Privacy Policy

What Certalot is

Certalot is a food-export compliance platform operated by Mocha's MindLab Inc. (Canada). Organisations use it to turn operational documents — delivery slips, harvest logs, spreadsheets — into traceability records for FSMA 204 (US), EUDR (EU) and CFIA SFCR (Canada).

What we collect

Account information: your email address and sign-in credentials.

Organisation data: the facilities, products, lots and traceability events your organisation records. This is business data about food shipments, not personal data, though supplier and signatory names may appear in it.

Documents you capture: photos of paper documents and spreadsheet files you upload for AI extraction.

Voice dictation: transcribed on your device. Only the resulting text is uploaded — audio never leaves your phone.

Location: only when you capture harvest GPS coordinates for EUDR compliance, and only for that record. We do not track your location in the background.

Where your data lives

Your records are stored and processed in Canada (Montréal), on Supabase infrastructure. Web hosting is provided by Vercel. Access to your organisation's records is enforced at the database layer — every row is scoped to your organisation.

AI processing

When you use Smart Import, the document photo or text you submit is sent to Anthropic (Claude) to extract traceability fields. This inference is processed in the United States. Your content is not used to train AI models. Extracted fields are always shown to you for review before anything is saved — the AI never writes a record on its own.

A plain-language explanation of every AI feature is at How Certalot Uses AI.

Who we share with

Service providers only, as processors: Supabase (database, Canada), Vercel (hosting and site analytics), Anthropic (document extraction, United States), Stripe (billing, for paid organisations), Inngest (background job processing), Resend (email delivery), and PostHog (product analytics: usage patterns, never your records or documents). We do not sell your data, and we do not share it with advertisers.

Retention & deletion

You can delete your account in the app (Settings → Delete account) or by emailing us. Deleting your account removes your sign-in identity immediately.

Traceability records belong to your organisation and are retained because food-safety regulation requires it (for example, FSMA 204 records must remain producible). Records are attributed to no one after the author's account is deleted.

Your rights

We operate under PIPEDA and Québec Law 25. You can ask us what personal information we hold about you, ask us to correct it, or ask us to delete it. Contact us and we'll respond within 30 days.

Contact

Privacy questions: hello@certalot.com