the footer. Without consent we keep only internal usage statistics, with no third-party cookie and no IP address, for at most thirteen months. Microsoft Clarity session recording (Microsoft Corporation, United States) falls under the same consent: without it, the script is not loaded at all. With it, it sets the _clck and _clsk cookies; the contents of your file and of your report are masked before anything is sent.

When a commodity code search returns no result, the words searched are kept with these internal statistics so that we can correct our dictionary; they are not sent to Google. A search containing an email address or a string of digits is never kept, and neither is a search that finds something.

The draft of a check in progress is saved in your browser's local storage, on your device only: it is not sent to our servers until you run the check. It is deleted after 7 days, when you start a new check or when you choose to ignore it.

While you sign up with a code, the email address you entered is also kept in your browser's local storage, for 30 minutes at most, so that you can finish signing up from another tab; it is erased as soon as your account is created.

Hosting and processors

The service is hosted by Vercel; the database is hosted in the European Union by Neon; accounts are managed by the service itself and stored in that database; sign-in emails and messages sent to our contact address are delivered by Resend; audience measurement is handled by Google Analytics, subject to your consent, and by Vercel Analytics for page views and loading times. Payments are handled by Stripe. Files are kept in private storage and are never published. Your data is never sold to third parties. A declaration is sent to the customs authorities only when you file it from your account with the customs filing service (or when a member of your team with the right to do so files it), and only then. The checker alone sends nothing to customs. When you ask a checker to query an official register, only the value entered is sent: the EORI number to the European Commission or to HMRC (United Kingdom), the VAT number to the European Commission's VIES system, and the company name and chosen country to the European Commission's database of Authorised Economic Operators. The MRN of a transit movement is sent to the European Commission's transit follow-up service (MRN Follow-up). An exporter's REX number is sent to the European Commission's database of registered exporters (REX), from the REX checker or when a checked file claims a tariff preference. The names of the parties of a checked file, and the name entered in the sanctions screening tool, are compared with the sanctions lists loaded on our servers: they are sent to no third party and are not kept outside the file. A chemical substance search (CAS number, CUS number or name) is handled by our server in its copy of the European Commission's ECICS inventory, without being passed to any third party or stored; CAS numbers cited in the description of the lines of a checked file are looked up the same way. A tariff quota order number, typed in the quota balance tool or taken from the TARIC for the lines of a checked file that claim a quota, is sent to the European Commission's QUOTA database to read the balance.

Transfers outside the European Union

Vercel, Neon, Resend and Google are US companies, and Stripe is a US group whose European entity processes payments: even when your data is stored in the Union, as our database is, it may be accessed from the United States. These transfers rely on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's standard contractual clauses.

Your rights

You have the right to access, rectify, erase, object to and restrict the processing of your data, the right to receive your data in a portable format, and the right to lodge a complaint with the data protection authority of your country. You can export your data and delete your account yourself from the settings of your account, or ask us through the help center.

For any question or to exercise your rights: contact@customs-check.com.

Legal notice