Privacy notice
Last updated 13 October 2026. Have a lawyer in your country check this before you rely on it.
What is kept, and why
| Data | Why | How long |
|---|---|---|
| Your email, company name, password hash | To let you in and to keep your work separate from other companies | Until you delete the account |
| Your tender criteria, customs and freight rates, suppliers, notes | They are the work itself | Until you delete them |
| Lots and documents read from public portals | So the analysis does not have to be redone every day | Until you delete the account |
| Your API key, Telegram token and mailbox password | To do the work you asked for | Until you replace or delete them |
| Sign-in sessions and one-time links | To keep you signed in and to confirm an address or reset a password | Sessions 14 days; links 2 hours to 7 days |
What is never kept
Passwords to supplier platforms such as Alibaba or Made-in-China. We do not ask for them. Your browser keeps that session on your own machine.
How the keys are protected
Every credential you save is encrypted on the server with a key held separately, and is never sent back to the browser — not even to you. We can see that a key exists, not what it is.
Who else sees it
- Anthropic, when the tool reads a document or drafts text for you: the text of that request goes to the Claude API under your own key and their terms.
- The public portals you scan, which see ordinary read requests.
- Your colleagues, if you invite them to your company.
- Nobody else. We do not sell data and we do not run advertising.
Where it is stored
On the server your installation runs on. If you self-host, that is your own machine and this notice describes what the software does, not what we do.
Your choices
You can see, correct, export or delete your data at any time by asking from your account. Deleting the account removes the company's lots, suppliers, criteria and stored keys.