Table of contents
DRAFT FOR COUNSEL REVIEW. Written by Corvant against the platform as built. The sub-processor list in section 6 must be verified against the running service before this is published. Not effective until counsel has reviewed it and the effective date is confirmed.
This agreement forms part of the Terms of Service and applies where Corvant processes data on your behalf. Where the two conflict on data processing, this agreement governs.
1. Who is who
You are the customer: a customs brokerage, an importer of record, a law firm or another party with a Corvant account. You decide what data you upload and why.
We are Imperium Sky Ventures Inc., operating Corvant. We process that data on your instructions to provide the service.
Where a customs brokerage uploads a book containing entries belonging to its importer clients, the brokerage is responsible for having the right to do so and for its own obligations to those clients, including under 19 CFR 111.24.
2. What we process, and why
We process data only:
- to provide the service described in the Terms and in your agreement;
- as you instruct through the platform;
- to keep the service secure and operating, including logging and backups;
- to meet our own legal obligations; and
- as otherwise agreed in writing.
We do not sell your data. We do not share it with other customers. We do not use the contents of your entry data to market to your clients.
3. Categories of data
Typically:
- Customs entry data: entry numbers, filer codes, importer of record numbers, tariff classifications, country of origin, entered value, duty amounts, liquidation dates and status, and related line detail.
- Account and contact data: names, business email addresses, telephone numbers, business addresses, roles and permissions.
- Usage and technical data: log records, IP addresses, device and browser information, and product analytics events.
- Commercial data: purchases, invoices and payment status. Card details are handled by our payment processor and are not stored by us.
The platform is a business tool. It is not designed for special categories of personal data, and you should not upload them.
4. Your responsibilities
You confirm that you have a lawful basis to provide us with the data you upload, that you have given any notice and obtained any consent required, and that your instructions to us are lawful.
You are responsible for the accuracy of what you upload, for managing who in your organization has access, and for removing access promptly when someone leaves.
5. Security
We maintain technical and organizational measures appropriate to the data, including:
- encryption of uploaded files at rest using AES-256 server-side encryption provided by our storage provider, and encryption in transit using TLS;
- access controls and tenant separation, so that one customer's records are not accessible to another;
- role-based permissions within your own account;
- two-factor authentication available on accounts;
- logging of access and administrative actions; and
- restricting our own personnel's access to what their role requires.
[FOR COUNSEL: whether to commit to a named security standard or an audit report is a business decision. Nothing here claims a certification we do not hold.]
6. Sub-processors
We use third parties to run the service. As at the date above these are:
| Sub-processor | What it does | Data it sees | |---------------|--------------|--------------| | Amazon Web Services (S3) | Object storage for uploaded files | Entry data files you upload | | Neon | Managed PostgreSQL database | Account data and processed entry records | | Stripe | Payment processing | Billing contact and transaction data. Card details go directly to Stripe and are not stored by us | | Resend | Transactional email delivery | Recipient email address and message content | | signNow | Electronic signature | Signer name, email address and the document being signed | | PostHog | Product analytics | Usage events, account and user identifiers, technical data |
Two components are not third-party sub-processors:
- Error monitoring. We run our own error-tracking service on our own infrastructure. Error reports, which may include technical context about a request, do not leave systems we operate.
- Authentication. The authentication library runs within our own application and sends no data to a third party.
Processing takes place in the United States (see section 10).
[VERIFIED 2026-09-20 against the running codebase and the estate's rulings: @aws-sdk/client-s3 in packages/storage; signNow in packages/esign; stripe, resend and posthog-js/posthog-node in the platform's dependencies; Neon as the database provider. PostHog is CLOUD, US region, host https://us.i.posthog.com -- ruled 2026-09-01, never self-hosted -- so it is correctly listed above as a third party. Error tracking runs on the estate's own GlitchTip instance and is therefore NOT listed as a sub-processor. BEFORE PUBLICATION: confirm each listed provider's data processing addendum is executed, and name the hosting provider for our own infrastructure if counsel wants it enumerated.]
We impose data protection obligations on sub-processors that are no less protective than those in this agreement, and we remain responsible for their performance. We will give you notice before adding or replacing a sub-processor, and you may object on reasonable data protection grounds.
7. Data breach
If we become aware of a personal data breach affecting your data, we will notify you without undue delay, giving what we know at the time: what happened, the categories and approximate volume of data involved, the likely consequences, and the steps taken or proposed. Where our understanding is still incomplete, we will tell you what we know rather than wait until we know everything.
[FOR COUNSEL: a fixed notification window is deliberately not committed to here. Corvant processes United States customs data for United States customers; Texas law allows sixty days for notification to affected persons (Tex. Bus. & Com. Code 521.053) and no statute imposes a shorter fixed processor-to-customer deadline on us. Enterprise customers commonly ask for a fixed window (twenty-four, forty-eight or seventy-two hours) during contract negotiation; that is a per-contract commitment to make knowingly, not a default to publish.]
We will cooperate with you in meeting any notification obligation you have. Notifying you is not an admission of fault by either of us.
8. Retention and deletion
We retain your data for as long as your account is active and afterwards as described in your agreement and the Privacy Policy.
On termination you may request the return or deletion of your data. We will delete or return it within a reasonable period, except where we are required to retain it by law, or where it exists in routine backups, which are overwritten on a normal cycle.
Your own recordkeeping obligations remain yours. Customs records carry a five-year retention requirement under 19 CFR Part 163 running from the date of entry, and you should not treat the platform as your system of record for regulatory purposes.
9. Assisting you with individual rights
Where an individual exercises a right over personal data we hold for you, we will pass the request to you promptly and give you reasonable assistance in responding, taking into account what we can see.
10. International transfers
We process data in the United States. If you require processing in another region, raise it before you upload data.
11. Audit
On reasonable written notice, not more than once a year unless a breach or a regulator requires it, we will provide information reasonably necessary to demonstrate compliance with this agreement. Where an on-site audit is required by law, it will be at a mutually agreed time, at your cost, subject to confidentiality, and it must not disrupt the service or expose another customer's data.
12. Governing law
[FOR COUNSEL: to align with the Terms of Service.]
13. Contact
Write to legal@corvant.io.