Privacy Policy

This Privacy Policy (the "Policy") is issued by TariffWolf India Private Limited, a company incorporated under the laws of India (CIN: U70200KA2026PTC220921), having its registered office at Salarpuria Symbiosis, Wework Arekere Begurhobli, Bangalore South, Bangalore, Karnataka, 560076 - India ("TariffWolf", "We", "Us" or "Our"). ECCN.help is a service of TariffWolf.

This Policy governs the collection, use, storage, disclosure, transfer and other processing of Personal Data in connection with the website located at https://eccn.help and the services made available through it, including account registration and management, the Classification Workflow, the licence requirement check, restricted-party and OFAC screening, the reference and lookup tools, and all related communications (collectively, the "Service"). By registering for, accessing or using the Service, You ("You" or "User") acknowledge that You have read and understood this Policy. Where applicable law requires Your consent to any processing described in this Policy, such processing shall be undertaken only upon, and to the extent of, such consent.

Table of Contents

1. Definitions
2. Personal Data We Collect
3. Sources of Personal Data
4. Purposes and Lawful Bases of Processing
5. Nature of the Processing Performed by the Service
6. Classification Credits and Paid Plans
7. Service Communications
8. Screening Data and Third-Party Information
9. Prohibited Submissions
10. Disclosure of Personal Data
11. International Transfers
12. Retention of Personal Data
13. Security of Personal Data
14. Cookies and Similar Technologies
15. Your Rights
16. Children
17. Account Deletion
18. Grievance Officer
19. Governing Law and Jurisdiction
20. Amendments to this Policy
21. Contact

1. Definitions

In this Policy, unless the context otherwise requires:

1. "Personal Data" means any data about an individual who is identifiable by or in relation to such data, and includes "personal data" and "personal information" as defined under Applicable Law.
2. "Applicable Law" means all laws, rules and regulations relating to the protection of Personal Data that apply to the processing in question, including, as applicable, the Digital Personal Data Protection Act, 2023 of India and the rules made thereunder, the Information Technology Act, 2000 of India and the rules made thereunder, the EU General Data Protection Regulation (Regulation (EU) 2016/679), the UK GDPR, and the privacy laws of the states of the United States.
3. "Account Data" means Your name, email address, account reference number, account status, one-way password hashes, one-way hashed verification codes (retained only until they expire or are used), sign-in metadata (including time of last sign-in and failed-attempt counters) and, where You elect to sign in with LinkedIn, the profile information described in Section 3.
4. "Classification Data" means the item information You submit or the Service generates in Your account, including item names and descriptions, technical parameters, destination countries, end-use and end-user information provided for licence checks, Your answers within the Classification Workflow, candidate entries offered to You, results, reasons for control, and Your selections and corrections.
5. "Attachment Data" means files You upload in support of an item, such as datasheets or product images.
6. "Credit Data" means the record of Your classification allowance, comprising the number of classifications available to Your account, the number used, and a ledger of each use, grant, addition and reduction, together with the date, the item concerned, the reason recorded and the person who made any adjustment.
7. "Screening Data" means the names and identifying details of persons or entities You submit for restricted-party screening, the screening results and Your recorded adjudications of those results.
8. "Usage and Log Data" means server, application, security and email-delivery records, including IP addresses, timestamps, actions performed and the delivery status of emails sent to You.

2. Personal Data We Collect

We do not collect payment card or bank account information through the Service. We do not purchase Personal Data from data brokers and do not collect Personal Data from advertising or analytics networks.

3. Sources of Personal Data

1. From You directly, when You register, verify Your email address, set a password, submit items and answers, upload attachments, run licence checks or screenings, or correspond with Us.
2. Automatically, through server and application logs maintained for security, abuse prevention and troubleshooting. A simple arithmetic challenge is used on public forms to deter automated abuse.
3. From LinkedIn, solely where You elect to sign in with LinkedIn, in which case We receive the name and email address associated with Your LinkedIn account, subject to LinkedIn's terms and privacy policy. We do not receive Your LinkedIn password and do not post to Your LinkedIn account.
4. From Our administrators, who may record additions to or reductions of Your classification allowance together with the reason for the change.

4. Purposes and Lawful Bases of Processing

5. Nature of the Processing Performed by the Service

The Classification Workflow applies curated regulatory reference data and deterministic, rule-based logic to the information You provide. It searches that reference data to offer candidate entries and asks You questions drawn from the published text of the regulations. The Service does not transmit Your Classification Data to third-party artificial-intelligence or large-language-model providers. Every output is presented to You for review, and no output constitutes an automated decision producing legal or similarly significant effects concerning You. Outputs may be incomplete or incorrect, and You must review them before relying on them.

6. Classification Credits and Paid Plans

1. Each account is allotted a number of classifications through the Classification Workflow (at present, five). One classification is used each time a classification is started from the product input. The reference tools do not use classifications.
2. We maintain Credit Data for the purposes of administering the allowance, preventing abuse, answering Your enquiries and maintaining accurate records. Administrators may add to or reduce an account's allowance; each change is recorded with its reason and the administrator who made it.
3. When Your allowance has been used, We send You an email explaining how to request additional classifications, and We send a copy notification, containing Your name, email address and account reference, to Our founder at ceo@tariffwolf.com so that We may respond to Your request.
4. Additional classifications may be offered on a paid plan. Any such plan shall be governed by separate terms agreed with You. Where payment is made, it is processed outside the Service, and We process only such billing information as is necessary to issue invoices and comply with tax and accounting laws.

7. Service Communications

1. Transactional emails. We send emails necessary to operate Your account, including verification codes, password-change notices, account-deletion confirmations and cancellations, and notices concerning Your classification allowance. These cannot be declined while You maintain an account.
2. Lifecycle and engagement emails. We send a limited set of automated follow-up emails tied to the state of Your account, including a reminder before an unused verification code expires, a getting-started message, an invitation to review a classification, a re-engagement message after a period of inactivity and usage-milestone messages. Each such email is sent at most once per trigger, and no account receives more than one automated follow-up email in any 24-hour period. You may object to and opt out of these emails at any time by writing to ask@eccn.help from Your account email address.
3. Internal reporting. Our administrators receive an internal daily operations report containing aggregate account statistics and the names and email addresses of newly activated accounts. The report is used solely to operate and secure the Service and is not disclosed outside TariffWolf.

8. Screening Data and Third-Party Information

The screening feature permits You to submit the names of natural persons and entities for comparison against government-issued screening lists. Such names may constitute Personal Data of persons other than You. By submitting such information You represent and warrant that You have a lawful basis for doing so under the laws applicable to You. Where Applicable Law treats You as the controller or data fiduciary of such information, We process it on Your documented instructions for the sole purpose of providing the Service. Screening inputs, results and adjudications are retained as export-control documentation in accordance with Section 12. We do not use submitted third-party information for any other purpose, do not build profiles of screened persons, and do not sell or share such information.

9. Prohibited Submissions

You shall not upload or submit to the Service: (a) technical data controlled under the International Traffic in Arms Regulations; (b) classified information of any government; (c) export-controlled technical data the transfer of which to the Service or its providers would itself require an authorisation You do not hold; or (d) confidential information of any third party that You are not entitled to disclose. The Service is designed to operate on ordinary commercial product descriptions and published specifications. You are solely responsible for ensuring that Your submissions comply with this Section and shall indemnify TariffWolf against losses arising from any breach of it. We may remove material submitted in breach of this Section.

10. Disclosure of Personal Data

We do not sell Personal Data, do not share it for cross-context behavioural advertising, and do not disclose it to advertisers or data brokers. We disclose Personal Data only to:

1. Service providers acting on Our behalf and under Our instructions, in the following categories: web hosting and server infrastructure; database infrastructure; email delivery infrastructure; and LinkedIn, where You elect LinkedIn sign-in. Such providers are bound by contractual or published terms limiting their use of Personal Data to the provision of their services to Us. A list of provider categories and countries of processing is available on written request to ask@eccn.help.
2. Public authorities, where disclosure is required by law, regulation, legal process or an enforceable governmental request, including in connection with export-control and sanctions enforcement. Where lawful and practicable, We will notify You of such a request.
3. A successor entity, in connection with a merger, acquisition, financing or sale of assets, subject to obligations of confidentiality and on terms that this Policy continues to apply to the Personal Data transferred.
4. Professional advisers, including legal, accounting and insurance advisers, under obligations of confidentiality and to the extent reasonably necessary.

11. International Transfers

The Service is hosted on infrastructure located in the United States of America. Personal Data of Users located outside the United States will accordingly be transferred to, stored and processed in the United States and in other countries in which Our service providers operate, which may not afford the same level of protection as the laws of Your country. Such transfers are made in accordance with Applicable Law and, where required, subject to appropriate safeguards, including standard contractual clauses. Transfers of Personal Data of Users in India are made subject to any restrictions notified by the Government of India under the Digital Personal Data Protection Act, 2023.

12. Retention of Personal Data

1. Export-control records. Classification Data, Screening Data, licence-check records, related Attachment Data and the associated audit trail are retained for not less than five (5) years, consistent with the recordkeeping requirements of 15 C.F.R. Part 762 and analogous obligations, and for such longer period as a legal hold, dispute or governmental enquiry may require. Such retention continues after deletion of Your account and prevails over a request for erasure to the extent permitted or required by law.
2. Credit Data is retained for the life of Your account and thereafter for such period as is necessary to resolve disputes and to comply with tax, accounting and recordkeeping obligations.
3. Account Data is retained for as long as Your account exists. Upon account deletion the account is permanently deactivated, sign-in is disabled and credentials are invalidated; the account record and the records described above are retained for the applicable period and thereafter deleted or irreversibly de-identified.
4. Verification codes are stored only as one-way hashes and cease to be usable upon expiry (twenty-four hours for sign-up codes, fifteen minutes for password-reset codes and thirty minutes for account-deletion links).
5. Logs are retained for operational and security periods appropriate to their purpose and are thereafter deleted or rotated. Backups are overwritten on a rolling basis.

13. Security of Personal Data

We implement reasonable security practices and procedures, and technical and organisational measures appropriate to the risk, including encryption of data in transit, one-way salted password hashing, segregation of each account's data, cryptographically signed internal requests, least-privilege access to production systems, two-step authentication for administrators, security logging and monitoring. No method of transmission or storage is entirely secure, and We cannot guarantee absolute security. In the event of a personal data breach, We shall notify You and the competent authorities as and when required by Applicable Law.

14. Cookies and Similar Technologies

The Service uses only strictly necessary cookies and equivalent browser storage, namely a session identifier to keep You signed in and short-lived tokens supporting sign-in and anti-abuse controls. We do not use advertising cookies, third-party analytics, cross-site tracking or social-media pixels. Blocking strictly necessary cookies will prevent sign-in.

15. Your Rights

Subject to the conditions and exceptions provided by Applicable Law, You may have the right to:

1. obtain confirmation of, and access to, the Personal Data We process about You, and a summary of the processing;
2. have inaccurate or incomplete Personal Data corrected, completed or updated;
3. have Your Personal Data erased, which We give effect to through the account-deletion procedure in Section 17, subject to the retention obligations in Section 12;
4. receive Your Personal Data in a structured, commonly used format, where Applicable Law so provides;
5. object to, or seek restriction of, processing based on legitimate interests, including lifecycle emails;
6. withdraw consent, where processing is based on consent, without affecting processing carried out before withdrawal;
7. nominate another individual to exercise Your rights in the event of Your death or incapacity, where the Digital Personal Data Protection Act, 2023 applies;
8. have Your grievances redressed in accordance with Section 18; and
9. lodge a complaint with the competent data-protection authority, including the Data Protection Board of India.

To exercise any of these rights, write to ask@eccn.help from the email address associated with Your account. We may take reasonable steps to verify Your identity before acting on a request, and We shall respond within the period prescribed by Applicable Law. We do not discriminate against any person for exercising these rights.

16. Children

The Service is a professional tool intended for adults acting in a business capacity. It is not directed to persons under eighteen (18) years of age, and We do not knowingly process Personal Data of such persons. If You believe that a person under eighteen has provided Personal Data to Us, please write to ask@eccn.help and We shall delete it, subject to Applicable Law.

17. Account Deletion

1. You may request deletion of Your account from within the Service. Upon such request, Your account is immediately suspended and an email is sent to Your address containing a confirmation link and a cancellation link, each valid for thirty (30) minutes.
2. Upon confirmation, the account is permanently deactivated and a final confirmation email is sent. If You cancel the request, or the link expires and You contact Us, the account is restored.
3. Following deletion, You will be unable to sign in and no further lifecycle emails will be sent. Records subject to Section 12 are retained as described there; other Personal Data is deleted or de-identified upon expiry of the applicable retention periods.

18. Grievance Officer

In accordance with the Information Technology Act, 2000, the rules made thereunder and the Digital Personal Data Protection Act, 2023, TariffWolf has designated a Grievance Officer to address complaints and concerns regarding the processing of Personal Data. The Grievance Officer may be contacted at:

Grievance Officer, TariffWolf India Private Limited
Email: ask@eccn.help
Address: Salarpuria Symbiosis, Wework Arekere Begurhobli, Bangalore South, Bangalore, Karnataka, 560076 - India

Grievances shall be acknowledged and resolved within the time periods prescribed by Applicable Law.

19. Governing Law and Jurisdiction

This Policy shall be governed by and construed in accordance with the laws of India. Subject to any mandatory provision of Applicable Law conferring jurisdiction on the courts or authorities of Your place of residence, the courts at Bengaluru, Karnataka shall have exclusive jurisdiction in respect of any matter arising out of or in connection with this Policy.

20. Amendments to this Policy

We may amend this Policy from time to time to reflect changes in the Service, Our service providers or Applicable Law. The "Last updated" date above indicates the current version. Where an amendment is material, We shall give reasonable prior notice by email to Your account address or by a prominent notice on the Service before the amendment takes effect. Your continued use of the Service after the effective date of an amendment constitutes acknowledgement of the amended Policy, to the extent permitted by Applicable Law.

21. Contact

Questions concerning this Policy, requests to exercise Your rights, opt-outs and complaints may be addressed to ask@eccn.help or in writing to: TariffWolf India Private Limited, Salarpuria Symbiosis, Wework Arekere Begurhobli, Bangalore South, Bangalore, Karnataka, 560076 - India.

Requests concerning additional classifications or paid plans may be addressed to ceo@tariffwolf.com.