Sections this document needs
- Identity and contact details of the controller, and a privacy contact.
- What personal information is collected, from whom, and why — separating the supplier's own staff from their customers' contact people, who never signed up with us.
- Legal basis / consent approach under PIPEDA, and GDPR/UK GDPR if any customer has European data subjects.
- Sub-processors, named, with what each receives: Anthropic (order message text), Supabase (database hosting, ca-central-1), Cloudflare R2 (product images), Hetzner (API hosting), Vercel (web hosting), and the email provider.
- Where data is stored and whether it crosses borders — the database is in Canada; the AI processing is not.
- Retention periods, and what deletion actually removes versus what is kept as legally-required records.
- Individual rights (access, correction, deletion, portability) and how to exercise them — the self-service export at /app/settings covers portability.
- Security measures, and the breach-notification commitment.
Facts about how Supligo actually works
Verified against the code, for whoever drafts this. Do not restate any of it from memory — it changes, and this list is maintained alongside the system it describes.
- Personal information held: supplier staff names, emails, roles and login timestamps; customer business contacts (name, email, phone); delivery addresses; order and invoice history.
- Passwords are stored as scrypt hashes; team PINs likewise. Session tokens are stored only as SHA-256 hashes. None of these are ever returned by the API or included in an export.
- Order message text is sent to Anthropic for extraction. Token counts and latency are recorded for cost accounting; the message text itself is stored in our own database against the order.
- A tenant can export everything they hold, themselves, as one JSON file (package A-1b). No request to us is needed.
- Operator access to a tenant workspace is recorded in an append-only log with a reason, and the tenant is shown a banner during it.