Security & Data Handling

Exactly what happens to your invoice data, where it is stored, and how it is protected. No marketing claims — just the facts.

Summary: Your invoice files stay on your PC. To classify them, their contents are sent over an encrypted connection to Google's Gemini API through our proxy. We never store your invoice content on our servers. Model training is disabled on our Google Cloud project (paid tier).

1. Where your data is processed

Invoice and packing-list contents are transmitted to the Google Gemini API for AI classification. This transmission is required because classification is performed by a large language model hosted by Google.

  • Transmission is encrypted with TLS 1.2 or higher.
  • Our Cloudflare Worker proxy forwards the request; the Gemini API key is held server-side and is never present in the desktop application.
  • Google's data handling for the Gemini API applies to this processing.

2. What we store on our servers

We store only the minimum needed to operate a paid license. We do not store invoice content, product descriptions, values, or classification results on our servers.

StoredPurpose
Hashed hardware ID (HWID)Binds one license to one PC / one named user
Subscription status & tierEntitlement checks and feature gating
Email addressLicense and billing communication
Webhook events from PaddlePayment lifecycle (purchase, refund, cancellation)

3. Where your invoice data lives

Parsed invoices, line items, and the classification audit trail are stored in a local database on your PC (under your Windows user profile). This database is encrypted at rest.

  • Encryption at rest: AES-256 (SQLCipher), with a random key protected by Windows DPAPI and bound to the installation.
  • Clearing your local data is under your control; deleting the application data folder removes it.

4. Model training

Our Google Cloud project uses the paid Gemini tier, under which customer inputs are not used to train Google's models.

So that we are precise: Google may retain requests for a limited period for abuse monitoring and service integrity even on the paid tier. This is not model training. The desktop application's own "learning" feature never sends your data anywhere — it stores broker-confirmed classifications locally and reuses them to improve future suggestions on your machine only.

5. Access control & licensing

  • One license = one PC = one named user. Each broker's classification audit trail is kept legally separate.
  • License validation is HWID-based; there is no reusable license key to share.
  • Refunds or cancellations revoke the license binding for that machine.

6. Third-party sub-processors

ProviderRole
Google (Gemini API)AI classification of document contents
CloudflareLicense server, API proxy, and content delivery
PaddleMerchant of record — payment processing and invoicing

7. Data retention & deletion

Invoice data is not retained by us, because we never receive and store it. Local data on your machine persists until you delete it or uninstall the application.

License records (HWID hash, email, subscription state) are retained while the subscription is active and for as long as needed to satisfy tax and accounting obligations. To request deletion of your license record, contact privacy@customspro1ai.com.

8. Download integrity & warnings

CustomsProAI is a newly released app. Windows SmartScreen and your browser flag any file that has not yet built up download reputation, and our code-signing certificate is still in review. The notice is triggered by newness — not by anything found in the file.

If you see it, it is two clicks:

  • Browser → “Keep” (Chrome/Edge: ⋯ menu → Keep)
  • Windows → “More info” → “Run anyway”

Every release is published with a SHA-256 checksum so you can confirm the file you downloaded is the exact build we shipped. On Windows PowerShell, run:

Get-FileHash .\CustomsProAI.exe -Algorithm SHA256

FileSize (bytes)SHA-256
CustomsProAI.exe
(v2.3.1)
997625312f15f39ef89da3016bbc382d562f5a2e0f5a55cbf3d310e9b2c694fc58d53d99
CustomsProAI.zip
(v2.3.1)
9904995964158ab160ed3fe58c67f5679f70858b7f9d45b5790a268a844737a5559e1c6b

Only download CustomsPro AI from dl.customspro1ai.com (linked from this site). If a file’s SHA-256 does not match the value above, do not run it. You can also submit the file to VirusTotal and compare the hash above.

We will never ask you to disable your antivirus. If you would rather not run it yourself yet, email support@customspro1ai.com — we will verify the download with you or send it through a channel you choose.

9. Report a vulnerability

If you believe you have found a security issue, please email security@customspro1ai.com with details and, if possible, reproduction steps. We will acknowledge receipt and keep you informed of remediation.