Privacy Policy

1. Information we collect

Account information. Your email address and password (stored only as a cryptographic hash, never in readable form), the name of the organization you create, and your display preferences.

Documents you upload. Supplier invoices, receipts and quotations, as files or photographs, together with everything extracted from them: line descriptions, quantities, pack sizes and prices. These documents frequently contain third-party information such as supplier contact names, account numbers and signatures. You are responsible for having the right to upload them.

Catalog and pricing data. The products, suppliers, pack tiers and price history you record, and any product images you upload.

Billing information. Handled by Paddle, our merchant of record. We receive your subscription status, plan and billing interval. We never receive or store your card number.

Technical and usage data. Standard server logs, and — on our public marketing pages only — aggregate page-view analytics. Our analytics provider sets no cookies and does not build a profile of you across sites.

2. How your documents are processed

When you upload a document, it is stored in Amazon S3 and read asynchronously. Text and table structure are extracted using Amazon Textract, and each line is then read by an AI model running on Amazon Bedrock to improve accuracy. Word and Excel documents go directly to the model.

Two things about this are worth stating plainly. First, the contents of your supplier documents are sent to these services as part of normal operation. Second, the model is invoked through a cross-region inference profile, which means a document may be processed in an Amazon Web Services region other than the one it is stored in. AWS does not use content submitted to Bedrock to train models.

Extraction produces a draft for you to review. Nothing enters your price history until you save it.

3. Why we process it

• To provide the service you signed up for — reading documents, matching products and maintaining your price history.
• To authenticate you and keep your organization’s data separated from every other organization’s.
• To take payment and apply the limits of your plan.
• To keep the service secure, diagnose faults and prevent abuse.
• To communicate with you about your account, including service and security notices.

Where the UK or EU General Data Protection Regulation applies, our legal bases are performance of a contract (providing the service and taking payment), legitimate interests (security, fault diagnosis, preventing abuse), and legal obligation (retaining financial records).

4. Who else processes your information

We do not sell your information and we do not share it with other customers. Your prices are never pooled, benchmarked across organizations, or made available to anyone outside your organization. We use the following subprocessors:

• Supabase — authentication and the Postgres database holding your catalog, records and price history.
• Amazon Web Services — document storage (S3), the processing queue, and the extraction services described above (Textract, Bedrock).
• Paddle — merchant of record; payment processing, invoicing and sales tax.
• Vercel — application hosting and cookieless analytics on the marketing pages.

We may also disclose information where we are legally required to, or to establish or defend legal claims.

5. Product images are public

Images you attach to products are stored in a public storage bucket. Anyone holding the image’s URL can view it without signing in. The URLs are not listed or linked anywhere outside the application, but they are not access-controlled. Please do not upload anything to a product image that you would not be comfortable being readable by someone with the link.

6. International transfers

Our subprocessors operate globally, so your information — including document contents during extraction — may be processed outside your own country. Where information is transferred out of the UK or EEA, that transfer relies on the safeguards offered by the relevant provider, such as standard contractual clauses.

7. How long we keep it

We keep your account and its data for as long as your account is open. If you close your account, we delete your documents, drafts, catalog and price history within 30 days, except where we are required to retain financial records for longer. Backups are overwritten on their own cycle.

8. Security

Every organization’s data is isolated at the database level by row-level security, not by application code, so a query can only ever return rows belonging to the organization that asked. Traffic is encrypted in transit. Passwords are stored only as hashes. No system is perfectly secure, and we do not claim otherwise.

9. Your rights

Depending on where you live, you may have the right to access a copy of your information, correct it, delete it, restrict or object to how we use it, receive it in a portable format, or withdraw consent. Paid plans also let you export your catalog and price history as CSV at any time, without asking us.

If you are in California, you may request disclosure or deletion of your personal information and are entitled not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined under California law.

To exercise any of these, contact us at hello@quonderbox.com. You also have the right to complain to your local data protection authority.

10. Cookies

The application sets only the cookies it needs to work: a session cookie that keeps you signed in, and a cookie holding your display preferences. We do not use advertising or cross-site tracking cookies, and our marketing analytics are cookieless — which is why you are not being asked to dismiss a consent banner.

11. Children

SanBili is a tool for businesses and is not directed at children. We do not knowingly collect information from anyone under 16.

12. Changes and contact

If we change this policy materially, we will update the date above and tell you through the application or by email. Questions or requests: hello@quonderbox.com, QuonderBox IT Solutions.

See also our Terms & Conditions.