Privacy Policy

Last updated: October 10, 2026

Tevley provides a business-to-business workspace for supplier evidence and human-reviewed AI screening. This notice explains how we handle personal information and trade data in connection with that service. Contact our service operator at info@tevley.com for privacy questions.

1. Information we process

We process account names, business email addresses, company details, team roles, authentication and session information, subscription information, supplier contacts, invitation records, and service activity. Our workspace also processes supplier PDFs, trade and supply-chain data, document metadata, AI findings, corrections, and audit history submitted or generated through the service.

Trade documents may contain personal or confidential information. Customers must have a lawful basis and appropriate authority to submit that information and to invite suppliers or team members. Do not submit unnecessary sensitive personal information or information you are not permitted to disclose.

2. Purposes and customer responsibilities

We use information to provide and secure the workspace, manage purchaser-specific access, retain and analyze evidence, send requested invitations and reminders, administer billing, investigate misuse, respond to support requests, and meet applicable legal obligations.

Where applicable, customers determine the purposes of processing personal information within their submitted evidence and Tevley processes it to provide the service on their instructions. Tevley administers account, security, and business-operation information for its own service purposes. An executed data-processing or enterprise agreement governs where it applies.

Customers are responsible for notices to their employees and suppliers, lawful instructions, the accuracy of submitted information, and their own regulatory reporting and recordkeeping obligations.

3. Encryption and access controls

Sensitive document metadata is protected using AES-256-GCM application-level encryption with a server-managed encryption key. The key is not included in public pages or client-side application code. Access to workspace information is scoped to the authenticated company, user permissions, and purchaser-specific supplier links.

Original PDF evidence is retained unredacted in private storage and accessed through authorization checks. The metadata encryption key does not mean every database field or original PDF is encrypted by that application-level mechanism. Public production traffic uses HTTPS, and account credentials and sessions receive the service's authentication protections.

No security measure can eliminate all risk. Customers must protect their accounts and invitation links, manage team access, and notify us of suspected unauthorized access. We do not represent that these controls constitute a particular security certification.

4. Service providers and AI processing

We use hosting and database/storage providers including Replit and Supabase, Anthropic (currently Claude Sonnet 5.5) for primary AI screening and text-risk simulation, OpenAI (currently GPT-6 Sol) for purchaser-requested replacement-document comparison and correction-request review, Resend for configured email delivery, and Stripe for payment processing. Historical reviews may record earlier models; changing a model does not rewrite those reviews. A replacement comparison is optional and sends both selected original PDFs, supplier/requirement context, and the purchaser's review instructions to OpenAI after an authorized reviewer expressly confirms sharing authority. It is not an automatic second screening of every upload.

Payment processing is handled by Stripe; do not upload payment-card information into supplier evidence. We do not sell customer evidence. We may also disclose information when legally required, to protect the service and its users, or in a business transfer subject to applicable safeguards.

Providers may process information in countries other than your own. Applicable contractual safeguards and legal requirements must be assessed for your organization; this notice does not promise a particular data-residency region or provider retention or AI-training policy.

5. Retention and deletion

We retain account and workspace information for service delivery, audit continuity, security, dispute resolution, and applicable legal or contractual retention requirements. Original findings and evidence are preserved alongside corrections and saved comparison attempts. Replacement comparisons are dated review suggestions, not current-status certifications, and do not rewrite original findings or purchaser acceptance; retirement of a record does not automatically delete it or rewrite its historical findings.

Contact us to request an account closure, export, or deletion review. Requests are subject to your authority, your organization's instructions, legitimate retention obligations, and applicable law. Backup and provider retention cycles can delay physical removal; we do not promise immediate erasure of every historical copy.

6. Cookies and privacy requests

The service uses session cookies needed for authentication and account security. This notice does not authorize unrelated advertising trackers. Browser cookie controls may affect your ability to sign in.

Depending on applicable law, you may have rights to access, correct, delete, restrict, or object to processing, or receive a portable copy of information. Contact info@tevley.com; we may verify your identity and authority before responding. For employer-controlled workspace information, contact your organization's administrator first. You may also contact the relevant privacy regulator where permitted by law.

7. Audience and changes

The service is intended for authorized business users, not children. If you believe inappropriate personal information has been submitted, contact us.

We may update this notice as the service or legal requirements change and will identify the updated date. Material changes will be communicated as required by applicable law or contract.