Privacy notice

Last updated 16 October 2026

OpenBtoB is a trade-intelligence and trade-promotion service for small and medium businesses. It shows which companies buy and sell which products, based on customs and shipment records, helps you screen potential trading partners and, when you ask, introduces buyers and suppliers to each other. This notice explains what personal data we handle, why, and how you can ask us to remove it. Until a company is registered to run it, OpenBtoB is run by its founder, who decides how the personal data described here is used and is responsible for it (the data controller). When that company is registered, it becomes the controller and we will update this notice. Questions, requests and complaints about personal data go to info@openbtob.com.

1. Data about companies and their business contacts

Most of what OpenBtoB shows is about companies, not people:

Shipment records from customs data and bills of lading: company names, countries, products, HS codes, dates, weights and, where the source publishes them, values.
Company websites, taken from public registries and business-data providers.
Business contact points found on a company's own public website: email addresses, which we show on the company's profile, and phone numbers, which we keep for internal use and do not show. Our crawler identifies itself, follows robots.txt, reads only a few contact and about pages per site, and skips free personal mailbox providers.
Contacts that signed-in users suggest for a company. Suggested email addresses are shown after review; suggested phone numbers and other details are kept for internal use and never shown.
Some importers and exporters in shipment records are individuals or sole traders. Their name appears as the source record shows it. We do not give them a screening recommendation, and they can ask us to correct or remove their record as described in section 2.

We use this data to help businesses find, assess and reach trading partners, which is our legitimate interest and the interest of the companies listed. We do not sell personal data, and we do not build profiles of individuals beyond the trading activity that public shipment records show.

2. Removing a business contact

If your company's contact details appear on OpenBtoB and you want them removed, use the removal form with an email address at your website's domain. We send that address a one-time link; after you confirm, we delete the contacts our crawler collected for that domain and never crawl it again. For anything else, such as a contact from another source or a company record, email us and we will reply within 30 days.

To remove one email address without removing the rest of your company's contacts, email info@openbtob.com with the address and the company profile it appears on. We remove it from the profile within 30 days and reply when it is done.

3. Trade-promotion requests and introductions

When you ask us to find buyers or suppliers for you, or to introduce you to a company, we use the details you give us (your company, products, target markets and contact person) only for that request. We share them only with the companies you agree to be introduced to. Introductions may be carried out by an affiliated company in Viet Nam, which uses these details only for your request. We keep them while the request is open and delete them when you ask.

When a client asks us to reach a listed company, we use only the business contact points that company publishes. Our first message says who we are and asks whether the company wants to receive the introduction; it contains no offer. We send nothing more unless the company says yes, and we stop at any time it asks. The company can also have its contacts removed as described in section 2.

4. Data about you as a user

Account: your email address, a password hash (never the password itself), your company name and product category, and when you verified your email.
Use of the service: your sessions, watchlist, export history, API key fingerprint and usage counts, and whether you opted in to the weekly digest email.
Technical data: IP addresses are used, and stored only in hashed form, to enforce rate limits. Error reports can include the request that failed.

We use this data to run your account, to send the emails you asked for (verification, and the weekly digest only if you opt in), to keep the service secure and within fair-use limits, and to fix bugs. We use only functional cookies: a session cookie to keep you signed in and a technical cookie that keeps database reads consistent. We use no advertising or tracking cookies.

5. Service providers

Cloudflare: hosting, database, storage, email sending, bot checks on sign-up and sign-in (Turnstile), and AI models (including the screening model), which run on Cloudflare's network.
Sentry: error monitoring.
A web-automation provider: runs our collection jobs on public shipment records. It receives no data about you.

These providers process data outside Viet Nam: Cloudflare on its global network, Sentry in the United States, and the others in the countries where they operate. Each processes it under the data processing terms it offers its customers.

6. Retention

We keep account data while your account exists. If you ask us to delete your account, we delete your account data within 30 days, apart from what we must keep for legal or security reasons. We keep shipment records as a historical dataset. Opt-out requests are kept so that the domain stays excluded. For each removal request we keep the domain, a one-way hash of the email address used, a hashed network address, and when the link was sent and confirmed, so we can show that the removal was asked for and confirmed. If a link is never confirmed, we delete the two hashes after 90 days. For a removal request by DNS record we keep the domain, the record value we asked you to publish, a hashed network address, and when the value was issued and the record found, so we can show that the removal was asked for and confirmed. If the record is never found, we delete the hashed network address after 90 days.

7. Your rights

Depending on where you live, you can ask to access, correct, delete or export your personal data, object to our use of it, or complain to your data protection authority (in Viet Nam, the Department of Cybersecurity and High-Tech Crime Prevention, Ministry of Public Security). Email info@openbtob.com and we will answer within 30 days.

8. Applicable law

We handle personal data under Viet Nam's Law on Personal Data Protection (Law No. 91/2025/QH15) and its implementing decree, and, for people in the European Union or the European Economic Area, under the GDPR.

9. Changes

OpenBtoB is in beta. When this notice changes, we will update the date above, and we will email account holders about material changes.