Privacy Policy

1. Scope

This Policy applies when you visit or use the Service, create or maintain an account, use SuedeDoor research and AI features, contact support, submit a product or correction, subscribe to communications, make a privacy request, or otherwise interact with SuedeDoor. It does not govern third-party websites or services that you access through outbound links from SuedeDoor.

2. Information We Collect

Account and business profile information

When you create and use an account, we may collect your full name, job title, business (work) email address, display name, company or organization name and website (and the domain derived from it), company email domain, company type and size, AEC role, project types, primary software, BIM platform, hosting preference, AI software budget, security requirements, organizational state, U.S.-presence attestation information, work-email verification status, registration and signup/review status, and related account timestamps. We also maintain role information and records showing acceptance of applicable Terms and Privacy Policy versions.

When you register, we send a one-time code to your work email address. Entering it confirms that you control that email address; it does not verify your identity, employment, or job title, which remain information you provide. If your work-email domain cannot be automatically matched to your organization website, the registration is reviewed before access is activated.

Authentication information

Account authentication is provided through Lovable Cloud/Supabase Auth. Authentication and session tokens are used to keep you signed in and protect authenticated functions. SuedeDoor application code does not receive your plaintext account password.

Research, workspace, and AI content

Depending on the features you use, we may collect and store research queries, AI chat messages, saved comparisons, Live Look-up URLs and results, saved research, Dynamic Workspace profile and stack information, generated reports, and private workspace notes. Private notes are treated separately from AI features and are not included in AI prompts or model payloads.

Subscription and payment metadata

We store limited subscription and usage information such as your Stripe customer and subscription identifiers, product and price identifiers, subscription status and period dates, plan information, purchase or credit information, and monthly usage counters. Card numbers, CVVs, expiration dates, bank credentials, and similar raw payment credentials are handled by Stripe and are not stored in SuedeDoor tables.

Support, vendor, correction, newsletter, and privacy-request information

When you contact support or use an intake workflow, we collect the information you choose to provide. This can include email address, message or conversation content, support category, product and vendor information, source URLs, correction details, submitter name and role, authority attestations, and privacy-request details. Vendor-submission workflows may also maintain technical verification, deduplication, and rate-limiting information needed to prevent abuse and validate submissions.

Technical and operational information

The Service and its infrastructure providers may automatically process technical information needed to deliver and secure the Service, such as IP address, browser or device information, request and session identifiers, timestamps, authentication events, service usage, error information, and server or security logs. We do not use this information to operate behavioral advertising or cross-site user profiles.

Consent and preference information

We record your cookie/storage choices and observed browser privacy signals. Functional preferences, such as theme or layout preferences, are persisted only when the applicable Functional consent has been granted, except for storage that is strictly necessary to operate authentication, security, payments, or the consent system itself.

3. Sources of Information

We collect information from:

• you directly, including information entered into account, research, AI, support, vendor, correction, newsletter, and privacy-request workflows;
• your use of the Service, including necessary authentication, security, and operational events;
• service providers that help us operate the Service, such as payment, hosting, authentication, email, and infrastructure providers; and
• publicly available vendor and product sources used for catalog research, Live Look-ups, and market discovery.

4. How We Use Information

We use information to:

• create, authenticate, administer, and secure accounts;
• verify control of the work email address used to register and determine signup eligibility, including business-email, organization-website, and U.S.-presence requirements;
• provide catalog research, comparisons, Live Look-ups, saved research, Dynamic Workspace features, AI-assisted functions, reports, and support;
• process subscriptions and maintain billing and usage records;
• respond to support, vendor-submission, correction, and privacy requests;
• send service, verification, support, and other communications you request or that are necessary to operate your account;
• detect misuse, enforce rate limits, protect the Service, troubleshoot problems, and maintain reliability;
• maintain governance, policy-acceptance, and compliance records; and
• comply with applicable law, legal process, and our agreements.

We do not use personal information for third-party advertising, and we do not sell personal information or share it for cross-context behavioral advertising.

5. AI Features and AI Processing

Some SuedeDoor features use AI to provide factual research, comparison, workspace, support, and catalog-related functions. AI requests are initiated from SuedeDoor server-side functions rather than directly from the browser.

Information that may be sent to AI services

Depending on the feature, an AI request may include your query or conversation text, relevant catalog information, tool results, product/vendor identifiers, public vendor-page content, and, for Dynamic Workspace, the business-profile context needed to perform the requested comparison or research. Support AI may include the support conversation and plan/tier context needed to answer the request. Support tickets and email escalations, including the retained conversation context, may be reviewed by authorized SuedeDoor personnel, and applicable service providers may process support data on SuedeDoor's behalf. Support data follows the retention schedule stated in this Policy.

Information excluded from AI processing

Dynamic Workspace conversation text (your messages and the assistant's replies) may be stored temporarily, for up to 7 days, to provide conversation context and operate the service. Private workspace notes are not part of that conversation history.

SuedeDoor does not include private workspace notes in AI prompts or model payloads. Our current implementation also does not send passwords, payment-card information, authentication tokens, or other credentials to AI models.

Lovable AI Gateway and model providers

SuedeDoor uses Lovable AI Gateway for application AI calls. Lovable has stated to SuedeDoor that data submitted by end users of apps built on Lovable is not used to train Lovable's AI models. Lovable has also stated that its agreements with the downstream model providers it uses restrict those providers' use of submitted content to what is needed to provide the service, including a restriction on training AI models on that content.

Lovable has informed us that the AI Gateway entry point is hosted in the European Union and that inference on standard plans may be brokered to provider endpoints hosted in the United States. The AI path therefore is not necessarily confined to one region. Lovable does not provide SuedeDoor with a verified fixed retention period for raw prompts and responses at every gateway or downstream-provider layer, so this Policy does not promise a specific third-party raw-prompt retention period.

For the production SuedeDoor project, Lovable's optional “AI app context” setting is disabled. This means SuedeDoor has not opted into Lovable's optional use of application AI-call context for debugging and improvement.

6. Cookies, Browser Storage, and Tracking

Necessary storage

SuedeDoor uses a first-party consent cookie (currently named sd_consent) for approximately 180 days to remember your versioned privacy choices and relevant browser privacy signals. Authentication/session information is maintained through Lovable Cloud/Supabase Auth using browser storage necessary to keep you signed in and secure the account.

Functional storage

Optional functional preferences are persisted only after Functional consent is granted. If Functional consent is not granted, the Service may use temporary in-session state where needed without persisting a non-essential preference.

Payments

Stripe payment interfaces and fraud-prevention systems may use cookies or other technical identifiers that Stripe considers necessary to provide secure checkout and billing functions. Those technologies are controlled by Stripe.

No behavioral analytics or advertising tracking

The production Service does not include Google Analytics, Google Tag Manager, Meta Pixel, advertising pixels, behavioral analytics platforms, session replay, heatmaps, browser-fingerprinting libraries, or cross-site tracking. Lovable Visitor analytics is disabled for the production project. SuedeDoor does not use externally hosted Google Fonts; the application font is served locally.

Global Privacy Control and Do Not Track

Our consent system observes Global Privacy Control (GPC) and Do Not Track (DNT) signals. GPC prevents marketing consent from being enabled, and DNT prevents analytics and marketing consent from being enabled. Because SuedeDoor does not currently sell or share personal information for targeted advertising and does not operate behavioral analytics, these controls reinforce the Service's existing privacy-minimizing configuration.

7. How We Disclose Information

We disclose information only as needed to operate, secure, support, and administer the Service, or as required by law.

Current service and infrastructure providers include:

We may also disclose information to professional advisers, auditors, insurers, regulators, courts, law-enforcement authorities, or other parties when reasonably necessary to comply with law, protect rights or security, investigate misuse, resolve disputes, or carry out a corporate transaction. If ownership or control of SuedeDoor changes, information may be transferred as part of that transaction subject to applicable law.

No sale or targeted-advertising sharing. SuedeDoor does not sell personal information and does not share personal information for cross-context behavioral advertising or targeted advertising.

8. Data Retention

We use defined retention rules intended to keep information only as long as needed for the purposes described in this Policy, subject to legal holds, security needs, dispute resolution, and other legal obligations. Our current production retention rules include the following:

Account deletion is currently fulfilled through the privacy-request process rather than through a one-click in-product account-deletion control. When account deletion is completed, account-linked data is deleted or de-identified as applicable, subject to the retention exceptions described above and any legal requirement to preserve particular records.

9. Security

We use administrative and technical safeguards designed to protect information, including authenticated access controls, database row-level access controls, server-side authorization, restricted service-role functions for sensitive maintenance operations, protected payment interfaces, and scheduled retention/deletion processes. No method of transmission, storage, or security is completely risk-free, and we cannot guarantee absolute security.

10. Your Privacy Choices and Rights

Privacy Request Center

Authenticated users can use the SuedeDoor Privacy Request Center at /privacy-requests to submit access, correction, or deletion requests. SuedeDoor also provides an immediate self-service JSON export of account-related data. A signed-in session is used to verify the requester's account identity. We may request additional information when reasonably necessary to verify a request, protect another person's privacy, or comply with law.

State privacy rights

Depending on where you live and which privacy laws apply to SuedeDoor, you may have rights to request access to or confirmation of personal information we process, obtain a copy, correct inaccurate information, request deletion, and obtain information about how information is used or disclosed. Applicable law may also provide rights concerning targeted advertising, sale or sharing of personal information, sensitive personal information, portability, non-discrimination, and appeal of certain request decisions.

SuedeDoor does not sell personal information or share it for cross-context behavioral advertising. If applicable law gives you a right to appeal a privacy-request decision, you may appeal by contacting us at support@suededoor.com and identifying the request you want reviewed. We will not discriminate against you for exercising applicable privacy rights.

Global Privacy Control

Where a Global Privacy Control signal is received, our consent system treats the signal as a privacy preference that prevents marketing consent from being enabled. SuedeDoor does not currently engage in sale or targeted-advertising sharing that would require a separate opt-out transaction.

How to submit a request

You may use the Privacy Request Center while signed in or contact us at support@suededoor.com. If you cannot access your account, contact us by email and provide enough information for us to identify the relevant account and verify the request. You may also write to the mailing address in Section 15.

11. Email Communications

We may send transactional or service emails necessary to operate your account or fulfill a request, including email confirmation, support, verification, vendor-submission, privacy-request, or billing-related communications. If you subscribe to optional email updates, you may unsubscribe using the available unsubscribe mechanism. We may retain an unsubscribed address as a suppression record so we do not re-subscribe that address contrary to your choice.

12. Third-Party Websites and Public Sources

SuedeDoor contains links to vendor websites and may retrieve publicly available vendor/product pages as part of research functions. When you leave SuedeDoor or interact directly with a third-party website, that third party's privacy practices apply. SuedeDoor is not responsible for the privacy practices of websites or services we do not control.

13. Children

SuedeDoor is a business-oriented service and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information to us, contact us so we can review and address the matter.

14. Changes to This Privacy Policy

We may update this Policy as the Service, our providers, or legal requirements change. We will post the revised Policy with an updated effective or last-updated date and provide any additional notice or consent required by applicable law. Material changes will apply prospectively unless law permits otherwise.

15. Contact Us

Questions or privacy requests can be sent to:

16. Notice at Collection

This section describes the categories of personal information SuedeDoor collects at or in connection with creating and maintaining an account, why we collect each category, whether we sell or share it for cross-context behavioral advertising, and how long we keep it. It summarizes the same practices described elsewhere in this Policy, including Section 2 (Information We Collect), Section 4 (How We Use Information), Section 6 (Cookies, Browser Storage, and Tracking), and Section 8 (Data Retention).

SuedeDoor does not sell or share personal information for cross-context behavioral advertising.

Where a retention statement above depends on account or service state rather than a fixed period, that criterion is the applicable rule. Some information may be kept longer where necessary to comply with legal obligations, resolve disputes, prevent abuse, or enforce our agreements. To exercise a privacy choice, use the Privacy Request Center or contact support@suededoor.com.