Privacy notice

Last updated 30 September 2026

This notice covers the free declaration check on thedeclarant.com, The Declarant platform and The Declarant plugin for ChatGPT and Codex. It describes the data these services process and why.

The short version

Your uploaded document is deleted automatically within 24 hours. We retain the generated report and delivery email for up to 30 days so you can reopen it. You can delete the document and report immediately at any time from the report page.

We do not sell your data, we do not use your documents to train AI models, and no account is required to run a check.

What we collect

• The document you upload. It goes directly from your browser to private object storage using a short-lived, single-use upload link. It does not pass through this website.
• Fields read from the document and the findings generated from them, for example commodity code, origin, declared values and stated Incoterm. We do not keep the raw page text.
• Your email address, only if you choose to unlock the full report. It is used to send you that report.
• Your IP address. The record we keep of your check stores only a one-way hash of it, never the address. The address itself does appear briefly elsewhere, as it does for any website: in short-lived rate-limiting counters and in standard server access logs. We do not use it to identify you.
• Your Declarant account identity. When you connect the plugin, Clerk handles sign-in and issues an OAuth access token. The connector verifies that token and uses its user identifier to limit every request to the correct Declarant account. The OAuth token is not forwarded to the Declarant application API.
• Plugin inputs and results. We process the information needed for the tool you ask to use, such as a product description, HS code, origin, destination, value, currency, quantity or weight. The plugin may also return tariff alerts, plan details and usage totals already associated with your account. It does not return payment provider identifiers, authentication secrets or internal company IDs.
• Aggregate visit measurement. This website counts page visits using Cloudflare Web Analytics. It records the page address, the referring site, a country, a device and browser class, and page loading speed. It sets no cookie, stores nothing in your browser, and builds no identifier that would let us recognise you across visits or across sites. We cannot use it to single you out, and it is never connected to a declaration you upload, to your email address or to your account. Nothing from the document you upload reaches it.

How long we keep it

• Uploaded document: deleted within 24 hours, automatically, by a scheduled job. This job runs whether or not the checker is switched on.
• Report, findings and delivery email: up to 30 days, so you can reopen the emailed link. After that they are erased from the record.
• Immediately, on request: the “Delete my document now” button on the result page and on the emailed report page removes both. We only tell you it is deleted once storage has confirmed the object is actually gone.
• Plugin access: disconnecting the plugin stops future access from ChatGPT or Codex. The connector does not create a second copy of your Declarant account data. Records already held in your Declarant account follow the platform's account and legal retention rules. You can request access or deletion at hello@orcavera.com.

Legal bases

• Running the check: performance of a service you asked for.
• Answering plugin requests is necessary to provide the connected service you ask us to perform.
• Emailing you the report: the operational consent you give by submitting your address to receive it.
• Product updates: separate, optional, opt-in consent. It is a distinct unticked checkbox and is never bundled with report delivery. You can withdraw it at any time by replying to any message or writing to hello@orcavera.com.
• Abuse control: our legitimate interest in keeping a free public service available.
• Aggregate visit measurement: our legitimate interest in knowing which pages people reach and whether the site works. We ask for no consent here because the measurement stores nothing on your device and identifies nobody. If we ever adopt a measurement tool that does either, it will be opt-in and this notice will say so first.

Who processes it

• Cloudflare: content delivery, private object storage and the aggregate visit measurement described above.
• Hetzner Online GmbH (Germany): application and database hosting.
• Mistral AI (France): reads text and fields out of the uploaded document. Document content is sent to this processor for that purpose and for no other.
• Clerk provides account authentication and OAuth for the connected plugin.
• OpenAI receives the plugin results you request so ChatGPT or Codex can present them to you. OpenAI processes that data under the settings and terms of your OpenAI account.

Report emails are sent from our own mail infrastructure; no third-party bulk-email provider receives your address.

Your rights

You can ask for access, correction, erasure, restriction, portability, or object to processing, and you can lodge a complaint with your supervisory authority. The fastest route to erasure is the delete button on the report itself. For anything else, write to hello@orcavera.com.

What this service is not

The declaration check and plugin are decision support. They do not file customs declarations, contact authorities, make payments, provide certification or legal advice, or guarantee compliance. Your declarant or broker remains responsible for what is actually declared.

Contact

The Declarant is a product of Orcavera, Basel, Switzerland. Privacy questions and data-subject requests: hello@orcavera.com. Full legal entity and registered address details are available on request at that address.