Privacy Policy — GCOS

Effective date: October 15, 2026 | Last updated: October 15, 2026 | Version: 1.

Summary. GCOS is a customs compliance platform available at thegcos.com. We respect your privacy. This Privacy Policy explains what personal data and business data we collect, how we use it, how we share it, how long we keep it, and your rights. We use aggregated and de-identified customer data to improve our AI classification models — a core part of our Service. You may opt out of model training on Growth and Enterprise plans.

1. Scope and Who We Are

This Privacy Policy ("Policy") describes how GCOS ("GCOS", "we", "us", or "our") collects, uses, shares, and protects information when you access or use the GCOS platform, website at https://thegcos.com/, API, and related services (collectively, the "Services").

For the purposes of applicable data protection laws, GCOS acts as the data controller of personal data processed through the Services, except where we process data on behalf of a business customer (in which case we act as a data processor and the business customer is the controller).

This Policy applies to all users of the Services, including individuals creating accounts, organizations whose employees use the Services, and visitors to our website.

2. Information We Collect

We collect information in the following categories:

We do not knowingly collect sensitive personal data (such as health information, biometric data, or data about children under 16) unless you voluntarily provide it in a free-text field.

3. How We Use Information

We use the information we collect for the following purposes:

• Service delivery — to provide, maintain, and improve the Services, including processing HTS classifications, managing catalogs, running audits, and delivering reports;
• Account management — to create and administer your account, authenticate access, and manage subscriptions;
• Billing and payments — to process payments, send invoices, and manage subscription renewals;
• AI model training and improvement — to train, refine, and evaluate our artificial intelligence classification models and compliance forecasting engine (see Section 4);
• Communications — to send transactional messages (account notices, billing alerts, security notifications) and, with your consent, marketing communications;
• Customer support — to respond to inquiries, troubleshoot issues, and provide help;
• Analytics and research — to understand usage patterns, improve features, and conduct business analytics;
• Security and fraud prevention — to detect, prevent, and respond to fraud, abuse, security incidents, and violations of our Terms of Service;
• Legal compliance — to comply with applicable laws, regulations, legal process, and government requests.

4. AI Model Training

Important disclosure. A core function of GCOS is to continuously improve classification accuracy. To do this, we use Customer Data — including product descriptions, user-submitted classifications, GCOS-generated classifications, user corrections, and classification outcomes — to train, evaluate, and refine our artificial intelligence models.

4.1 Data Used for Training

Before being used for model training, Customer Data is aggregated and de-identified where feasible. We do not use directly identifiable personal information (such as account names, emails, or billing details) as training inputs.

4.2 Opt-Out

Users on Growth and Enterprise plans may opt out of model training by configuring account settings or submitting a written request to privacy@thegcos.com. Opt-out applies to Customer Data submitted after the opt-out date; data already incorporated into trained models cannot be retroactively removed.

4.3 Free and Starter Tiers

Users on Free (including Launch Trial) and Starter tiers consent to the use of their Customer Data for model training as a condition of using the Services at these price points. If this is not acceptable, upgrade to Growth or Enterprise for opt-out eligibility.

4.4 Third-Party Model Providers

We may use third-party AI/ML infrastructure providers to host, train, or serve our models. These providers are contractually prohibited from using your data for their own purposes beyond providing services to GCOS. A current list of sub-processors is published at thegcos.com and updated when material changes occur.

5. Legal Bases for Processing

We process personal data on one or more of the following legal bases, as applicable under relevant data protection laws:

• Performance of a contract — processing necessary to provide the Services under our Terms of Service;
• Consent — where you have given explicit consent (e.g., marketing communications, non-essential cookies, model training on Growth/Enterprise opt-in);
• Legitimate interests — including service improvement, security, fraud prevention, and business analytics, where not overridden by your rights;
• Legal obligation — including tax, accounting, and regulatory compliance;
• Vital interests or public interest — in limited circumstances required by law.

You may withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing.

6. How We Share Information

We share information only as described below. We do not sell personal data.

6.1 Service Providers

We share information with trusted third-party providers who perform services on our behalf, including:

• Cloud hosting and infrastructure providers;
• Payment processors;
• Email delivery and customer support platforms;
• Analytics providers;
• AI/ML infrastructure and model-serving providers.

All service providers are bound by confidentiality obligations and may use information only to provide services to GCOS.

6.2 Partners

If you were referred to GCOS by a partner (such as a 3PL or customs broker participating in our partner program), we may share limited account information (e.g., signup confirmation, usage status) with that partner for referral tracking purposes.

6.3 Legal and Safety

We may disclose information when required by law, court order, or valid legal process, or when we believe disclosure is necessary to: (a) comply with applicable law; (b) protect the rights, property, or safety of GCOS, our users, or others; (c) detect, prevent, or respond to fraud, security, or technical issues; or (d) enforce our Terms of Service.

6.4 Business Transfers

In the event of a merger, acquisition, financing, or sale of assets, information may be transferred to a successor entity. We shall provide notice before personal data becomes subject to a different privacy policy.

6.5 With Your Consent

We may share information for other purposes with your explicit consent.

7. International Data Transfers

GCOS operates globally. Information is processed and stored in secure data centres and may, in the normal course of providing the Services, be transferred to, accessed from, or processed in jurisdictions other than the one in which you reside — including, where relevant, for CBP-related classification, service provider operations, or Enterprise customer requirements.

Where personal data is transferred across borders, we rely on legally recognised transfer mechanisms, which may include:

• Standard Contractual Clauses (SCCs) or equivalent model clauses approved by competent authorities;
• Binding Corporate Rules or equivalent intra-group transfer frameworks (where applicable);
• Adequacy decisions by competent data protection authorities;
• Transfer impact assessments and supplementary technical and organisational measures;
• Your explicit consent, where lawful and appropriate.

You can request information about specific transfer safeguards applicable to your data by contacting privacy@thegcos.com.

8. Data Retention

We retain information only for as long as necessary to fulfill the purposes for which it was collected, including to comply with legal obligations, resolve disputes, and enforce agreements:

• Account information — for the duration of your account plus up to 24 months after account closure (for legal, tax, and dispute resolution purposes).
• Billing records — retained for the period required by applicable tax, accounting, and anti-money-laundering laws (typically 7-10 years).
• Customer Data (your product catalogs) — for the duration of your subscription. You may export data within 30 days after account termination; thereafter, data is deleted or anonymized within 90 days.
• Usage and technical logs — typically 12-24 months, except where longer retention is required for security or legal purposes.
• Communications and support records — up to 36 months after last interaction.
• AI training data — aggregated and de-identified training sets may be retained indefinitely for model development.

9. Your Rights

Subject to applicable data protection laws, you may have the following rights in relation to your personal data:

• Right to be informed — about how we process your data (fulfilled by this Policy);
• Right of access — to request a copy of personal data we hold about you;
• Right to rectification — to request correction of inaccurate or incomplete data;
• Right to erasure — to request deletion of personal data, subject to legal retention requirements;
• Right to restrict processing — in certain circumstances defined by applicable law;
• Right to data portability — to receive your data in a structured, commonly used, machine-readable format and to transmit it to another controller;
• Right to object — to processing based on our legitimate interests, including profiling;
• Right to withdraw consent — at any time, where processing is based on consent, without affecting the lawfulness of prior processing;
• Right not to be subject to automated decision-making — including profiling, where it produces legal or similarly significant effects;
• Right to lodge a complaint — with a competent supervisory authority in your jurisdiction.

To exercise any of these rights, contact privacy@thegcos.com. We shall respond within thirty (30) days, extendable by a further sixty (60) days where necessary due to the complexity or number of requests.

We may need to verify your identity before fulfilling a request. We may refuse or charge a reasonable fee for manifestly unfounded or excessive requests, and shall notify you of any such refusal with reasons.

10. Security Measures

We implement commercially reasonable technical and organizational measures to protect information, including:

• Encryption in transit using TLS 1.3;
• Encryption at rest using AES-256;
• Role-based access controls and principle of least privilege;
• Multi-factor authentication for administrative access;
• Regular security assessments and vulnerability scanning;
• Incident response procedures and breach notification protocols;
• Vendor security review for third-party processors;
• Pathway to SOC 2 Type II compliance (in progress).

Despite our safeguards, no system is 100% secure. In the event of a personal data breach, we shall notify affected users and the relevant supervisory authority in accordance with applicable law (within 72 hours of becoming aware, required).

11. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to operate the Services, remember your preferences, understand how the Services are used, and support marketing. Categories include:

• Strictly necessary cookies — required for the Services to function (e.g., authentication). These cannot be disabled.
• Functional cookies — remember preferences and improve user experience.
• Analytics cookies — help us understand usage (e.g., Google Analytics, product analytics tools).
• Marketing cookies — used for advertising and remarketing (requires your consent).

You can manage non-essential cookies via our cookie banner or your browser settings. Blocking cookies may affect Service functionality.

12. Children's Privacy

The Services are intended for business users and are not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided personal data, please contact privacy@thegcos.com and we shall promptly delete it.

13. Third-Party Links

The Services may contain links to third-party websites or services. We are not responsible for the privacy practices of those parties. We encourage you to review their privacy policies.

14. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top indicates when the Policy was most recently revised. For material changes, we shall provide at least 30 days' advance notice via email or in-app notification. Continued use of the Services after the effective date constitutes acceptance of the updated Policy.

15. Contact and Data Protection Officer

For questions, requests, or complaints regarding this Privacy Policy or our data practices, contact our Data Protection Officer:

• Email: privacy@thegcos.com
• Website: https://thegcos.com/
• Legal inquiries: legal@thegcos.com

We aim to resolve all privacy inquiries directly. If you are not satisfied with our response, you have the right to lodge a complaint with the competent data protection supervisory authority in your jurisdiction.