Customer trade datasets may include personal data depending on what the customer uploads.
Privacy
Privacy Policy
This Privacy Policy explains how intrastat.ai handles personal data in the website, contact, account, support, and AI-supported Intrastat preparation workflows.
Last updated: September 22, 2026
intrastat.ai may act as controller for its own business data and processor for customer-submitted datasets.
AI processing may involve OpenAI and Mistral AI where enabled, subject to provider configuration and agreements.
1. Who We Are
The website and service are operated by SmartRoad AI and Technology Services OÜ, Mäealuse 2/1, Tallinn 12618, Estonia.
For general privacy questions, use the verified public contact email info@intrastat.ai. A dedicated Data Protection Officer and supervisory authority have not been verified for publication in this notice.
A dedicated privacy contact, DPO, and supervisory authority are not yet published because they have not been verified for this notice.
2. Scope of This Privacy Policy
This Privacy Policy applies to the intrastat.ai website, contact forms, platform interactions, account-related interactions, support communications, and processing connected with the Intrastat preparation service.
Customer contracts, order forms, and any signed data-processing agreement may contain additional or more specific terms.
3. Categories of Personal Data
The categories of personal data processed depend on how the website and service are used.
- Account and user information such as name, business email, username, company information, and login-related information where accounts are enabled.
- Contact and support information such as name, email address, company details, message content, and related correspondence.
- Technical and security information such as IP-derived country headers, device/browser information, application logs, and security events where collected by the application or hosting environment.
- Customer-submitted business, invoice, ERP, trade, import/export, and Intrastat reporting data, which may include personal data depending on the customer dataset.
- AI processing inputs and outputs such as prompts, extracted fields, suggested classifications, validation results, transformed data, and declaration-preparation outputs.
- Human-review records where review is included in the service.
4. How Data Is Collected
Data may be collected directly from users, through customer uploads or integrations, through support and contact forms, through account interactions, and automatically through use of the website or platform.
The current website includes a contact form, account/login interface elements, selected-country browser session storage, and a visitor-country API that reads common country headers supplied by hosting or edge infrastructure.
5. Purposes of Processing
- Providing, configuring, and administering the service.
- Processing Intrastat-related data for extraction, structuring, normalisation, validation, classification assistance, review, and declaration preparation.
- Providing AI-assisted analysis and human review where included.
- Responding to contact, sales, and support requests.
- Maintaining service security, preventing abuse, troubleshooting, and improving reliability.
- Managing billing, commercial administration, and legal or compliance obligations where applicable.
6. Legal Bases
Different legal bases may apply to different processing activities.
- Service delivery
- Performance of a contract or steps requested before entering a contract, and legitimate interests in delivering the B2B service.
- Customer datasets
- Where intrastat.ai processes personal data on customer instructions, the customer determines the appropriate legal basis and intrastat.ai may act as processor.
- Support and contact
- Performance of a contract, pre-contract steps, and legitimate interests in responding to business enquiries.
- Security and logs
- Legitimate interests in securing the service and, where applicable, legal obligations.
- Optional cookies or marketing
- Consent where legally required. No analytics or advertising cookie implementation has been verified in the current website materials.
7. Customer as Controller and intrastat.ai as Processor
When intrastat.ai processes personal data contained in customer-submitted business datasets solely to provide contracted services on customer instructions, the customer may act as controller and intrastat.ai may act as processor.
intrastat.ai may act as controller for its own account administration, website, contact, billing, security, support, and business-administration data. These roles are context-specific and may be further defined in the applicable agreement or DPA.
8. AI Processing
The service uses AI to support extraction, matching, field suggestion, commodity/CN code assistance, validation, data transformation, and preparation of reporting information where those features are enabled.
Relevant inputs and outputs may be processed by AI systems. Not every record is necessarily sent to every AI provider, and intrastat.ai should not make provider-specific routing claims unless confirmed by configuration and contract.
9. OpenAI Data Processing
OpenAI may be used as an AI service provider or subprocessor for eligible AI workloads where enabled in the platform.
EU regional processing, provider-side retention settings, no-training commitments, and other provider-specific controls depend on the applicable OpenAI service, account configuration, model, endpoint, and agreement. This page does not claim exclusively European processing or no provider-side retention for OpenAI.
OpenAI EU regional processing, Mistral European regional endpoint usage, and provider retention controls should be confirmed against the active provider configuration before stronger claims are published.
10. Mistral AI Data Processing
Mistral AI may be used as an AI service provider or subprocessor for eligible AI workloads where enabled in the platform.
European regional endpoints, dedicated deployment options, retention settings, and training/use-of-data commitments depend on the applicable Mistral service, account configuration, endpoint, and agreement. This page does not claim that all Mistral processing remains exclusively in Europe unless that configuration is verified.
OpenAI EU regional processing, Mistral European regional endpoint usage, and provider retention controls should be confirmed against the active provider configuration before stronger claims are published.
11. Hosting, Infrastructure, and Email
The existing website content identifies AWS Europe (Frankfurt) as core application hosting infrastructure. The website contact form sends enquiries to info@intrastat.ai using configured SMTP email infrastructure.
This does not mean every supplier, email path, metadata operation, support process, or AI provider action is automatically restricted to Germany or the EEA.
12. Subprocessors and Service Providers
intrastat.ai may use service providers for hosting, email delivery, AI processing, support, security, and operational administration where required to provide and secure the service.
- AWS
- Core application hosting. Existing site content identifies the AWS Europe (Frankfurt) Region.
- OpenAI
- AI processing where enabled. Endpoint, regional processing, and retention controls require configuration review.
- Mistral AI
- AI processing where enabled. European endpoint and retention controls require configuration review.
- SMTP email infrastructure
- Contact-form email delivery through configured SMTP infrastructure used by the website.
13. International Transfers
Where personal data is processed outside the EEA, intrastat.ai should rely on appropriate transfer safeguards such as adequacy decisions, standard contractual clauses, provider DPAs, and supplementary measures where required.
This policy does not state that there are no international transfers because the complete provider and configuration chain has not been confirmed for publication.
14. Data Retention
Retention should be limited to what is necessary for the relevant purpose, customer agreement, legal obligation, security need, and deletion request handling.
A verified retention schedule for account data, customer datasets, generated reports, logs, support records, billing/legal records, backups, or deleted-account data has not been confirmed for this notice. Fixed retention periods are therefore not stated here.
Account, customer dataset, report, log, support, billing, backup, and deleted-account retention periods are not yet published because they have not been verified for this notice.
15. Data Security
intrastat.ai applies security measures appropriate to a B2B service that handles commercially sensitive Intrastat data. Existing site content refers to European hosting, controlled review, and traceable decisions.
No system can be guaranteed to be completely secure. This policy avoids publishing sensitive internal security details and does not claim that breaches are impossible.
16. Human Review and Confidentiality
Where human review is included in the applicable service or plan, relevant customer data may be made available to authorised reviewers for service and quality-control purposes.
Human review is not official government approval and does not replace customer validation, authorisation, or submission responsibility.
17. Data Subject Rights
Where GDPR applies, data subjects may have rights to information, access, rectification, erasure, restriction, portability where applicable, objection, withdrawal of consent where consent is relied upon, and rights relating to applicable automated decision-making situations.
Requests may be sent to info@intrastat.ai. Where intrastat.ai acts as processor, it may need to refer the request to the relevant customer/controller or support that customer in handling the request under the applicable agreement.
18. Complaints
Data subjects may have the right to lodge a complaint with a competent supervisory authority. A specific lead supervisory authority has not been verified for publication and is not named here.
A dedicated privacy contact, DPO, and supervisory authority are not yet published because they have not been verified for this notice.
19. Cookies and Similar Technologies
The website uses Google Analytics 4 to understand site usage. Analytics is enabled by default unless the visitor rejects optional cookies. The preference is stored in the browser and can be changed at any time using Cookie settings.
The website also uses browser session storage to remember a selected country during the session and may use hosting-provided country headers to suggest an EU country.
20. Changes to This Privacy Policy
intrastat.ai may update this Privacy Policy to reflect changes in the service, providers, law, or operational practices. The updated date should be changed when the policy is materially updated.
21. Contact
Privacy questions may be sent to info@intrastat.ai or to SmartRoad AI and Technology Services OÜ, Mäealuse 2/1, Tallinn 12618, Estonia.