Privacy Policy

Information We Collect

Cortex. When you interact with our WhatsApp service we collect your phone number, the messages you send (text, photos and voice notes), equipment identifiers, and metadata such as timestamps.

Synapse. We process the operational data you send us in order to return an order plan: your product list, storage locations, stock on hand, purchase orders, supplier terms, and sales history. This is business data about your operation. Where you use the order planner in the customer portal, we save that work to your account so it is there when you return: your product list, the sales history you paste, the settings you choose, and each plan you run with its results. The plan itself is worked out in your browser. Data you send to the Synapse API for a plan is processed for the length of the request and not stored afterwards.

Deliveries and documents. When you record a delivery, or photograph an invoice, delivery note or other supplier document, we store the image and what we read from it: the supplier, the items, the quantities, the prices, the invoice and account numbers, when delivery was promised and when it arrived. Deliveries are stored whether you record them in the portal or through the API.

Accounts. To sign in to the portal we hold your name, email address, a hash of your password (never the password), the organization you belong to, your role in it, and a record of sign-ins and permission changes.

How We Use Your Information

We use the information to provide the products you have signed up for, to authenticate you, to communicate with you, and to comply with legal obligations. One customer's operational data is never shown to another. The one thing that contributes to what other customers see is described under Pooled Data below.

We may publish or sell statistics built from customer data, aggregated and stripped of identifying detail so that no individual business can be picked out of them. We do not sell records that identify you, and we do not sell or publish the prices you have negotiated with your suppliers.

Pooled Data

Every delivery you record produces two separate records.

Yours. The items, the quantities you ordered and received, the prices, the invoice and account numbers, your own product codes, the location it went to, and the document image. This record stays in your account. It is never pooled. No other customer and no supplier sees any part of it.

The supplier's. A record of how the supplier performed: when the order was placed, when delivery was promised, when it arrived, how many lines were short, substituted or rejected, the supplier's own catalogue numbers for those lines, how long unloading took, and the first three digits of the delivery postcode. It carries no prices, no quantities, no invoice or account numbers, none of your product codes, and no name, address or contact detail of yours. We combine this record with the same record from other customers to produce statistics about that supplier, and we show those statistics to our customers and to the supplier itself.

We publish a figure about a supplier only above a minimum. Our customers see a figure only where at least three separate businesses and twelve deliveries contributed to it, and it is always shown with the number of deliveries and businesses attached. A supplier sees figures about itself only where at least eight separate businesses and thirty deliveries contributed, as ranges rather than exact values, with the number of contributing businesses given as a bracket, never broken down by customer, location, postcode, weekday or product, and updated monthly. Below those minimums we show nothing at all. A supplier is never told which of its customers use Synapse. Some customers tell their supplier directly, by inviting them.

What we do not do. We do not compare prices across customers. We do not build price benchmarks, price indexes, or comparisons of what different businesses pay, we do not keep your prices for that purpose, and we will not build such a thing. Your prices are used for your own planning and your own reporting, and for nothing else. Nothing from Cortex, including messages, photographs and voice notes, is ever pooled.

Data Storage and Security

Your data is stored securely using Amazon Web Services (AWS) infrastructure, including encrypted databases and storage.

Third-Party Services

We use Meta (WhatsApp Business Platform) for messaging, Anthropic for the language models Cortex uses to read messages and Synapse uses to read documents, Amazon Web Services for storage and processing, Stripe for payments, and Resend for account email. Statistics about a supplier's performance, as described under Pooled Data, are shown to that supplier. Your data goes to no other third party.

Data Retention

We keep what you send us until you ask us to delete it, including after you stop using the products. That covers Cortex message data, account records, the Synapse work saved from the portal - your product list, your sales history and your plans - and the deliveries you record and documents you photograph. The portal has a control that deletes everything the order planner has saved, and you can ask us to delete anything else at any time. We keep the fifty most recent plans per person. Data sent to the Synapse API for a plan is not stored after the plan is returned. The supplier performance records described under Pooled Data are kept after your identity is removed from them.

If you close your account, or ask us to delete your data, we delete your account, your organization's data, your delivery records and your documents within thirty days. The supplier performance records you contributed are not deleted. Your identity is removed from them instead: the identifier linking them to your organization is replaced with a random value, and we keep no copy of the mapping, so neither we nor anyone else can link those records back to you afterwards. They remain because other customers' order plans depend on how reliable a supplier has been, and once your identity is removed they say nothing about you. Records of the deletion itself, our backups until they expire on their own schedule, and our payment provider's own billing records are the exceptions.

Your Rights

You may request access to, correction of, or deletion of your personal data at any time by contacting us at info@loboslabs.ai. Deletion reaches everything we hold about you and your organization, including your prices, your product list, your documents, your sales history and your delivery records. It does not reach the supplier performance records you contributed, which are stripped of your identity as described under Data Retention rather than deleted.

Changes to This Policy

We may update this policy from time to time by posting the updated version on this page.

Contact Us

Questions? Contact us at info@loboslabs.ai.