Privacy Policy

1. Information we collect

• Account information: name, email address and sign-in credentials of authorized users.
• Business email content: when a Gmail account is connected, we read messages and PDF attachments that match our business filters (customer RFQs, customer purchase orders, and supplier replies to our quote requests), including sender, subject, date, body text and attachments.
• Business records: customer and supplier names, contacts, addresses, job and PO numbers, line items, prices, estimates, order acknowledgements and invoices.
• Usage and audit data: a log of actions the Service’s AI features take (what was processed, when, and a short explanation), plus standard server logs (such as IP address and browser type) kept by our hosting provider.

2. How we use information

• To extract quote and order details from business email, draft estimates, price lines and flag differences for human review.
• To send emails you explicitly approve (estimates to customers, quote requests to suppliers). Nothing is sent without a person approving it.
• To keep the Service secure, keep an audit trail, and fix problems.

We do not sell personal information, use it for advertising, or share it with data brokers.

3. Google user data

The Service requests the Gmail scopes gmail.readonly (to find RFQs, purchase orders and supplier replies) and gmail.send (to send emails a user has approved). Gmail data is used only to provide these features. It is not used for advertising, not sold, not used to train generalized AI models, and is not read by people except where needed for security, to comply with law, or with your consent.

MySourceBot’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Service providers that process data for us

• Supabase: database and user authentication (United States).
• Vercel: application hosting.
• Anthropic: the Claude AI model that reads email and PDF content to extract structured data and powers the in-app assistant, under Anthropic’s commercial terms.
• Google: Gmail API for reading and sending business email.

Each provider processes data only to deliver its service to us. We may also disclose information if required by law or to protect our rights.

5. Retention and deletion

We keep business records and the related email content for as long as needed to run the business and meet tax and legal obligations. You can ask us to delete information about you at gregthompsonmv@gmail.com; we will respond within 30 days, except where we must keep records by law. You can revoke the Service’s access to a Google account at any time at myaccount.google.com/permissions.

6. Security

Data is encrypted in transit, access requires sign-in, and database rules restrict each organization to its own records. AI features are limited to reading data and preparing actions; sending email or committing orders requires a person’s approval. No system is perfectly secure, and we will notify affected people of a breach as required by law.

7. Cookies

We use only the cookies needed to keep you signed in. We do not use advertising or third-party analytics cookies.

8. Your rights

Depending on where you live (including California), you may have the right to know what personal information we hold, to correct it, to delete it, and not to be discriminated against for exercising these rights. Contact us at gregthompsonmv@gmail.com to make a request.

9. Children

The Service is a business tool and is not directed to children under 16. We do not knowingly collect their information.

10. Changes and contact

We may update this policy and will change the effective date above when we do. Questions: gregthompsonmv@gmail.com, or Greg Thompson, doing business as Thompson Enterprises / Bolt Brokers, 3525 Shannon St, Corona, CA 92881.