Privacy Policy

1. Overview

This policy explains what information SupplySmart (a product of Onwardlabs LLC) collects, how it is used, and the choices you have. It applies to supplysmart.app and to tenant storefronts running on the platform.

2. What we collect

• Account information - name, business name, email, phone, and address provided at signup or in settings.
• Workspace data - the catalogs, customers, orders, invoices, payments, and bookkeeping records that tenants and their customers enter while using the service.
• Payment information - handled by Stripe. Card and bank numbers are entered on Stripe's systems and never stored on ours; we keep only references (such as customer and subscription IDs) and payment status.
• Usage and log data - standard technical logs (IP address, browser type, pages accessed, timestamps) used for security and debugging.

3. How we use information

To operate and secure the service, process subscriptions, send transactional email (order confirmations, invoices, statements, billing and account notices), provide support, and improve the product. We do not sell personal information, and we do not use your workspace data for advertising.

4. Tenant customer data

When a distributor uses SupplySmart, their customers' information (store names, contacts, order history, balances) is entered and controlled by that distributor. We process it on the distributor's behalf to provide the service. If you are a store whose supplier uses SupplySmart, direct questions about your information to your supplier first.

5. Service providers

We share data only with the providers that run the service:

• Stripe - payment and subscription processing
• Supabase - database, authentication, and file storage
• Vercel - application hosting
• Resend - transactional email delivery

Each provider processes data only to provide its service to us. We may also disclose information if required by law.

6. Cookies

We use cookies for sign-in sessions and security. We do not use advertising or cross-site tracking cookies.

7. Security and retention

Data is encrypted in transit, tenant workspaces are isolated at the database level, and access within our team is limited to what operating and supporting the service requires. We retain data while an account is active; after closure, data is deleted on request, except records we are required to keep (such as billing records).

8. Your rights and contact

You can access and update account information in the dashboard, request an export, or request deletion by contacting us. For any privacy request or question: hello@supplysmart.app. We may update this policy over time; material changes will be announced by email or in the dashboard.