Privacy Policy

1. Information We Collect

Sunburst Ventures LLC ("Company," "we," "us," or "our") operates Suprly (the "Service"). This Privacy Policy describes how we collect, use, and protect your information.

Account information: When you create an account, we collect your name, email address, and password (hashed; we never see your plaintext password).

Health profile data: To generate personalized supplement recommendations, we collect information you provide about your health goals, age, sex, weight/height, dietary framework (e.g., vegan, omnivore), activity level, existing supplements, allergies, medications (optional), lab values (optional, Premium feature), and budget preferences.

Usage data: We collect information about how you interact with the Service — page views, feature usage, recommendation outcomes, check-in responses, and affiliate-link click events. This data may include IP address, browser type, device information, and referring URLs.

Cookies: We use cookies and similar technologies for authentication, preferences, and analytics. See Section 5.

2. How We Use Your Data

To personalize recommendations: Health profile data is used by our scoring engine to generate supplement recommendations tailored to your stated goals and biology.

To operate the Service: Account information is used for authentication, account management, billing (Premium), and customer support.

To improve the Service: Aggregated and anonymized usage data helps us understand which recommendations resonate, where users drop off, and how to refine our scoring algorithm.

To communicate with you: We send transactional emails (signup confirmation, password reset, check-in reminders) and, with your consent, occasional product updates. You can unsubscribe from non-transactional emails at any time.

We do not sell your personal information. We do not use your health profile data for advertising.

3. Data Storage

User data is stored in Supabase, a US-based managed PostgreSQL provider (data centers in the United States). All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Row-Level Security (RLS) policies enforce that you can only access your own data.

Account passwords are hashed using bcrypt and never stored in plaintext. We do not have access to recover lost passwords; only reset them via email-verified link.

4. Third Party Services

We use the following third-party services to operate the Service. Each has its own privacy policy governing how they handle your data:

Stripe (payment processing): Handles Premium subscription billing. Stripe receives your name, email, and payment method details. We never see or store your full credit card number. Privacy policy: stripe.com/privacy

PostHog (analytics): Collects anonymized usage events to improve the Service. IP addresses are anonymized. Privacy policy: posthog.com/privacy

Resend (transactional email): Sends signup confirmation, password reset, and check-in emails. Receives your email address. Privacy policy: resend.com/legal/privacy-policy

Sentry (error monitoring): Collects error reports including browser type and URL. Configured to scrub PII from error context. Privacy policy: sentry.io/privacy

Vercel (hosting): Hosts our application. Vercel may collect technical information for service operation. Privacy policy: vercel.com/legal/privacy-policy

5. Cookies

We use cookies for authentication (keeping you signed in), preferences (remembering filter selections), and analytics (PostHog). You can disable cookies in your browser settings, but this may prevent some Service features from working correctly.

6. Your Rights

You have the following rights regarding your personal information, regardless of where you reside:

Access: Request a copy of the personal data we hold about you.

Deletion: Request that we delete your account and associated personal data. You can delete your account directly in account settings, or by emailing legal@suprly.co.

Portability: Request your data in a machine-readable format (JSON or CSV).

Correction: Update or correct inaccurate personal information via your account settings.

Opt-out: Unsubscribe from marketing emails using the link in any such email.

If you are a California resident (CCPA) or EU/UK resident (GDPR), you have additional rights including the right to opt out of "sale" of personal information (note: we do not sell your data) and the right to lodge a complaint with a supervisory authority.

To exercise any of these rights, email legal@suprly.co.

7. Data Retention

We retain your personal information for as long as your account is active. If you delete your account, we will delete your personal information within 30 days, except where we are required to retain it for legal or accounting purposes (e.g., transaction records for tax reporting).

Anonymized aggregate data (which cannot identify you) may be retained indefinitely for analytics and Service improvement.

8. Children's Privacy

The Service is intended for users 18 years of age and older. We do not knowingly collect personal information from anyone under 18. If we discover that we have collected information from a user under 18, we will delete that information promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice within the Service. The "Last Updated" date at the top of this Policy reflects the most recent revision.

10. Contact

Questions about this Privacy Policy, your data, or your rights? Email legal@suprly.co.