CBAM Vault logoCBAM Vault

Privacy Notice

Last updated: 19 October 2026

1. Who is responsible

Craimor Products trading as CBAM Vault is the data controller for personal data processed through CBAM Vault. Contact: support@cbamvault.app.

2. Data we collect and why

  • Account data (name, email, login credentials) — to create and secure your account. Basis: contract.
  • Business records (customs documents, shipment, supplier and contact details, EORI numbers) — to provide the service. Basis: contract.
  • Support messages — to help you. Basis: contract and legitimate interests.
  • Usage and device data (IP address, browser, device identifiers, logs) — for security, fraud prevention and improving the product. Basis: legitimate interests.
  • Marketing preferences — to send product updates where you agree. Basis: consent, which you can withdraw at any time.

3. Who we share it with

  • Service providers who host and run the service (cloud hosting, database, file storage, AI document reading, email);
  • Paddle, our Merchant of Record, for the sale of subscriptions, subscription management, payments, tax compliance and invoicing;
  • Professional advisers such as lawyers and accountants;
  • HMRC or other authorities where required by law.

4. International transfers

Some providers may process data outside the UK. Where they do, we rely on UK adequacy regulations or the UK International Data Transfer Agreement / Addendum to standard contractual clauses.

5. Retention

Account data is kept while your account is active. Verified customs and CBAM records are kept for at least six years after the end of the relevant accounting period to support HMRC record-keeping. After that, or when no longer needed, data is deleted or anonymised.

6. Your rights

Under UK GDPR you can request access, correction, erasure, restriction, portability, or object to processing, and withdraw consent. We respond within one month. You can complain to the Information Commissioner's Office at ico.org.uk.

7. Security

We use encryption in transit, private document storage, per-account access controls and audit logging to protect your data.

8. Cookies

We only use essential cookies and local storage needed to keep you signed in and run the service. We don't use advertising cookies. Paddle may set cookies needed to process checkout.