Privacy policy

Last updated 21 October 2026

Supply Chain Co. (“we”) runs the BOM cost-reduction tool on this site and the customer portal where your analysis appears. This page explains what we collect, why, and who else sees it.

What we collect

• What you give us: your email address, company name, expected volumes, the bill of materials (BOM) you upload, and any answers you type in the portal.
• If you sign in with Google: your name, email address and Google account ID. We never see your Google password, and we can’t read your email, files or contacts.
• If you connect Claude: the requests Claude makes to our connector, meaning which tool it used and the inputs it sent (for example a part number or a company name), and a record of any change it made for you. We don’t receive or keep your Claude conversations. See Using Supply-Chain-OS with Claude.
• If you text Supply-Chain-OS (iMessage): your phone number or Apple ID address, which we keep only as a scrambled fingerprint (plus its last few digits, so you can recognise it), and your messages and our replies from the last 24 hours, stored encrypted so a follow-up question makes sense. We record which tools each text used and any change you confirmed by replying YES, as with Claude. If someone shared Supply-Chain-OS with you, we note whose link you used.
• If you watch our demo video: the email address you enter before it plays, when you watched and how far you got. We use it to follow up about the demo, and to count views. If you share it, we also keep the address you sent it to, and email that person the link once, saying it came from you.
• If you set a password: we store only a scrambled (hashed) version that can’t be turned back into your password.
• Technical details: a coded version of your IP address (not the address itself), used to stop abuse, and the cookies needed to keep you signed in. Apart from the Google Ads measurement below, we don’t use advertising or tracking cookies.
• Counting visits: each page you load tells us the site that sent you there (for example Google or LinkedIn), with no cookie. To count you once a day, we turn your IP address and browser into a code that changes every day and can’t be turned back into either. We never keep the address itself.
• If you arrive from a Google ad: we note which ad and search brought you (Google’s click ID and the campaign tags in the link) with your upload, to learn which ads work. The Google Ads tag may set a cookie to measure that. Visitors in the EEA, the UK and Switzerland get no ad cookies.

How we use it

• To produce your should-cost analysis and cost-reduction recommendations.
• To let you, and colleagues at your company, get back into your workspace.
• To contact you about your analysis.
• To keep the service secure and prevent abuse.

We don’t sell your data. We don’t show your BOM or results to any other customer.

Who else sees it

Our team reads your files to check the analysis. We also use a few service providers:

• Vercel hosts the site and stores uploaded files privately.
• Neon hosts our database.
• Resend sends the demo link when you share it, and tells our team when someone new watches.
• Google handles “Sign in with Google”, and Google Ads measures which of our ads work.
• DigiKey and Mouser receive part numbers and quantities, to look up current prices. They don’t receive your file, your name or your company name.
• TrustedParts, Future Electronics and Master Electronics receive part numbers only, to look up more distributors’ prices and stock. They don’t receive your file, your quantities, your name or your company name.
• Anthropic (the Claude AI model) may read BOM contents to help with the analysis, under terms that don’t let it train on your data.
• Sendblue carries texts between your phone and Supply-Chain-OS when you text us, and Anthropic writes the replies from your company’s data.

These providers may store data in the United States.

How long we keep it

We keep your files and analysis until you ask us to delete them; nothing is deleted automatically. If you ask, we delete them within 30 days of your request. Sign-in sessions expire on their own, and a Claude connection ends after 30 days or as soon as you disconnect it. A texting connection ends after 90 days or when you text STOP, and we forget the conversation 24 hours after your last text.

Keeping it safe

Files are kept in private storage and sent over encrypted connections. Each company’s workspace is walled off from every other company’s.

Your choices

You can ask for a copy of your data, ask us to correct it, or ask us to delete it. Email greg@thesupplychaincompany.ai.

Changes

If we change this policy, we’ll update it here and change the date at the top.

← Back to BOM cost reduction