Account and authentication data
Supabase Auth handles registration, sign-in, and recovery. Project Insight stores account profile fields needed for the workspace, such as name, company, and optional role title. The application does not store your plaintext password.
Private quote evidence
When controlled ingestion is enabled, quote PDFs are uploaded directly to private Supabase Storage. Raw PDFs, extracted customer identifiers, submitter identity, and account details are not publicly exposed or included in public benchmark summaries. Authorized administrators may review a source document and extracted fields.
Before submission, users can remove customer-company and quote-reference text from the retained extraction. To detect repeat contributions, the workflow compares the document's byte hash and a server-keyed fingerprint of quote-specific fields against prior submissions. Fingerprint keys and match details remain server-only; contributors receive a generic duplicate result.
Extraction provider boundary
If the workflow is enabled and an exact duplicate is not found, the private PDF is sent to OpenAI to extract structured commercial fields. OpenAI response storage is disabled for this request with store: false.
Under OpenAI's standard API policy, separate abuse-monitoring logs may be retained for up to 30 days, or longer when required by law or reasonably necessary to protect OpenAI's services or third parties from harm. Eligible, approved accounts may use Zero Data Retention or Modified Abuse Monitoring, subject to OpenAI's limitations. For image and file inputs, an image detected as potential child sexual abuse material is retained for manual review even when those controls are enabled.
Retention at a glance
Source PDF
Scheduled for deletion 30 days after upload when ingestion is enabled.
Failed or blocked upload
Removed sooner when cleanup succeeds; cleanup is not instantaneous.
Structured quote fields
May be retained for private analysis, access integrity, and authorized administration.
Duplicate and review evidence
Keyed fingerprints, matching records, and review history may be retained to prevent repeat access and support audits.
Provider abuse-monitoring logs
Under the standard OpenAI API policy, up to 30 days, with the exceptions described below.
Structured quote data, keyed duplicate evidence, and review records may outlast the source file to protect access integrity and support private administration. Lawful retention or an unresolved review may also delay deletion.
Public-release boundary
No raw PDF, verbatim quote text, submitter identity, or customer identity is included in a public benchmark summary. Approved quote data remains private unless and until separately anonymized, aggregated release controls are implemented. Contributed quote cohorts are not currently published.
Export and deletion requests
Signed-in users can export their profile, quotes, and access grants or request account deletion from the account page. A deletion request records a pending request only. No deletion begins automatically, and the request does not mean deletion is complete.
Open account controls