Privacy Policy

PartPin is operated by Heron Networks LLC. Short version: the only personal information we ask for is a work email address. Most of what we hold is your business data — your catalog and the part numbers your customers search for — and we treat that as yours. We run no advertising, we sell nothing, and the list of parties we share with is three names long.

What we collect about you

• Email address — the only thing sign-up asks for. Stored lowercased, used to send your single-use sign-in link and to identify your workspace.
• Sign-in tokens — a single-use magic-link token valid 15 minutes, and a session token stored in a cookie so you stay signed in. Both expire.
• API keys — issued to your workspace, rotatable from the dashboard.

No password (there isn’t one), no name, no phone number. If you subscribe, your card details go straight to Stripe and never reach us. We keep only Stripe’s customer and subscription ids, your subscription status and its renewal date.

What we hold on your behalf

• Your catalog — SKUs, manufacturer part numbers, titles and aliases you upload, plus the normalized keys, trigrams and tokens we derive from them to make lookup fast.
• Your query log — every call to the resolve API: the raw query text, its normalized form, which tier answered, whether the match was asserted, and whether anything was returned at all. This is what powers your dashboard, your zero-result list, and usage metering.
• Confirmed aliases — when someone at your business confirms a previously-unresolved query, we record that mapping and who it belongs to, so the same query asserts next time.

A query your customer typed is normally just a part number, but a free-text search box can capture anything a person chooses to type. Treat the query log as potentially containing whatever your customers put into your search field, and tell them so in your own privacy notice.

The Zero-Results Autopsy scores a catalog and a list of failed searches that you paste in. It is computed and returned in the same request; the pasted catalog and queries are not written to the database.

Who we share with — the full list

• Cloudflare — hosting, the database holding everything above, and the visit counts described under “Cookies and analytics” below.
• Brevo — delivers PartPin’s email: the sign-in link, one setup reminder if your catalog is still empty a day after you sign up (with a one-click way to stop it), and receipts and payment-failed notices if you subscribe. Receives your address and the message.
• Stripe — the payment processor, and only if you subscribe. It receives your email address, your workspace id and the payment details you give it on its checkout page. Stripe handles the card itself under its own privacy policy.

That is the entire list. We do not sell data and we share it with nobody else.

Cookies and analytics

One functional session cookie, set when you sign in. There are no advertising or cross-site tracking cookies.

We count visits with Cloudflare Web Analytics. It sets no cookies, uses no local storage and does not fingerprint visitors. For each page view Cloudflare records the page address, the referring site, the browser, operating system and device type, and the country (worked out from the IP address, which is not kept for analytics). We see only totals, never an individual visitor. We use no Google Analytics, no advertising pixels and no cross-site trackers, so there is no cookie banner.

How long we keep it

Your catalog and aliases are kept while your workspace exists. Magic-link tokens expire in 15 minutes or on first use; sessions expire on their own. The query log is retained while your workspace exists because it is the dashboard — if you want a shorter retention window for it, ask and we will set one.

Getting it out, and getting it deleted

Delete account on your dashboard deletes your workspace and everything in it at once: API keys, catalog, aliases, query log, sessions and your email address. A deleted workspace stops being served within 60 seconds: its search answers “gone” and the stored catalog, shop line and activity log are erased, not archived. Any subscription is canceled first. Stripe keeps its own records of past payments, as the law requires it to.

Email hello@heronnetworks.net to receive your catalog and query log in a machine-readable form, to correct anything, or to have us do the deletion for you. We respond within 30 days.

If you are in the EU, the UK, or a US state with a privacy statute, you have rights of access, correction, deletion, portability and objection, and the right not to have your data sold — which we do not do. Where the data is about your own customers rather than about you, you are the controller and we act on your instructions.

Security

Every query is scoped to a workspace id, sign-in has no password to steal, and API keys are rotatable. We do not claim to be breach-proof; if a breach affects your data we will tell you what happened and what was in it.

Children

PartPin is a B2B tool and is not directed at children.

Changes

We will update this page and its effective date, and email workspace owners if the change is material. See also the Terms of Service.

Contact

Heron Networks LLC — hello@heronnetworks.net, business phone (703) 249-9248.