Privacy Policy
What we collect, why we collect it, and what you can do about it.
1. What we collect
Account data
Email, name (first + last), phone (E.164-normalized, optional), organization name + role. Stored in auth.users + profiles + organization_members.
Listing + transaction data
Slabs, remnants, lots, dimensions, photos, status history, inquiries, quotes, comments, watchers. The audit trail.
Comms data
Comments + mentions on slab/project/inquiry/inventory threads. Notification records. Notification preferences (per-kind, quiet hours). Heartbeat timestamps from user_sessions.
Voice data (HE.A.03.1)
When you use the warehouse-floor voice mic on /fabricator/inventory: audio is streamed to Cartesia for transcription, transcript is sent to Anthropic for intent classification, both are logged to voice_events for debugging (90-day retention). Audio is never persisted by Honed Earth. Cartesia’s data-handling: see their privacy policy.
2. Why we collect it
- To run your account + listings + inquiries.
- To audit-log every change (listing edits, status moves, comment posts).
- To send notifications you opted into (mentions, replies, status changes, digests).
- To debug platform issues (voice events, error logs, request traces).
3. What we don’t do
- We don’t sell your data to third parties.
- We don’t share supplier-side pricing with public surfaces.
- We don’t use your business data for advertising on the platform.
- We don’t train AI models on your private listings or comments.
4. Who can see what
Public surfaces (anyone)
The /slab/[id] page renders publicly only when the supplier’s organization has flipped marketplace_listed = true. The page shows: stone type, finish, dimensions, lot, supplier name + city, list date, photos. No prices, no contact info.
Your organization (members)
Your org’s listings, projects, inquiries, comments, voice events. RLS enforces this via current_user_orgs().
Sysadmin + compliance officers
Read access to all data for platform administration + compliance reviews. Every admin read writes a row to the access log. Sysadmins are listed in the Honed Earth team page.
5. Email + notifications
See our notification preferences page. You can disable email per-kind (mentions, replies, status changes, digests), set quiet hours, or unsubscribe entirely. Every email includes a one-click RFC 8058 List-Unsubscribe header. Unsubscribe URLs are HS256-signed JWTs.
6. Data retention
- Audit trail (status history, slab photos, comments): retained for the lifetime of the platform plus seven years.
- Voice events: 90 days.
- Notification records: 1 year.
- User sessions / heartbeat: 30 days.
- Soft-deleted accounts: redacted within 30 days; the audit trail keeps the org_id but redacts the user identity.
7. Your rights
- Access — request a copy of your data via privacy@honedearth.com.
- Correction — edit profile, organization, listings inline; or email to fix.
- Deletion — delete your account from /profile. The org keeps the audit trail; your user identity is redacted.
- Portability — listings, comments, and trail data are exportable as JSON / CSV on request.
- Opt-out of data sharing — see data-sharing opt-out.
8. Cookies + tracking
Honed Earth uses functional cookies (auth session, theme preference) only. We don’t use third-party tracking pixels. Web analytics: anonymized, server-side only.
9. Children’s data
Honed Earth is a B2B platform; we do not knowingly collect data from anyone under 18.
10. Changes to this policy
We’ll email all active accounts at least 30 days before any material change.
Questions: privacy@honedearth.com.