Privacy

We store account contact details and permissions; company profiles, products, packaging, suppliers, sales and uploaded evidence; configured forms, notes, review decisions, report snapshots and audit history. This supports sign-in, teamwork, reporting, support and recovery. Private company fields and notes are scoped to your organization and excluded from government reporting exports.

Vercel hosts the applications and private file storage; Neon stores workspace records. Resend sends sign-in and notification emails when configured. Stripe processes payment and subscription information through its hosted pages. When enabled, Cloudmersive receives uploaded files for malware scanning. When you request AI processing, OpenAI receives the selected document and context. Provider features remain unavailable until configured. Optional error telemetry can use Sentry.

Organization roles limit access. Private evidence downloads require authorization; internal support access is temporary and audited. Owners can export company records and close access in Settings. Export links expire after seven days and temporary upload parts after 24 hours. Old email outbox records are removed after 30 days. Canonical evidence, reports and audit history can remain after closure for retention or legal holds. Private recovery backups contain company records and originals.

The application uses sign-in session cookies to maintain access. Company permissions control who may edit notes and private fields. Use workspace support to ask about a record, export, correction or retention request. Avoid unnecessary personal information in uploaded documents and free-text notes.