Suppled

Privacy Policy

Effective October 2026

1. Who we are and how this policy applies

This Privacy Policy explains how Suppled (“Suppled”, “we”, “our”, or “us”) collects, uses, and protects personal data when you visit our website or use the Suppled application.

We treat privacy with the same craft and honesty we put into our software. We do not sell your personal data, we do not track you across the web, and we do not profile your behavior for advertising.

2. Data Controller vs. Data Processor

Under data protection laws, including the UK Data Protection Act 2018 / UK GDPR, the European Union General Data Protection Regulation (EU Regulation 2016/679, “GDPR”), and US privacy laws:

  • Suppled is the Data Controller (or “Business”) for the personal data of our direct customers and website visitors (such as your account email, name, authentication credentials, and billing records).
  • Suppled is a Data Processor (or “Service Provider”) for the data you enter into your business tools (such as the names, delivery addresses, phone numbers, and quotes belonging to your customers). In this context, your business is the Data Controller, and our processing is governed by our Data Processing Addendum (DPA).

3. The personal data we collect

We collect only what is strictly necessary to provide and support our service:

  • Account and identity: Your name, email address, and authentication credentials (such as public passkey credentials or one-time sign-in code records).
  • Business profile: Your shop name, preferred currency, business address, and logo.
  • Tool data and records: The lists, records, calculations, price catalogues, and files (such as PDFs, spreadsheets, and artwork) you store in your tools.
  • Tailoring requests: The questions and change requests you submit to the tailoring assistant, which we use to update your tools and improve our engine.
  • Billing details: Our payment processor, Stripe, collects and securely handles your payment card details. We only store your Stripe customer identifier, subscription status, and billing cycle dates. We never see or store your full card number.
  • Technical logs: Basic operational logs (such as IP addresses, browser user agent, and error traces) collected solely to maintain service reliability, diagnose faults, and defend against security attacks.

4. Legal bases for processing (UK & EU GDPR)

We process your personal data based on the following legal grounds under UK and EU law:

  • Performance of a contract (Art. 6(1)(b)): Providing the Suppled platform, managing your account, generating quotes, dispatching customer emails, and processing your subscription.
  • Legitimate interests (Art. 6(1)(f)): Maintaining the stability and security of our servers, preventing fraud, providing technical support, and diagnosing system faults.
  • Legal obligation (Art. 6(1)(c)): Retaining statutory financial and tax records required by commercial and tax law.

5. Artificial intelligence and third-party LLMs

Suppled utilizes commercial large language model APIs (specifically Anthropic’s Claude API) to power the tailoring assistant.

Your business data and prompts are never used to train foundation models. Under our commercial API agreements with our AI providers, customer data submitted for tailoring is used solely to generate the requested tool changes and is deleted by the provider in accordance with their strict zero-retention or ephemeral enterprise retention policies.

6. Sub-processors and service providers

We rely on trusted third-party infrastructure providers to run Suppled. Each provider has been selected for their rigorous security standards and compliance with international data protection laws:

  • Anthropic, PBC (United States) — AI tailoring model inference. Protected by Standard Contractual Clauses (SCCs).
  • Stripe, Inc. (United States / Ireland) — Payment processing and subscription management.
  • Neon Inc. (Frankfurt, Germany / AWS EU) — Serverless PostgreSQL database hosting.
  • Cloudflare, Inc. (United States / Global) — Encrypted object storage (R2), DNS, and edge network protection.
  • Resend, Inc. (United States) — Transactional email delivery for sign-in codes and issued quotes. Protected by SCCs.

7. Cookies and tracking transparency

Suppled sets no advertising, marketing, or third-party tracking cookies.

We do not use Google Analytics, Meta Pixels, or behavior-tracking beacons. The free calculator on our website runs entirely in your browser without transmitting your typed numbers anywhere.

Within the customer application, we use only strictly necessary first-party technical cookies:

  • better-auth.session_token: An encrypted, HTTP-only session token necessary to keep you securely signed in to your account.
  • reply_[token]: A temporary, scoped authentication cookie set only when a customer verifies their identity to view a private quote link.

Because these cookies are strictly technical and required to deliver the requested service, no consent cookie banner is legally required under European ePrivacy rules, UK PECR, or global privacy standards.

8. Data retention and account deletion

We retain your personal data only for as long as your account is active.

You have the complete right to erasure (GDPR Art. 17). When a shop owner deletes their shop through Settings → Your data → Delete your account, our system executes an atomic transaction that permanently erases:

  • All records, lists, versions, and change history in the database.
  • All stored files, uploaded artwork, and generated PDFs.
  • All team members associated solely with that shop, along with their sessions and passkeys.
  • Your active subscription in Stripe, terminating all future charges immediately.

9. Rights under UK and European privacy laws

If you reside in the United Kingdom, European Union, or European Economic Area, you hold the following rights:

  • Right of access: You can export a complete machine-readable copy of your data at any time via Settings → Your data → Download everything.
  • Right to rectification: You can update your name, email, business details, and records directly in the app.
  • Right to erasure: You can delete your entire shop and data at any time.
  • Right to restriction of processing: You can request that we restrict processing under certain conditions.
  • Right to data portability: Your data is exportable in open standard formats (.zip, .csv, .json).
  • Right to object: You can object to processing based on legitimate interests.

To exercise any of these rights, use the export and deletion features in your settings or contact us directly at privacy@suppled.app.

You also have the right to lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioner’s Office (ICO) (ico.org.uk). In the European Union, you may contact your local national data protection authority.

10. Notice to United States residents

If you reside in the United States, including California, Colorado, Connecticut, Utah, or Virginia, state privacy laws (such as the California Consumer Privacy Act, “CCPA”, as amended by the CPRA) grant you specific rights:

  • No sale or sharing of personal information: We do not sell your personal information, nor do we share it with third parties for cross-context behavioral advertising.
  • Right to know and access: You have the right to know the categories of personal information collected, the sources, the business purposes, and to receive a copy of your data.
  • Right to delete: You have the right to request deletion of your personal information.
  • Right to correct: You have the right to request correction of inaccurate personal information.
  • Non-discrimination: We will never discriminate against you for exercising your privacy rights.

To exercise these rights, use the in-app export and deletion tools in Settings or email privacy@suppled.app.

11. Security

We implement strong technical and organizational safeguards: end-to-end encryption in transit via TLS 1.3, encryption at rest, passwordless passkeys (FIDO2 / WebAuthn) resistant to phishing, and strict tenant isolation at the database and file-storage layers.

12. Contact

For any privacy questions or data protection requests, please reach out to our privacy team at privacy@suppled.app.