Privacy notice

The website vs the product

• The public marketing pages set no tracking cookies and run no analytics or third-party scripts.
• The signed-in workspace is the product. It stores the data you add so you can prepare responses to buyer requests.

What the product processes

• account and sign-in details (email, authentication);
• your organisation profile;
• buyer questionnaire text and the request fields parsed from it;
• evidence you record — file metadata and the private evidence files you upload;
• your review decisions, evidence/claim checks, and visible gaps;
• generated response-pack snapshots and their private files;
• an append-only activity trail of actions in your workspace;
• standard server/session logs kept by our hosting to run and secure the service.

Why we process it

Only to provide the Response Desk: to let you import requests, hold your evidence, run the review workflow, and generate and download response packs. We do not sell your data or use it for advertising.

Where it is stored and who can access it

• Data is stored in Supabase (Postgres and private file storage) in the Sydney, Australia region, and served through Vercel.
• Access is scoped to your organisation using row-level security. Evidence and export files live in private storage — there are no public links, and downloads are streamed only to signed-in members of your organisation.
• BoltScope staff may access data only where needed to operate or support the service, under our design-partner agreement.

Retention and deletion

• You can delete an uploaded evidence file at any time; deletion removes the file and its mappings and is recorded in your activity trail.
• You can request deletion of all organisation data or your account from workspace settings. We action deletion requests under a controlled workflow.
• We do not run an automated time-based purge yet; retention is request-driven at this stage. Email admin@boltscope.com.au for any data request.

Third-party processors

Supabase (database, authentication, private file storage) and Vercel (application hosting). Each processes data on our behalf to run the service.

Security and honest limitations

• We use private storage, row-level security, server-only privileged paths, short-lived authenticated downloads, secure session cookies, and an activity trail. See the security page.
• We do not yet scan uploaded files for malware; during the controlled pilot we restrict file types and sizes instead. Please only upload documents you are comfortable sharing.
• We make no formal security-certification or independent audit-assurance claims.

Design-partner stage

BoltScope is early-access, running with a small set of design partners. Real supplier data is handled under a separate written agreement made with you directly. This notice is a plain-English summary, not lawyer-reviewed terms, and will be updated as the product grows.

Who operates BoltScope

BoltScope is a product operated by Synapse Labs Pty Ltd.

Contact

Privacy questions and data requests: admin@boltscope.com.au.