1. Who is responsible for your data
Baranta International Trade Solutions LLC operates uno.trade and is the controller of your personal data. Its address for legal notices is 919 Imperial Avenue, Calexico, California 92231, United States.
The person we have designated handles privacy questions and requests at privacidad@uno.trade. Please put "Privacy" in the subject line.
2. What this notice covers
This notice applies when you:
- visit uno.trade;
- join the waitlist;
- use an account in our apps: app.uno.trade, pro.uno.trade, the partner and guest portals, the pocket app and the operators' console;
- write to us.
What it does not cover. Our customers may store data about their own clients, contacts, suppliers or carriers in their workspace. They may also upload documents that contain personal data, such as invoices, customs entries or tax certificates. For that data, the customer is the controller. We act only as its processor, on its behalf and on its instructions. If your data sits in a customer's workspace, please contact that customer first. If you write to us, we will pass your request on.
3. What personal data we process
3.1 If you only visit the website
We don't ask you for anything. To deliver the pages, our hosting provider processes the technical data every browser sends: IP address, browser type and the page you request. The website sets no cookies and uses no analytics or advertising (see section 12).
3.2 If you join the waitlist
| Data | Required? |
|---|---|
| Email address | Yes |
| Name | No |
| Company | No |
| Role | No |
| Whether you import or export for your own company or for clients | No |
| Main products (one line) | No |
| Country | No |
| Plan you're interested in (free or Pro) | No |
| Your acceptance of this notice: the version you accepted, the date and the time | Recorded when you submit the form |
Submitting the form also creates this technical data:
- Bot check (Cloudflare Turnstile). Your browser completes an automatic challenge. To run it, Cloudflare processes your IP address, a technical fingerprint of the connection and your browser type. We only receive the result: passed or not.
- A hash of your IP address, to limit submissions. We do not store your IP address. We compute a keyed hash (HMAC) of it with a key only our website holds, and use it only to count how many submissions come from the same connection. The hash deletes itself within one hour.
- A hash of your email address, to limit repeat submissions. We also compute a keyed hash of your email address and use it only to count submissions for the same address. It deletes itself within 24 hours.
We may also register your email address on the waitlist of our account provider (Clerk), so that your invitation can be sent from there.
3.3 If you have an account
- Email address and name.
- The one-time codes we email you to sign in, and your active sessions.
- Your workspace, your role in it and your plan.
- Your admission record: your request, the decision, who made it, when and why.
- Activity records inside the service, such as changes, comments and tasks.
- Your preferences.
- If you turn them on in the pocket app, your browser's push-notification subscription.
3.4 What you upload to your workspace
Products, companies, contacts, quotes, operations, notes and documents. If they include other people's personal data, section 2 applies: whoever uploads the data is its controller. Some fields can hold tax identifiers, such as an individual's RFC or CURP. Handle them with care and upload only what you need.
3.5 If you write to us
Your email address, your name and the content of your message.
Sensitive, financial and asset data
- We don't ask for sensitive personal data (health, ethnic origin, beliefs, political opinions, sexual orientation and the like). Please don't put it in forms, notes or documents.
- We don't ask for your personal financial or asset data. There are no payments on uno.trade today. If we ever need such data, for example to charge for a plan, we will update this notice and ask for your express consent first, as Article 7 of the Law requires.
4. Why we use your data
4.1 Necessary purposes
These purposes make possible the relationship you ask us for:
| # | Purpose | Does it need your consent? |
|---|---|---|
| a | Record and manage your waitlist request | Yes. You give it by ticking the box and submitting the form |
| b | Review your request and decide the order of access. For this we use your company, role, what you import or export, your country and the plan you're interested in | Yes, the same consent |
| c | Send you a confirmation and, if you're approved, the email with your access | Yes, the same consent |
| d | Protect the form and the service against bots, abuse and fraud | Part of the purposes above and below |
| e | Create and run your account, and identify you when you sign in | No: it is necessary for your relationship with us (Law, Art. 9-IV) |
| f | Provide the service: store and show your information, classify products, read documents, prepare quotes, operations and reports | No, for the same reason |
| g | Send service messages: invitations, security notices and the reminders you turn on | No, for the same reason |
| h | Answer your requests, questions and rights requests | No, for the same reason |
| i | Meet legal obligations and well-founded requests from competent authorities | No (Law, Art. 9-I and 9-VII) |
4.2 Secondary purposes
We have none. We don't use your data for advertising, marketing or commercial profiling, and we don't sell it. If we ever want to use it for something this notice doesn't describe, we will ask for your consent first (Law, Art. 11).
5. Where we get your data
- From you: when you fill in the form, create your account, use the service or write to us.
- Automatically: the technical data described in sections 3.1 and 3.2.
- From someone else: if a workspace member invites you as a partner or guest, they give us your email address and, where applicable, your name. The invitation email includes a link to this notice.
6. Service providers and where they process data
We use service providers that process data only on our behalf and on our instructions (processors, or encargados). The Law does not require your consent for this, but we list them for transparency. Each one is bound to keep the data confidential and protect it.
| Provider | What we use it for | What data it handles | Where |
|---|---|---|---|
| Vercel | Hosts the website and the apps | Connection data, and what you send while it is in transit | United States, with a global delivery network |
| Cloudflare | Domain DNS, bot check (Turnstile), and forwarding of mail sent to privacidad@uno.trade | IP, browser type and technical signals; the emails you send us | Global network (US company) |
| Clerk | Accounts, sign-in, waitlist entries and invitations | Email, name, sessions and sign-in codes | United States |
| Railway | Application servers: API, background jobs, cache and file virus scanning | Service data while it is processed | United States (California) |
| Contabo | Rented servers that run our database, which we manage ourselves, and our file storage | All service data | United States (Seattle area; files in St. Louis) |
| Hetzner | Encrypted database backups, and the server for our AI gateway | Encrypted backups; content you send to AI features | Germany (backups) and Finland (gateway) |
| Resend | Sending email | Email address, name and message content | United States |
| Anthropic | AI models that classify products and read documents (signed-in users only) | The text and documents you send to those features | United States |
| OpenAI | Numerical representations of product descriptions, used to find similar tariff lines (signed-in users only) | Product text | United States |
Waitlist data is never sent to AI providers.
7. Transfers
We don't sell your data or transfer it to third parties for their own use.
We could disclose it without your consent only where Article 36 of the Law allows, for example:
- when a law or treaty requires it;
- when a competent authority issues a reasoned order, or a court case needs it;
- to a company under common control with the controller, or in the same group, that runs the same processes and policies. This would apply, for example, if uno.trade comes to be operated by another company in the same group. We would tell you as described in section 16.
In addition:
- Cloudflare also uses Turnstile's technical signals, on its own account, to improve its bot detection. It explains this in its notice: https://www.cloudflare.com/turnstile-privacy-policy/
- Inside your workspace, you decide whom to share information with: members, partners or guests. That is not a transfer made by us.
Transfer clause (Law, Art. 35). We make no transfers that require your consent, so this notice does not ask you to accept any. If that changes, we will ask for your consent before transferring.
8. How to limit the use or disclosure of your data
- Leave the form's optional fields blank.
- Ask us to remove you from the waitlist or to stop writing to you. To respect your choice, we keep your email address on an internal do-not-contact list.
- Turn off push notifications or reminders in the app or in your browser.
- Don't upload personal data you don't need to your workspace.
For any of these, email privacidad@uno.trade.
9. How to withdraw your consent
You can withdraw the consent you gave for the waitlist at any time. Email privacidad@uno.trade with the subject "Withdraw consent", from the address you registered or naming it.
- We will answer within the same time limits as a rights request (section 10).
- Withdrawing consent is not retroactive.
- On the waitlist, withdrawing means leaving the list.
- For an account, it may mean we can no longer provide the service. Some data may be kept blocked for as long as the law requires (section 11).
10. Your rights (access, rectification, cancellation and opposition, known in Mexico as "ARCO")
You have the right to:
- Access: know what data we hold about you and how we use it.
- Rectification: correct it if it is inaccurate, incomplete or out of date.
- Cancellation: have it deleted. Before final deletion we block it for the period the law requires, and we tell you when it has been cancelled.
- Opposition: have us stop processing it for a legitimate reason. You can also object to automated decisions that affect you (see section 13).
How. Email privacidad@uno.trade with the subject "ARCO rights". Include (Law, Art. 28):
- your name and a way to reply to you (your email is fine);
- a document proving your identity or, if you act for someone else, your authority to do so;
- a clear description of the data the request is about (not needed for access);
- the right you want to exercise, or what you are asking for;
- anything else that helps us find your data.
For a correction, tell us what should change and, if needed, send a supporting document.
Identity. To protect your data, we may ask you to confirm the request from your registered email address or to show identification. We use it only to verify who you are.
Time limits (Law, Art. 31). We will tell you our decision within 20 business days of receiving your request. If it is granted, we will carry it out within the following 15 business days. Each period can be extended once, by the same length, when the circumstances justify it; we will tell you if we do.
How you receive your data. By email, in a readable file such as PDF or CSV.
Cost. Exercising your rights is free. We would charge only reproduction or shipping costs, if any (Law, Art. 34).
When we may refuse. Only in the cases in Article 33 of the Law. For example: your identity isn't proven, we don't hold the data, or a law prevents it. We will explain why, by the same channel you used.
If you disagree with our answer, or we don't answer in time, you can go to Mexico's Secretaría Anticorrupción y Buen Gobierno. You have 15 business days from our answer, or from the end of the period we had to give it (Law, Art. 40).
11. How long we keep your data
| Data | Period |
|---|---|
| Waitlist request | Until we give you access: it then becomes part of your account. If we don't, we delete it 12 months after your latest request. If you leave the list, we keep only your email on the do-not-contact list |
| Hash of your IP | One hour at most. It deletes itself |
| Hash of your email address (submission limit) | 24 hours at most. It deletes itself |
| Admission record (decision, who, when and why) | While your account exists, plus the blocking period |
| Account and workspace content | While your account is active. When you close it, we delete or de-identify your data within 90 days. Data we must block because of legal responsibilities is kept only for the limitation period (Law, Art. 24) |
| Encrypted backups | Renewed on a regular cycle. What we delete disappears from them when that cycle completes |
| Our providers' technical logs | The short periods their security policies set |
13. AI and automated decisions
Some features for signed-in users use AI models: suggesting a product's tariff classification, reading documents and proposing data. Their output is a suggestion about goods and documents, which you review and approve. We make no automated decisions about people that have legal effects or significantly affect them. If you believe one affects you, you can object (Law, Art. 26-II).
14. Security
We protect your data with administrative, technical and physical safeguards (Law, Art. 18). Among them:
- encrypted connections;
- access only for authorized people;
- separation of data by workspace;
- encrypted backups;
- virus scanning of the files you upload.
If a security breach significantly affects your financial or moral rights, we will tell you immediately so you can protect yourself (Law, Art. 19).
15. Children
uno.trade is a service for businesses and for adults acting on their behalf. It is not directed to anyone under 18, and we do not knowingly collect their data. If we learn that we did, we will delete it.
16. Changes to this notice
We will publish any change at https://uno.trade/en/legal/privacidad/ and on the Spanish page, with a new version number and date.
If a change is material, we will tell you by email and with a notice on the website at least 15 calendar days before it takes effect. Material changes include, for example, a new controller, new data or new purposes. If a change needs your consent, we will ask for it before applying the change.
17. Supervisory authority
In Mexico, the authority that oversees the Law is the Secretaría Anticorrupción y Buen Gobierno (https://www.gob.mx/buengobierno).
18. Information for visitors in the United States
Where your data goes. The controller is in the United States (Calexico, California). Most of your data is processed in the United States, and encrypted backups and our AI gateway are in Germany and Finland (section 6).
Categories of personal information and of third parties. Section 3 lists what we collect. Section 6 lists the service providers who process it for us. Section 7 explains when we might disclose it to anyone else.
Reviewing or changing your information. Email privacidad@uno.trade (section 10). We honor requests to access, correct or delete your information whatever US state you live in.
No sale or sharing. We do not sell or "share" personal information, as those terms are used in California law. We do not use it for cross-context behavioral advertising.
Do Not Track. We don't track you across other websites, and we let no advertising, analytics or social-media tracker do so on uno.trade. So we treat every visit the same way, whether or not your browser sends a Do Not Track or Global Privacy Control signal. The only third-party code on the website is Cloudflare Turnstile on the waitlist form, which processes technical signals to tell people from bots, as described in Cloudflare's Turnstile privacy addendum.
Children under 13. uno.trade is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, email privacidad@uno.trade and we will delete it.
State privacy laws. We will update this section if the California Consumer Privacy Act or another US state privacy law comes to apply to us.
Changes and effective date. Section 16 explains how we notify changes. The version and date at the top of this notice give its effective date.