Privacy Policy

• Account information: the email address you sign up with, and a hashed password if you don't use Google sign-in.
• Purchase order data you upload or enter: PO numbers, supplier names and email addresses, item descriptions, dates, quantities, and prices. This is your business data; we store it to run the Service and don't use it for anything else.
• Follow-up emails: drafts, edits, and the content of emails you approve and send through the Service. If a supplier replies to a follow-up, we also store the content of that reply.
• Billing information: handled entirely by Stripe, our payment processor. We never see or store your card number. We only receive your subscription status and plan, which Stripe shares with us.
• Basic technical data and privacy-conscious analytics: sign-in timestamps and the kind of activity logs any web application needs to operate and debug. We also use Vercel Web Analytics for aggregated page-view and device information. It is designed not to use cookies or identify visitors across sites; we do not use advertising trackers or sell analytics data.
• Product usage milestones: we log a small number of account-level events tied to your account (such as signing up, uploading orders, generating or sending a follow-up, a supplier reply, an order update, and return visits) so we can understand how the Service is actually used and improve it. These events don't include the content of your orders or emails, aren't shared with anyone outside SupplierPing, and are deleted with the rest of your account data if you delete your account.

We use your data only to run the Service you signed up for:

• Classifying your purchase orders as overdue, due soon, unconfirmed, or on track.
• Drafting follow-up emails, and reading a supplier's reply to suggest a status/date update. This is applied automatically only if you've turned on auto-pilot and the reply contains a clear delivery update. Otherwise it's held for you to review and apply yourself.
• Sending an approved follow-up through our email provider, with your address as the reply address, when you click send, or automatically if you've turned on auto-pilot (Growth and Unlimited plans, off by default).
• Billing your subscription and enforcing your plan's order limits.
• Account security, support, and legal compliance.

Order and email content is sent to an AI model (see Section 4) to draft messages and interpret replies. Your open purchase orders (PO numbers, supplier names, items, statuses, and dates, not supplier email addresses) are also sent to the same AI model when you ask the in-app assistant a question about your queue, so it can answer from your real data instead of guessing. We send this data to Groq only to produce the result you asked for, under Groq's API terms. Groq may process it in the United States and other countries.

We do not use your purchase-order or email content to train a general-purpose AI model. We do not make decisions about a person’s eligibility, employment, credit, insurance, or access to essential services.

We process your data to perform the contract you enter into by creating an account (Singapore's Personal Data Protection Act treats this as deemed consent for the purposes reasonably needed to provide the service you asked for), and, where applicable, on the basis of your consent. If the EU or UK GDPR applies to you, our legal bases are: performing our contract with you (running your account and the Service); our legitimate interests (securing the Service, preventing abuse, understanding how the Service is used, and contacting businesses about SupplierPing); your consent, where we ask for it; and legal obligations such as tax records.

For purchase-order and supplier information that a business customer uploads, that customer generally decides why the information is processed and SupplierPing processes it to provide the Service. The customer is responsible for its own notices, consents, instructions, and responses to supplier requests; SupplierPing is responsible for the personal data it controls directly, such as account and billing administration, and acts on the customer's instructions for supplier data (see Section 14).

We don't sell your data, and don't share it for marketing. We use the following processors to run SupplierPing, each only for what's needed to provide the Service:

• Supabase: database hosting and authentication.
• Stripe: subscription billing and payment processing.
• Groq: processes order and email text to draft follow-ups, interpret supplier replies, and answer questions you ask the in-app assistant about your open order queue.
• Resend: delivers follow-up emails, and parses inbound supplier replies routed back to the Service.
• Vercel: hosts the website and application and provides aggregated web analytics. Vercel processes request data such as IP addresses, and the content you submit while the Service runs.
• Google: if you choose Continue with Google, Google confirms your identity and shares your email address with us. We do not access your Gmail or Google account. If you link a Google Sheet, we store its link and download the sheet's contents when you link it and once a day afterwards, to import your orders. This only works for sheets shared as "Anyone with the link", which means anyone who has that link can read the sheet. You can unlink it any time from Account.
• Exchange-rate service: we fetch published currency exchange rates from a public reference-rate service. No personal data is sent to it.

We may also disclose data if required by law, or to protect the rights, property, or safety of SupplierPing, our users, or others.

Our providers process data in several countries, mainly the United States and the countries where their own infrastructure runs. Where the law requires, we rely on the providers' data processing terms, including standard contractual clauses for transfers from the EU and UK, and on contractual protections that meet the Singapore PDPA's transfer requirements. The list above names the providers we use today; we update this page when it changes.

Data is stored with Supabase (PostgreSQL) behind row-level security, so every account's data is isolated at the database level, not just in application code. Connections to the Service are encrypted (HTTPS). Access to production data is limited to what's needed to operate the Service. No online service can guarantee absolute security, so you should use a strong unique password and report suspected compromise promptly.

We keep your data for as long as your account is active. We do not currently delete inactive accounts automatically: you can delete yours at any time, or ask us to. Deleting an order removes its follow-up emails and drafts with it. Deleting your account (available any time from Account) permanently removes your orders, uploads, emails, and subscription record from our active systems without undue delay. Encrypted backups, fraud-prevention records, security logs, and billing records may remain for a limited period where needed for recovery, security, dispute handling, or tax and accounting law, after which they are deleted or irreversibly de-identified. We keep billing records for up to 5 years, security logs for up to 90 days, and backups for the period our database provider keeps them. Billing records may also be retained by Stripe under its own legal obligations.

You can access and correct your data directly in the Service at any time (editing an order, updating your account), export your purchase orders as CSV from the dashboard, or delete your account entirely. If you'd like help with any of this, or have a request we don't have a self-serve option for (such as a data export in another format), email supplierping@gmail.com. If you're in the EU or UK you have the right to access, correct, delete, restrict or port your data, to object to processing, to withdraw consent at any time, and to complain to your local data protection authority. Email us and we will answer within one month. Business customers who need a data processing agreement can request one at the same address.

We maintain a data-protection contact for privacy questions and complaints. Contact our data protection contact at supplierping@gmail.com. We will acknowledge and investigate complaints, ask for information needed to verify the request, and respond within a reasonable period. You may also contact Singapore’s Personal Data Protection Commission if you are not satisfied with our response.

We maintain procedures to detect, assess, contain, and respond to suspected personal-data incidents. If an incident is likely to result in significant harm or is of significant scale, we will make the notifications required by applicable law, including notifying the PDPC and affected individuals where required. Where we hold your data on your behalf, we will tell you without undue delay, and aim to do so within 72 hours of becoming aware of a breach, with what we know so you can meet your own duties. Customers who upload business data must notify us promptly at the contact above if they believe their SupplierPing data or credentials have been compromised.

We use only essential cookies and storage: sign-in session cookies from our authentication provider, and one browser storage setting that remembers whether you collapsed the assistant panel. We use Vercel Web Analytics, which does not use cookies or track you across sites. We do not use advertising or tracking cookies, so there is no cookie banner. If that changes, we will ask first.

SupplierPing is a business tool and isn't directed at, or knowingly used by, children. We don't knowingly collect data from anyone under 18.

If we make a material change to how we handle your data, we'll update the date at the top of this page and, where appropriate, notify you directly.

We send service emails to your account address: reply alerts, a notice when auto-pilot sends follow-ups, and a weekly summary when there is something to act on. You can turn the weekly summary off in Account.

If you are a supplier contact, a SupplierPing customer uploaded your name, email address and order details so they can follow up on a purchase order. We process this on their instructions and keep it until they delete it or close their account. Every follow-up we send carries a line explaining who sent it and how to stop: reply STOP and we pause further emails to you from that customer. To see, correct or delete your data, ask the customer who emailed you, or write to us at supplierping@gmail.com and we will pass the request on or act on it.

We may email businesses about SupplierPing using business contact details published on their own websites. We keep the business name, the address and our message history, and we stop and delete on request: reply "unsubscribe" or write to supplierping@gmail.com. The free Open PO Health Check analyses the file you upload in memory to produce your summary and does not store it or send it to an AI model. We use your IP address only to limit repeated uploads. Please do not upload personal data you have no right to share.

Questions about this policy or your data: supplierping@gmail.com.