Privacy Policy

Who we are

CigarLink is a B2B service operated by HellasBAE LLC, a Pennsylvania limited liability company headquartered in Philadelphia, PA ("CigarLink," "we," "us"). This policy explains how we handle information when retailers, manufacturers, brokers, and their team members use the CigarLink platform at cigarlink.io and the related API at api.cigarlink.io.

CigarLink is not consumer-facing. Accounts are provisioned by an administrator on behalf of an organization (a cigar shop, manufacturer, or broker). There is no public self-signup.

What we collect

Account information

When your organization is onboarded, we record the organization name, type (retailer, manufacturer, broker, distributor), state(s) of operation, and one or more user accounts. Each user account stores first and last name, email address, and optionally a phone number, organization title, and the U.S. states the user covers.

Pricing and product data

Manufacturers and brokers send price sheets to CigarLink (by email to [email protected], upload, or photo). We store the original document, the structured rows extracted from it, and the resulting catalog of products and prices. Retailers connected to a sender see those prices in their catalog.

Usage and logs

We log API requests, sign-in activity, import history, and similar operational data. We do not run web analytics, advertising, or marketing trackers.

How AI fits in

Price sheets sent to CigarLink are processed by an AI model — currently Anthropic's Claude API — to convert the document into structured rows (brand, SKU, pack quantity, wholesale price, MSRP). The original document is sent to the AI provider; in return we receive a structured extraction. Output is reviewed by your organization before any row reaches your catalog.

Anthropic's terms govern that processing on their side. We do not use customer pricing data to train AI models, and we do not authorize sub-processors to do so.

Data ownership and isolation

• Your organization owns the data it uploads to or generates within CigarLink — your price sheets, your catalog, your users, your import history.
• Each organization's data is isolated. CigarLink does not commingle or share one organization's confidential records with another.
• Manufacturer-published pricing flows to retailers connected to that manufacturer, by design — that is the product. A manufacturer can see which retailers are receiving its pricing; a retailer can see which manufacturers are connected.
• Aggregated, anonymized statistics (e.g. "X retailers carry brand Y") may be used to operate and improve the service.

Sub-processors

We use the following third parties to operate CigarLink:

• Anthropic — AI extraction of price-sheet documents (Claude API)
• Resend — outbound transactional email (invitations, contact form, system notifications)
• Mailgun — inbound email pipeline (signed webhooks for price-sheet emails sent to [email protected])
• Wasabi — encrypted object storage for uploaded price sheets, attachments, and database backups
• Cloud infrastructure providers used to host the service

This list will change as the service evolves. The "Last updated" date at the top of this page reflects the most recent change.

How we use information

• To run the service: provisioning accounts, processing price sheets, serving the catalog, and pushing pricing to retailer POS systems.
• To send transactional email tied to your account (invitations, password resets, import notifications, contact replies).
• To investigate abuse, debug incidents, and prevent fraud.
• To meet legal obligations or respond to lawful requests.

We do not sell personal information. We do not run third-party advertising on the platform.

Security

Passwords are hashed with Argon2id. Authorized Users may also register passkeys (WebAuthn) for phishing-resistant sign-in. High-entropy machine credentials (API keys, refresh-session tokens) are stored as keyed BLAKE3 hashes with a server-side pepper. Object storage and database backups are encrypted at rest. Transport between you and the platform uses TLS.

No system is invulnerable. We do not currently hold a SOC 2 or ISO 27001 attestation. If you require one, contact us before onboarding.

Retention

Account and operational data is retained for the life of the engagement plus a reasonable period afterward to support audit, dispute resolution, and legal obligations. Encrypted backups have their own rotation schedule. Deletion requests are handled per the rights section below; some logs (e.g. security and billing records) may be retained where required by law.

Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Request deletion (subject to legal-retention exceptions)
• Restrict or object to certain processing
• Receive a portable copy of your information

To exercise a right, email [email protected] from the address on file.

Changes

We may update this policy as the service evolves. Material changes will be communicated to organization owners by email and reflected in the "Last updated" date above.

Contact