Who operates SupplyNerve

SupplyNerve is a private product build operated by CPH Solutions LLC. Questions or privacy requests may be sent to cphsolutionsllc@gmail.com.

Information we process

When Google sign-in is enabled, we request only the OpenID Connect, email, and basic profile permissions. Google provides an account identifier, name, email address, email-verification status, and authentication evidence. We use these to match the Google account to a previously approved SupplyNerve operator and check whether the sign-in meets our security requirements. We do not request or read Gmail, Drive, contacts, or calendar content. Sign-in is not active in the current private build.

When activated, SupplyNerve will record the minimum identity, approval, membership, session, and security-event evidence needed to issue, rotate, revoke, and investigate access. The browser receives a signed, HttpOnly session cookie; authorization is checked on the server against current approval and membership, not inferred from the cookie alone.

The current product workspace uses synthetic operational records. It is not authorized to receive real customer, regulated, payment, traceability, or design-partner data.

How information is used

Authenticate an approved operator and maintain a session.
Enforce organization, facility, and capability boundaries.
Prevent abuse and investigate security events.
Respond to access and privacy requests.

We do not sell personal information, use Google account data for advertising, train generalized AI models with it, or use it for credit or lending decisions. Product feedback may improve the private build, but Google sign-in data is not used to profile buyers or suppliers.

Google API data and Limited Use

SupplyNerve's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Google account data is used only to provide and secure the sign-in functionality the operator requests.

Service providers and disclosure

Google performs account authentication and Vercel hosts the site. When approved sign-in is activated, an approved database provider will store the limited identity and session evidence described above. These providers receive only the information needed for their service roles. We may also disclose information when required by law or necessary to protect the service and its users. We do not sell or disclose Google account data to advertisers, data brokers, or unrelated partners.

Retention, security, and deletion

The current build does not create Google sign-in records. Before sign-in is activated, our operating policy requires an eight-hour maximum application session, deletion of expired or revoked session records after 30 days, retention of revoked access-binding evidence for 30 days, and retention of authentication and authorization security events for 180 days. Current access records are kept only while needed for access, security, or applicable legal obligations.

We use HTTPS, signed HttpOnly cookies, server-side authorization, restricted operator access, and a separate private-build gate. Session records are designed to be revocable, and signing secrets are kept outside source code. No online service can promise absolute security.

To access, correct, or request deletion of your SupplyNerve account information, email the address above. We will remove information that is no longer needed, subject to the limited security, legal, and audit duties described here.

Changes and age limits

SupplyNerve is for authorized business operators and is not directed to children. Material policy changes will be posted here with a new effective date before expanded data use begins.