Privacy
What is stored, where it goes, and what is missing.
This describes how the alpha actually behaves today. It is a plain description of the system rather than a legal privacy policy, and it will change as the product does.
Do not enter sensitive personal data during alpha
Do not enter adopter or client contact details, medical records, staff personal information, or anything else you would not be comfortable having stored in an alpha system and processed by a third-party model or embedding provider. Describe workflows in general terms, and prefer documents that do not contain personal data.
What is stored
Account: the email address you sign in with, handled by Supabase Auth. Passwords are managed by Supabase and are never stored by this application.
Organizations and memberships: which organization you belong to. Application data is scoped by organization membership, not by a single-user account boundary alone. Creator identity is still recorded as metadata on rows you create.
Shelter assessments: the twelve form answers you submit, the generated draft, and metadata about the run.
Organization AI Opportunity Discovery reports: the organization context you submit, the selected document set for the run, the generated report, an evidence snapshot of the excerpts used, and related run metadata.
Documents: the uploaded file in private object storage, plus filename, type, size, processing status, extracted text, chunks derived from that text, and embedding vectors for retrieval.
Telemetry (`ai_runs`): workflow and version labels, provider and model identifiers, token and latency figures, status and error codes, digests, guardrail outcomes, and retrieval diagnostics where applicable. Feedback: whether a result was helpful, an optional short comment, and linkage to the result and run.
Who can see it
Database access for assessments, reports, documents, chunks, telemetry, and feedback is constrained by row-level security using organization membership. Members of the same organization can read that organization’s application data in the product.
Original file binaries in object storage are still path-scoped to the uploading user’s id. Another organization member can read document metadata, extracted text, and chunks used for retrieval, but cannot download another member’s original binary through Storage today.
Multi-organization switching and administration are still limited. Organization Discovery derives the report's organization from the selected documents and rejects a selection that spans organizations.
The operator of this deployment has administrative access to the underlying Supabase project, as with any hosted application. Treat that the way you would treat any vendor with database access.
Nothing is sold, and there is no advertising, profiling, or third-party analytics in this application.
Where your text goes
Shelter AI Assessment: the form text you submit is sent from this application’s server to the configured model provider (currently Google’s Gemini API) to generate the structured assessment. Your browser never contacts the provider, and provider credentials never reach the browser.
Organization AI Opportunity Discovery: after upload, extracted document chunk text is sent server-side to the configured embedding provider (currently Google’s Gemini embedding API) so chunks can be indexed for retrieval. At report time, your submitted organization context plus the retrieved document excerpts used as evidence are sent server-side to the configured generation model. Documents you did not select for that run are not included in retrieval or generation for that run.
That means assessment input, embedding input, and generation evidence are processed by Google under Google’s terms for those APIs. If your content must not leave your own infrastructure, do not enter or upload it here.
Cookies
The application uses Supabase session cookies to keep you signed in. It does not intentionally use analytics or advertising cookies.
What is not in place yet
These are real gaps, listed because their absence is more useful to you than a vague assurance.
- There is no in-product way to delete a Shelter assessment, a document, an Organization report, or your account yet, even where the database would allow some of those deletions.
- There is no data export.
- There is no defined retention period. Data persists until it is removed manually by the operator.
- There is no audit log of administrative access.
- There is no signed data processing agreement, and this deployment has not been assessed for GDPR, HIPAA, SOC 2, or any comparable framework.
Human oversight
The Workbench does not take actions on your behalf. It does not contact anyone, change any record outside itself, or integrate with your systems. It produces a draft that a person reads, questions, and decides what to do with. It is labelled as a draft, with assumptions and, for Organization Discovery, evidence basis and citations where the run produced them.
Related reading: limitations and how it works.