Privacy policy

• Account data: email address, password stored as a one way hash, role (buyer or provider), company name, job title if you give it, and the confirmation status of your email.
• Request data: what you enter in the method advisor and the request for quote, such as part or asset description, material, size, quantity, region, timing, standards and any files or images you upload.
• Provider profile data: company name, methods, equipment capabilities, certifications and accreditations as stated by the provider, regions served, business email and the names of team members with access.
• Billing data for providers: plan, billing period, invoices and payment status. Card details are entered with our payment processor and are not stored by us.
• Messages: emails you send to support and messages exchanged through the platform.
• Technical data: IP address, browser type, device information, pages visited and timestamps, collected in server logs for security and abuse prevention.
• Marketing attribution: the referring page and campaign parameters in the link you used to reach us.

Do not include sensitive personal data (such as health data) in requests. Inspection requests are about parts and assets, not individuals.

• To create and run your account and provide the service you request, including matching your RFQ with providers. Basis: performance of a contract.
• To process provider subscriptions, issue invoices and keep accounting records. Basis: performance of a contract and legal obligations.
• To send service emails such as confirmation codes, request status and replies from providers. Basis: performance of a contract.
• To keep the platform secure, prevent fraud and abuse, and enforce our terms of service. Basis: legitimate interests.
• To improve the method advisor, our pages and our matching, using aggregated or de identified data where possible. Basis: legitimate interests.
• To answer your questions sent to support. Basis: legitimate interests or performance of a contract.
• To comply with legal requests and protect legal claims. Basis: legal obligations and legitimate interests.

Where the law requires consent for a specific use, we ask for it first and you can withdraw it at any time without affecting earlier processing.

We share data only as needed to run the service:

• Providers you are matched with receive the scope of your request; drawings, files and identifying details go only to providers you approve, as explained on our inspection data security page.
• Buyers see the public parts of provider profiles and the replies providers send them.
• A hosting provider that stores and serves the platform.
• A payment processor that handles provider subscription payments.
• An email delivery provider that sends service emails.
• An AI model provider that processes advisor inputs to produce method recommendations.
• Professional advisers and authorities when required by law or to protect rights.

Our service providers act on our instructions and are bound to protect the data. We do not sell personal data and we do not share it for cross context behavioral advertising.

The service is focused on the United States and data may be processed in the United States and other countries. When personal data of visitors in the European Economic Area, the United Kingdom or Switzerland is transferred outside those regions, we rely on appropriate safeguards such as standard contractual clauses.

• Account and request data: while your account is active, and up to 30 days after you delete the account, except backups that roll over on their regular cycle.
• Billing records: as long as tax and accounting law requires.
• Server logs: up to 12 months.
• Support emails: up to 3 years after the last message.

You can delete individual requests and files from your account at any time.

Depending on where you live, you may have the right to access your personal data, correct it, delete it, receive a copy in a portable format, restrict or object to processing, and withdraw consent. Visitors in the European Economic Area and the United Kingdom have these rights under the GDPR and UK GDPR and may complain to their local data protection authority.

Rights of US residents

Residents of California and other US states with privacy laws, including rights under the CCPA as amended by the CPRA, may request to know what personal data we collect and how we use and disclose it, to delete it, to correct it, and to opt out of sale or sharing. We do not sell or share personal data as those laws define it, and we do not use sensitive personal information for purposes that require a right to limit. We will not discriminate against you for using your rights. You can use an authorized agent, and we may verify your identity before acting on a request.

How to make a request

Email [email protected] from the address on your account and say which right you want to use. We reply within the time the applicable law sets, usually within 30 days for GDPR requests and 45 days for US state law requests.

We use only essential cookies: to keep you signed in, to protect forms and sessions, and to remember settings such as the billing period toggle. They are needed for the site to work and are not used for advertising. We do not use third party advertising cookies or tracking pixels.

Data is encrypted in transit and at rest, access is limited per account and per role, and staff access is restricted and logged. No system is perfectly secure, and we will notify you and the authorities of a breach where the law requires it.

The service is for businesses and is not directed at children. We do not knowingly collect data from anyone under 16.

Changes to this policy

We may update this policy when the service or the law changes. We change the date at the top, and for material changes we notify account holders by email before they take effect.

Contact

Questions or requests about privacy go to [email protected].