PRIVACY POLICY
Last Updated: [Insert Date]
Effective Date: [Insert Date]
This Privacy Policy explains how SupplyAlert (“SupplyAlert,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information when you access or use our Services.
SupplyAlert maintains a privacy program designed to align with generally accepted global privacy principles. Certain jurisdiction-specific rights or obligations described in this Policy apply only if and when SupplyAlert offers its Services in those jurisdictions.
SupplyAlert
118 North Bedford
Mount Kisco, NY 10549
United States
Privacy Email: privacy@supplyalert.com
Data Protection Officer (DPO): Hadley Griffin
Email: hadley@supplyalert.com
Phone: +1 313-318-6612
SupplyAlert has not appointed an EU GDPR Article 27 representative, a UK GDPR representative, or a China-based data localization entity. If SupplyAlert expands service availability into those jurisdictions, this Policy will be updated accordingly.
This Privacy Policy applies to all personal data processed when you:
This Policy does not apply to:
Service Availability by Jurisdiction.
SupplyAlert does not currently offer its Services to individuals or entities located in the European Union, European Economic Area, United Kingdom, or the People’s Republic of China. Users located in these jurisdictions are not permitted to create accounts or use the Services at this time.
To avoid duplication across jurisdictions, these definitions apply globally unless a local law requires a specific definition.
SupplyAlert does not collect sensitive data unless it is voluntarily uploaded as part of vendor data.
Our Services are intended only for users aged 18 and older. We do not knowingly collect personal data from individuals under 18. If we learn that a minor has provided personal information, we will delete it promptly.
For jurisdictions that establish specific age thresholds, including COPPA (under 13), we do not knowingly collect or process personal data belonging to individuals below the applicable age requirement. If such information is identified, we will delete it in accordance with legal obligations.
SupplyAlert collects only the data necessary to operate and improve our Services. We gather information in four main ways:
We use minimal tracking, specifically: Strictly necessary cookies, Analytics cookies (Google Analytics only).
We do not use: Third-party advertising cookies, Retargeting pixels (e.g., Facebook Pixel). Details are provided in the Cookies section.
SupplyAlert uses AI tools to: Categorize vendor data, Suggest vendor classifications, Improve data clarity.
We process: User-submitted vendor content, Metadata about your interactions with the AI system.
We do not: Use AI to profile users, Allow AI models to train on user data outside SupplyAlert, Perform automated decisions with legal impact.
All AI output is subject to human review.
We do not buy personal data. We receive only: Analytics data from Google, Payment metadata from Stripe.
No other third-party data sources are used.
Because we voluntarily comply with global privacy frameworks, we rely on the following legal bases depending on region and purpose:
Used for: Analytics cookies, AI-powered features (where required), Any optional personal data you provide. Consent may be withdrawn at any time. Where required under applicable law, we will obtain explicit consent before processing any sensitive personal data. Users should avoid uploading sensitive personal data unless strictly necessary for business purposes and permitted by applicable law.
We use your data to: Provide the Services, Manage your account, Authenticate you, Process payments via Stripe.
We rely on legitimate interests for: Improving platform functionality, Performing analytics, Preventing fraud or misuse, Ensuring security, Internal administrative purposes. Where required by applicable law, we assess and balance our legitimate interests against individual privacy rights.
We process data to: Comply with accounting and tax laws, Respond to lawful government requests, Maintain required business records.
Rarely, we may process data to: Prevent potential harm, Respond to urgent safety concerns.
SupplyAlert uses personal information solely for the purposes described in this Policy. We do not use data in ways that are incompatible with the purposes for which it was collected.
We use your information to: Register and manage user accounts, Authenticate access, Store and manage vendor information, Provide platform features and updates, Deliver AI-assisted vendor classification.
We analyze aggregated usage data to: Understand platform performance, Optimize user experience, Fix bugs and troubleshoot issues, Develop new features.
When payments are enabled through the Services: Stripe processes payment card details, We receive transaction confirmation and pricing metadata. We maintain financial records as required by law.
SupplyAlert never receives or stores: Credit card numbers, CVV codes, Bank account numbers.
We may use your information to: Send service-related notifications, Respond to support requests, Provide updates and administrative messages, Address technical issues or security notices.
We do not send marketing emails unless you explicitly opt in.
We process data to: Detect suspicious behavior, Prevent unauthorized access, Monitor usage for potential threats, Investigate or prevent potential harm.
We maintain written Data Processing Agreements with all third parties that process personal data on our behalf. These agreements require such parties to protect the information in accordance with applicable privacy laws, limit their use of the data to specific instructions given by SupplyAlert, and notify us promptly of any security incidents. We will inform users in advance where required by law if we add or replace any sub-processor that may process personal data.
We may process data to: Comply with regulatory obligations, Respond to lawful requests, Maintain business records, Enforce our Terms of Service.
SupplyAlert does not use automated systems to make decisions that produce legal or similarly significant effects.
Our AI tools:
We do not conduct:
SupplyAlert guarantees the following across all global jurisdictions:
Compliance With Global Standards
Our non-sale commitment applies under:
SupplyAlert does not engage in any activities that fall within the definitions of “sale,” “sharing,” or “targeted advertising.”
SupplyAlert shares personal information only as necessary to provide the Services and comply with legal obligations. We do not sell or disclose personal data for advertising purposes. We share information exclusively with the following categories of recipients:
We share device and usage data with Google Analytics for: performance measurement, functional insights, aggregate usage statistics.
Google Analytics is configured to: disable advertising features, anonymize IP addresses where required, prevent data sharing for Google Ads purposes.
Stripe processes: payment card details, transaction data, billing metadata.
SupplyAlert only receives: transaction confirmation, non-sensitive metadata, basic payment status.
We may use third parties for: cybersecurity services, fraud detection tools, error monitoring, system diagnostics
We may disclose personal data if required by: court orders, subpoenas, government or regulatory authorities. We will notify you where legally permitted.
We may disclose data to: investigate and prevent fraud, protect our legal rights, enforce terms of service, protect the safety of users.
If SupplyAlert undergoes: a merger, acquisition, financing, or sale of assets personal data may be disclosed under confidentiality obligations. Your data will remain protected by this Policy unless replaced by a successor policy.
Because SupplyAlert is based in the United States, your information may be transferred to and processed in the U.S., even if you are located in another country. We use robust legal mechanisms to protect data globally.
We retain data only as long as necessary for the purposes described in this Policy or as required by law.
General timeframes:
If data is no longer needed, we permanently delete it, or irreversibly anonymize it.
Default Retention Limitation.
Where a user does not actively delete their account or data, SupplyAlert will not retain personal data indefinitely. Personal data associated with inactive accounts may be deleted or anonymized after a reasonable period of inactivity, unless retention is necessary for legal compliance, security, fraud prevention, dispute resolution, or enforcement of contractual obligations.
SupplyAlert employs industry-standard technical and organizational measures to safeguard personal data.
Technical Measures
Organizational Measures
Data Breaches
If a breach occurs, we notify affected individuals and relevant authorities of data breaches in accordance with applicable law and regulatory requirements.
Because SupplyAlert operates globally, we extend a baseline set of privacy rights to all users worldwide, even where not legally required. You may request any of the following:
You may request copies of the personal data we hold about you.
You may request correction of inaccurate, incomplete, or outdated information.
You may request deletion of:
We will honor deletion requests unless:
If processing is based on consent (e.g., analytics cookies), you may withdraw consent at any time.
In certain jurisdictions, you may request that we temporarily limit processing.
We can provide your data in a structured, machine-readable format.
You may object to processing based on:
SupplyAlert does not make automated decisions with legal or significant effects.
You may file complaints with:
You may submit a rights request through:
We may require verification of identity to protect user privacy.
Timeframes: We respond to privacy right requests within legally required periods as per applicable law:
Below is a clear breakdown of rights by region.
Users have rights to:
SupplyAlert:
These state laws grant rights to:
SupplyAlert does not engage in any targeted advertising, sale, or profiling.
Users have:
SupplyAlert follows the ten PIPEDA Fair Information Principles.
Rights include:
We follow PDPA’s Notification and Reasonableness Obligations.
Users have:
No processing of children’s data occurs.
Rights include:
One of the strictest privacy regimes in the world; rights include:
Users may request:
Mandatory response period is 15 days.
Users may:
Future Jurisdictional Rights.
If SupplyAlert expands its Services to jurisdictions with additional statutory privacy rights (such as the European Union, United Kingdom, or the People’s Republic of China), users in those jurisdictions may be entitled to additional rights under applicable law. Any such rights will apply only after SupplyAlert formally offers Services in those regions and updates this Policy accordingly.
SupplyAlert uses a minimal set of cookies to ensure the platform operates securely and efficiently. We do not use cookies for advertising, retargeting, or behavioral profiling.
These cookies are essential for: Logging into your account, Security and fraud prevention, Core platform functionality. They cannot be disabled.
Used only to understand:
We configure Google Analytics to:
SupplyAlert does not use:
Consent is not required for analytics cookies under CCPA/CPRA, CDPA, CPA, CTDPA, UCPA, TDPSA, or OCPA, but users may still opt out.
Consent may be implied or explicit depending on sensitivity and context.
Non-essential cookies require disclosure and, in some cases, express consent.
Analytics cookies typically require consent.
You can manage cookies by adjusting your browser settings. Common paths:
You may block all non-essential cookies.
SupplyAlert uses Google Analytics solely to analyze platform usage and performance.
Google Analytics does not receive:
We configure Google Analytics to:
Users may opt out using:
If payments are used within the platform, Stripe- our payment portal, processes all financial information.
Stripe processes this data under its own privacy policy.
We only receive:
SupplyAlert never stores:
Stripe is:
No. We want to be absolutely clear:
SupplyAlert does not:
This applies universally across all global privacy laws, including:
This is a core policy commitment.
SupplyAlert retains personal information only as long as necessary for the purposes described in this Policy or as required by law.
We consider:
When data is no longer needed, we:
SupplyAlert never re-identifies anonymized data.
SupplyAlert applies industry-standard technical and organizational measures to safeguard personal data.
In case of a security incident:
Examples of required notice:
SupplyAlert maintains a documented incident response plan.
SupplyAlert uses AI responsibly and transparently.
Our AI functionality is limited to:
AI outputs are assistive, not authoritative.
SupplyAlert’s AI systems do not:
AI processing is always subject to human oversight.
We implement:
Users maintain full control over vendor information.
User data processed through AI-supported features is not used to train external machine learning models and remains within SupplyAlert’s controlled systems. All AI outputs remain subject to human oversight.
To maintain security and compliance, users agree to:
You are responsible for:
Users must comply with applicable laws when providing data to SupplyAlert.
Users must not:
You may exercise your privacy rights at any time.
We may require identity verification before fulfilling your request.
To protect account security, we may verify:
We do not use verification data for any other purpose.
We may refuse a request if:
We will explain the reason for any denial (unless restricted by law).
In certain jurisdictions (e.g., California), you may appoint an authorized agent to make rights requests on your behalf. Agents must provide:
SupplyAlert may contact you directly to confirm authorization.
Some U.S. state laws require a formal appeals process if we deny your rights request. You may submit an appeal by emailing: privacy@supplyalert.com.
Subject Line: “Privacy Rights Appeal – [Your Full Name]”
Response timeframes (per law):
If your appeal is denied, you may contact your state’s Attorney General.
SupplyAlert will never discriminate against you for exercising your privacy rights.
This includes:
We comply with anti-discrimination provisions in:
This protection applies to all users worldwide.
This section addresses important variations in global privacy regulations.
Indian users may:
We acknowledge grievances within a reasonable timeframe per DPDP guidelines.
Korean regulations require:
We align with PIPA’s elevated requirements whenever applicable.
APPI requires:
We comply with all APPI transparency requirements.
Australia requires:
SupplyAlert fulfills these obligations for Australian users.
Under PIPEDA:
We follow the 10 PIPEDA Fair Information Principles.
Our Services may contain links to websites, tools, or resources operated by third parties.
These third parties may collect information independently. We are not responsible for:
If you follow a link to a third-party website, you do so at your own risk.
We recommend reviewing their privacy policies before providing any personal information.
Although SupplyAlert is headquartered in the United States, we serve users worldwide.
By using our Services, you acknowledge that:
We follow regional privacy requirements such as:
Each requires safeguards for cross-border transfers and appropriate notice.
We comply with:
SupplyAlert may update this Privacy Policy periodically.
Updates may occur to:
We will update the “Last Updated” date at the top of this Policy. For material changes, we may also:
Examples:
Material changes include:
Non-material changes include:
If any portion of this Privacy Policy conflicts with:
The stricter requirement will apply for the relevant jurisdiction. Nothing in this Policy limits rights provided under:
Our failure to enforce any part of this Privacy Policy is not a waiver of our rights.
Any waiver must be explicit and in writing.
If any provision of this Privacy Policy is found invalid or unenforceable:
We may assign or transfer this Privacy Policy in connection with:
Your information will remain protected under this Policy unless replaced with a successor policy. We will notify users of any ownership changes if legally required.
If you have questions, concerns, requests, or complaints regarding this Privacy Policy or our data practices, you may contact us using the information below:
SupplyAlert
118 North Bedford
Mount Kisco, NY 10549
United States
Privacy Email: privacy@supplyalert.com
General Support: [Insert support email if any]
Data Protection Officer (DPO): Hadley Griffin
Email: hadley@supplyalert.com
Phone: +1 313-318-6612
We will respond within the timelines required by applicable law.
For all users worldwide, the data controller responsible for your information is:
SupplyAlert
118 North Bedford
Mount Kisco, NY 10549
United States
We currently do not maintain:
If these are appointed, we will update this Policy accordingly.
SupplyAlert has not appointed, and does not currently maintain, an EU GDPR Article 27 representative, a UK GDPR representative, or a China-based data localization entity. SupplyAlert does not currently direct, market, or offer its Services to individuals or entities located in these jurisdictions.
If you believe your privacy rights have been violated, you may lodge a complaint with your regional authority. Examples include:
Unless otherwise required by mandatory local law, this Privacy Policy is governed by and interpreted as per the laws of the State of New York, USA. This choice of law does not limit rights granted under mandatory and non-waivable privacy laws applicable to users at the time Services are offered in a given jurisdiction.
This Policy may be translated into multiple languages. In cases of conflict the English version prevails. Translations exist only for convenience unless required by local law.
This Privacy Policy constitutes the complete and exclusive statement of our privacy practices with respect to the Services. It supersedes any prior version of the policy.
We may amend this Policy periodically. When updates occur:
You are encouraged to review this Policy regularly.