What we collect
Business contact details you provide (such as name and work email); content customers submit to the service (product catalogues, technical data sheets, inquiry text, whole emails forwarded to the service with the sender's name and address and any attachments, and support requests and problem reports); what a buyer enters in an inquiry form that a customer places on its own website (name, company, work email and requirements); public product documents we gather ourselves, such as manufacturers' published data sheets; and service logs (requests, timestamps, approximate usage, and the email address and IP address of the person making the request) kept for security and operations. Our marketing website uses no advertising or analytics trackers.
How we use it
To provide, secure, and improve the service under our agreement with the customer; to communicate about the service; and to meet legal obligations. We do not sell personal information, and we do not use one customer's content to serve or train for another without written consent.
AI processing
The service processes submitted text using large-language-model infrastructure provided by Anthropic as a subprocessor, subject to contractual confidentiality. Deterministic screening runs in our own application and database, which are hosted by Railway, and makes no call to a large language model.
Cookies
The application uses only essential cookies/tokens required for sign-in and security. We set no advertising or cross-site tracking cookies, which is why you see no cookie banner.
Retention and deletion
Customer content is retained by default until the customer asks us to delete it. We return or delete it within 30 days of a written request or termination. On a written request or at termination, a person at GRADE runs the return and the deletion. A customer administrator can download a data file (company profile, product catalogue, and inquiries with their results and replies) and can request deletion in the product; unless the request is cancelled during the waiting period, a nightly job then deletes the customer's records and stored files. The return is an archive of the customer's records and the files the customer uploaded. It does not include replies on support tickets, users' business-unit assignments, or sign-in data. Anything we have not cleared for release is listed or counted in the archive without its contents: source documents we captured or fetched during processing, page images made from them, and records that name a supplier whose material we have withheld. After deletion we keep our own sales records about the customer (such as business contact details and demo requests), audit records filed under an individual user rather than the customer's account (such as sign-ins, account activation and deactivation, and invitation changes), and a record that the deletion was carried out.
We make an encrypted backup of the database each day. Each copy ages out 56 days after it is stored; we have set the off-site copy to be removed sooner, about 32 days after it is made. The hosting provider holds one backup it took before a security patch in early September 2026, which we cannot delete ourselves.
The audit log of a customer's account is kept for the life of the account. It is deleted when the account is deleted, apart from a few records (such as business-unit and product-note changes) that our nightly clean-up removes afterwards. Audit records filed under an individual user rather than the account (such as sign-ins, account activation and deactivation, and invitation changes) and a record of the deletion are kept with no fixed end date. Browser security reports, which a browser sends us when one of our pages loads something our security policy does not allow, are also kept with no fixed end date.
Security
Access-controlled endpoints, encrypted transport, and audit logging. No method is perfectly secure; we notify affected customers of incidents as required by law and contract. See our security overview.
Your choices
Email [email protected] to access, correct, or delete information we hold about you, or with any privacy question. We serve business customers in the United States; if additional regional rights apply to you, we will honor them as required by law.
Changes
We may update this policy. The effective date above changes with each update, and we tell active customers about material changes.