1. Who We Are
Stipendia Global Exports Ltd (“Stipendia”, “we”, “us”) is a technology company registered in England and Wales (United Kingdom). We provide automated customs duty calculation, collection, and remittance services for international shipments entering the United States and other countries. We operate Stipendia Prepay (prepay.stipendia.ai), the Stipendia merchant dashboard (ddp.stipendia.ai), and related APIs.
This policy applies to personal data processed by Stipendia when you use Stipendia Prepay, the merchant portal, or when a merchant uses our API to process shipments you receive.
2. Data We Collect
2.1 When you use Stipendia Prepay (consumer)
| Category | Examples | Why collected |
|---|---|---|
| Identity | Name | Required for customs declaration |
| Contact | Email address | Receipt delivery, DSAR responses |
| Shipment details | Origin country, item descriptions, declared values | Duty calculation and customs filing |
| Payment data | Card type, last 4 digits, payment reference | Payment processing (not full card number — Stripe handles this) |
| Technical | IP address, browser type, session data | Security, fraud prevention |
2.2 When you are a merchant (B2B)
| Category | Examples |
|---|---|
| Account | Business name, contact email, billing address |
| API credentials | API keys (hashed), usage logs |
| Shipment manifests | Recipient name/address, declared goods values, HS codes |
| Billing | Payment method, invoices |
2.3 Data we do NOT collect
- Full payment card numbers (processed directly by Stripe/Antom under their own PCI-DSS scope)
- Government-issued ID numbers (passport, SSN, tax ID)
- Biometric data
- Data from children under 18
3. Legal Basis for Processing
| Processing activity | Legal basis | GDPR Article |
|---|---|---|
| Processing your customs declaration | Performance of contract | Art. 6(1)(b) |
| Filing required customs data with CBP | Legal obligation | Art. 6(1)(c) |
| Payment processing | Performance of contract | Art. 6(1)(b) |
| Sending receipts and declaration IDs | Performance of contract | Art. 6(1)(b) |
| Security and fraud prevention | Legitimate interests | Art. 6(1)(f) |
| Analytics (aggregated, non-identifiable) | Legitimate interests | Art. 6(1)(f) |
| Marketing communications (opt-in only) | Consent | Art. 6(1)(a) |
For customs filings, we are legally required to transmit certain data (name, address, declared values, HS codes) to the US Customs and Border Protection via CBP’s DATA-ACE system. This is a statutory obligation under US customs law; we cannot omit this data.
4. Who We Share Data With
We share personal data only with the following categories of recipients:
4.1 Payment processors
- Stripe, Inc. (US) — card payment processing under their own privacy policy
- Antom (Ant Group) — APAC payment processing under their own privacy policy
4.2 Infrastructure and cloud providers
- Railway (US) — database and API hosting (PostgreSQL, API servers)
- Vercel (US) — frontend hosting
- Clerk (US) — authentication services
4.3 Customs and regulatory authorities
- US Customs and Border Protection (CBP) — mandatory customs data submission via DATA-ACE
- Duty remittance clearing bank (UK/EU) — settlement and remittance of collected duties on our behalf
4.4 Communication
- Resend, Inc. (US) — transactional email (receipts, notifications)
We do not sell personal data. We do not share data with data brokers or advertising networks. All subprocessors are subject to Data Processing Agreements (DPAs) where required by GDPR Art. 28.
AI classification (no personal data). To determine tariff codes, we send only the product description and the origin/destination country to an AI provider (Anthropic, Inc., US). No names, addresses, or other personal data are shared for this purpose, so this processing does not involve your personal data.
5. International Data Transfers
Stipendia Global Exports Ltd is registered in the United Kingdom. Some of the recipients above are located outside the UK and the European Economic Area (EEA), including in the United States. Where this is the case, we rely on the European Commission’s Standard Contractual Clauses together with the UK Addendum issued by the Information Commissioner’s Office (ICO), and on UK/EU adequacy decisions or the US Data Privacy Framework where applicable, to ensure an equivalent level of protection. A copy of the relevant safeguards is available on request.
6. How Long We Keep Your Data
| Data type | Retention period | Reason |
|---|---|---|
| Customs declaration data | 7 years | US customs legal requirement (19 CFR 163.4) |
| Payment records | 7 years | Tax/financial services law |
| Account data | Duration of account + 3 years | Contract, legal obligations |
| Technical logs | 12 months | Security and compliance |
| Marketing preferences | Until withdrawn | Consent |
7. Your Rights Under GDPR
| Right | Description | How to exercise |
|---|---|---|
| Access | Request a copy of your personal data | Email privacy@stipendia.ai |
| Rectification | Correct inaccurate data | Email privacy@stipendia.ai |
| Erasure | Request deletion (where not legally required to retain) | Email privacy@stipendia.ai |
| Restriction | Restrict processing in certain circumstances | Email privacy@stipendia.ai |
| Portability | Receive your data in machine-readable format | Email privacy@stipendia.ai |
| Object | Object to legitimate interest processing | Email privacy@stipendia.ai |
| Withdraw consent | Withdraw consent for marketing at any time | Unsubscribe link in emails |
We will respond to data subject access requests (DSARs) within 30 days. We may need to verify your identity before actioning a request. Note: We cannot erase data we are legally required to retain (customs records, payment records).
8. Complaints
If you are unsatisfied with how we handle your personal data, you have the right to lodge a complaint with your supervisory authority.
Lead supervisory authority (UK GDPR)
As Stipendia Global Exports Ltd is registered in England and Wales, our lead authority is the Information Commissioner’s Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
casework@ico.org.uk · 0303 123 1113
www.ico.org.uk
If you are in the EU/EEA
Where your data is processed under the EU GDPR, you may also complain to your local data protection authority (a list is available from the EDPB at www.edpb.europa.eu). EU residents complaining about UK-based controllers commonly use the Irish Data Protection Commission (www.dataprotection.ie).
9. Cookies
Stipendia Prepay and the merchant dashboard use essential session cookies for authentication (Clerk). No advertising or tracking cookies are used. You can disable cookies in your browser settings; however, this will prevent you from logging in.
10. Changes to This Policy
We will notify registered users of material changes by email. The effective date at the top of this document reflects the most recent update. Previous versions are available on request.
11. Contact Us
For all privacy matters, including DSARs:
Stipendia Global Exports Ltd
privacy@stipendia.ai
Response time: within 30 days of receipt.