Privacy Policy

What Certalot is

Certalot is a food-export compliance platform operated by Mocha's MindLab Inc. (Canada). Organisations use it to turn operational documents such as delivery slips, harvest logs and spreadsheets into traceability records for FSMA 204 (US), EUDR (EU) and CFIA SFCR (Canada).

What we collect

Account information: your email address and sign-in credentials.

Organisation data: the facilities, products, lots and traceability events your organisation records. This is business data about food shipments, not personal data, though supplier and signatory names may appear in it.

Documents you capture: photos of paper documents and spreadsheet files you upload for AI extraction.

Voice dictation: transcribed on your device. Only the resulting text is uploaded. Audio never leaves your phone.

Location: only when you capture harvest GPS coordinates for EUDR compliance, and only for that record. We do not track your location in the background.

Technical information when you visit certalot.com or use the web app: pages visited, how you arrived, browser and device type, and an approximate location based on your IP address. This comes from the analytics tools described below, and we use it to understand how the site is found and used.

Where your data lives

Your records are stored and processed in Canada (Montréal), on Supabase infrastructure. Web hosting is provided by Vercel. Access to your organisation's records is enforced at the database layer: every row is scoped to your organisation.

AI processing

When you use Smart Import, the document photo or text you submit is sent to Anthropic (Claude) to extract traceability fields. This inference is processed in the United States. Your content is not used to train AI models. Extracted fields are always shown to you for review before anything is saved. The AI never writes a record on its own.

A plain-language explanation of every AI feature is at How Certalot Uses AI.

Who we share with

Service providers only, as processors: Supabase (database, Canada), Vercel (hosting and site analytics), Anthropic (document extraction, United States), Stripe (billing, for paid organisations), Inngest (background job processing), Resend (email delivery), Google (website analytics, United States and other countries), and PostHog (product analytics: usage patterns, never your records or documents). We do not sell your data, and we do not share it with advertisers.

Your records, documents and extraction results never go to Google, PostHog or any other analytics provider.

Analytics and cookies

Google Analytics records pages visited, how you arrived (for example, from a search), browser and device type, and an approximate location based on your IP address. Vercel Web Analytics records page views. PostHog, where it is switched on, records which features are used in the app, never what is in your records.

These tools use cookies and similar browser storage. We also use essential cookies to keep you signed in; the app does not work without those.

We do not run advertising tags on certalot.com. If that changes, we will update this policy first.

Your choices: block or delete analytics cookies in your browser settings (Certalot still works with them blocked), or install the Google Analytics opt-out browser add-on. Google describes its own handling of this information in How Google uses information from sites that use its services.

Security

All traffic to Certalot is encrypted in transit (TLS). Sign-in is handled by Supabase Auth: passwords are stored hashed, and sessions use signed tokens that expire and refresh automatically. Every database row is scoped to your organisation by row-level security, so one organisation cannot read another's records. Uploaded documents are stored in Canada alongside your records.

Retention & deletion

You can delete your account in the app (Settings, then Delete account) or by emailing us. Deleting your account removes your sign-in identity immediately.

Traceability records belong to your organisation and are retained because food-safety regulation requires it (for example, FSMA 204 records must remain producible). Records are attributed to no one after the author's account is deleted.

Your rights

We operate under PIPEDA and Québec Law 25. You can ask us what personal information we hold about you, ask us to correct it, or ask us to delete it. Contact us and we'll respond within 30 days. You can limit analytics at any time using the choices above.

Changes to this policy

We may update this policy from time to time. Material changes are announced by email to account holders or by a notice in the app, and the date at the top of this page always shows the current version.

Contact

Privacy questions: hello@certalot.com