Privacy policy
This policy explains what personal information CustomsHero collects, why, who it is shared with, and how to get it removed. It is written to meet Québec's Law 25 and the federal PIPEDA. If anything here is unclear, ask through the contact form.
Last checked
What we collect, and when
Browsing the site collects no personal information. There is no account, no login and no advertising network.
Personal information is collected in exactly two places, both of which you fill in yourself: the quote and compliance forms (your name, email, and optionally phone and company, together with the answers you gave about your shipments), and the contact form (your name, email and message).
Along with a quote request we store the first page you landed on and, where present, the ?ref or utm_ parameters of the link that brought you. This is held in your browser's sessionStorage until you submit, is cleared when you close the tab, and is never read for any other purpose. It is not a cookie and not a cross-site identifier.
Why we collect it
Quote and compliance form data exists to do the one thing you asked for: connect you with licensed Canadian customs brokers who can quote on your shipments. Contact form data exists to answer you.
We do not sell personal information, we do not rent mailing lists, and we do not send marketing to people who only asked a question.
Who it is shared with
Quote requests are forwarded by email to licensed Canadian customs brokers — normally one per request — so that they can contact you. Once a broker holds your information, their own privacy policy governs what they do with it.
The site also relies on service providers who necessarily handle this data: Vercel (hosting), Supabase (the database holding quote requests), and Google (Gmail for delivering the notification emails, and Google Analytics as described below). These providers process data on our behalf, and some of them do so outside Québec, including in the United States.
Cookies and analytics
Google Analytics runs with Consent Mode set to denied on every storage type until you accept. In that state it sends no identifier and writes no cookie. Accepting grants analytics storage only — the advertising signals stay denied permanently, because this site runs no advertising.
You can withdraw consent at any time through the Manage cookies link in the footer. Withdrawing also deletes the _ga cookies already on your device, so that withdrawal is as effective as consent was.
Two items are stored in your browser and never sent anywhere: your consent decision and your light or dark theme preference. Both are local to your device and you can clear them with your browser's site data.
How long it is kept
Quote requests are retained for three years from submission, which covers the normal life of a brokerage relationship, then deleted. Contact form messages are kept for one year.
Analytics data is retained for fourteen months under Google Analytics' own retention setting.
Your rights
Under Law 25 and PIPEDA you may ask to see the personal information we hold about you, have it corrected, or have it deleted. You may also withdraw consent to analytics at any time, as described above.
Send any of these requests through the contact form and we will respond within thirty days. If you are not satisfied with the outcome, you may complain to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca) or to the Office of the Privacy Commissioner of Canada (priv.gc.ca).