Submitted requests
We store the request type, contact name, work email and submitted fields so a reviewer can respond. Supplier claims also contain the authenticated account ID, stated role and authority evidence needed for verification.
Critical Supply Brief
Brief and supplier-update forms send your work email to Beehiiv so we can deliver the twice-weekly note and confirmation message. We do not store those addresses in the public directory, and a subscription never changes ranking, verification or endorsement.
Supplier accounts and billing
WorkOS provides authentication and organisation access. Stripe hosts checkout and billing management; Critical Supply stores billing-status identifiers, not card or bank details.
Site activity
We use cookie-free aggregate analytics for broad site activity. We do not send search terms, form contents, IP addresses, user IDs or private console paths.
Bot protection
Site forms use Cloudflare Turnstile, which runs an invisible check in your browser to confirm a person is submitting. Cloudflare processes browser and device signals for that check under its Turnstile Privacy Addendum. We use only the pass or fail result.
Retention
New submissions, aggregate activity rollups and minimal Stripe webhook markers are retained for up to 90 days. Stale pending or rejected claims and drafts are deleted after 180 days. Brief subscription records follow Beehiiv’s retention until you unsubscribe.
Access and disclosure
Private access is limited to authorised operators and approved supplier users. Submissions and drafts are not published automatically and are not sold.
Your request
Use the correction form and reference your ticket or workspace to request access, correction or deletion. Use the confirmation email or Beehiiv unsubscribe link to leave the Brief.