Privacy Policy

PartPin is operated by Heron Networks LLC. Short version: the only personal information we ask for is a work email address. Most of what we hold is your business data — your catalog and the part numbers your customers search for — and we treat that as yours. We run no advertising, we sell nothing, and the list of parties we share with is five names long.

What we collect about you

• Email address— the only thing sign-up asks for. Stored lowercased, used to send your single-use sign-in link and to identify your workspace.
• Sign-in tokens— a single-use magic-link token valid 15 minutes, and a session token stored in a cookie so you stay signed in. Both expire.
• API keys— issued to your workspace, rotatable from the dashboard.

No password (there isn’t one), no name, no phone number. If you subscribe, your card details go straight to Stripe and never reach us. We keep only Stripe’s customer and subscription ids, your subscription status and its renewal date.

What we hold on your behalf

• Your catalog— SKUs, manufacturer part numbers, titles and aliases you upload, plus the normalized keys, trigrams and tokens we derive from them to make lookup fast.
• Your query log— every call to the resolve API: the raw query text, its normalized form, which tier answered, whether the match was asserted, and whether anything was returned at all. This is what powers your dashboard, your zero-result list, and usage metering.
• Confirmed aliases— when someone at your business confirms a previously-unresolved query, we record that mapping and who it belongs to, so the same query asserts next time.

A query your customer typed is normally just a part number, but a free-text search box can capture anything a person chooses to type. Treat the query log as potentially containing whatever your customers put into your search field, and tell them so in your own privacy notice.

The Zero-Results Autopsy scores a catalog and a list of failed searches that you paste in. It is computed and returned in the same request; the pasted catalog and queries are not written to the database.

Who we share with — the full list

• Cloudflare— hosting and the database holding everything above.
• Brevo— delivers the sign-in email. Receives your address and the link.
• Stripe— the payment processor, and only if you subscribe. It receives your email address, your workspace id and the payment details you give it on its checkout page. Stripe handles the card itself under its own privacy policy.
• Google Analytics 4— aggregate page views on the public pages, and only when a measurement ID is configured for the build. It receives what any web request carries plus a GA client id. It is not attached to your workspace, and it does not run on the API.
• An LLM provider (OpenAI or Anthropic)— only when the optional adjudication tier is enabled with a model key, and only then. It receives the query and the shortlisted candidate items so it can rank them; it never receives your whole catalog, your email, or your query history. With no key configured, the tier is off and nothing leaves for a model at all.

That is the entire list. We do not sell data and we share it with nobody else.

Cookies

One functional session cookie, set when you sign in. Google Analytics sets its own first-party client-id cookie on the public pages when it is enabled. There are no advertising or cross-site tracking cookies.

How long we keep it

Your catalog and aliases are kept while your workspace exists. Magic-link tokens expire in 15 minutes or on first use; sessions expire on their own. The query log is retained while your workspace exists because it is the dashboard — if you want a shorter retention window for it, ask and we will set one.

Getting it out, and getting it deleted

Delete account on your dashboard deletes your workspace and everything in it at once: API keys, catalog, aliases, query log, sessions and your email address. Any subscription is canceled first. Stripe keeps its own records of past payments, as the law requires it to.

Email [email protected] to receive your catalog and query log in a machine-readable form, to correct anything, or to have us do the deletion for you. We respond within 30 days.

If you are in the EU, the UK, or a US state with a privacy statute, you have rights of access, correction, deletion, portability and objection, and the right not to have your data sold — which we do not do. Where the data is about your own customers rather than about you, you are the controller and we act on your instructions.

Security

Every query is scoped to a workspace id, sign-in has no password to steal, and API keys are rotatable. We do not claim to be breach-proof; if a breach affects your data we will tell you what happened and what was in it.

Children

PartPin is a B2B tool and is not directed at children.

Changes

We will update this page and its effective date, and email workspace owners if the change is material. See also the Terms of Service.

Contact

Heron Networks LLC — [email protected].