Version: V3 — Last updated: September 17, 2026
The processing of users' personal data is carried out by BuyrBox SAS, a SAS company with a capital of 15,000 euros, registered with the RCS of Nice under number 987 962 982, with its registered office at 21 avenue Caravadossi, France. For any questions or requests regarding personal data, you can contact us at: support@supply-finder.com.
BuyrBox has appointed a Data Protection Officer (DPO). For any questions related to personal data, you can contact our DPO at: dpo@supply-finder.com.
In the context of using the Supply Finder platform, BuyrBox collects the following data:
The data is collected and processed for the following purposes:
The processing activities carried out by BuyrBox are based on the following legal grounds:
The data collected is exclusively intended for BuyrBox. It may be processed by the following technical service providers acting as subcontractors:
| Subcontractor | Purpose | Data Processed | Location/Guarantees |
|---|---|---|---|
| HubSpot | CRM, customer support | User contact details, interaction history | EU-hosted, SCCs for transfers |
| Amplitude | Product analytics and session replay | Usage statistics, behavioral data, session recordings, email address | EU-hosted (serverZone: EU configured) |
| OpenAI | Analysis of user briefings | Text entered in designated input fields | US, SCCs and API terms limit data use |
| Anthropic (Claude) | AI assistant access to the platform via the Supply Finder MCP connector, at the user's initiative | Campaign, deal, and site list data the user asks about in their Claude conversation | US, SCCs and API terms limit data use |
| Clerk | User authentication and account login | Name, email address, authentication credentials and session data | US, SCCs for transfers |
| Slack | Internal notification of platform usage | User identifier, feature/tool used | US, SCCs for transfers |
| Stripe | Payment processing | Payment details | US, SCCs and PCI DSS compliance |
| Mailchimp | Onboarding and transactional emails | Email address, user preferences | US, SCCs and EU-US Data Privacy Framework |
| Zapier | Workflow automation | Data necessary for integration between tools | US, SCCs and security certifications |
| MongoDB | Primary application database hosting | Account, campaign, deal, and site list data | EU-hosted (MongoDB Atlas) |
| LangSmith | Tracing and monitoring of AI/LLM feature calls | Prompts, model outputs, and related metadata from AI feature usage | US, SCCs for transfers |
These providers are contractually bound to strict confidentiality and security obligations. For providers outside the EU, Standard Contractual Clauses (SCCs) validated by the European Commission are implemented.
Supply Finder uses Amplitude to analyze platform usage and improve user experience. This solution includes a session replay feature that captures user interactions with the interface.
Data collected via Amplitude includes:
Session recordings are used solely to identify usability issues, fix bugs, and improve the interface. Sensitive data (passwords, payment information) is automatically masked. Recordings are retained for a maximum of 90 days.
All Amplitude data is hosted in the European Union (serverZone: EU configuration) and is GDPR compliant.
Supply Finder uses OpenAI's API to assist users in formulating or analyzing their needs. The data sent to the API is:
Supply Finder offers an MCP (Model Context Protocol) connector that lets a user access the platform's site list and campaign reporting tools from within Claude, Anthropic's AI assistant. This connector is opt-in: it is only active if and when a user chooses to connect it from their Claude account.
Once connected, the data sent to Anthropic is:
Authentication for the connector uses the user's existing Supply Finder account; no additional personal data is collected for this purpose beyond what is described elsewhere in this policy. Users can disconnect the connector at any time from their Claude account settings.
Supply Finder uses YouTube API Services to retrieve public channel and video data for use within the platform. By using features powered by YouTube API Services, users acknowledge that they are also bound by:
YouTube API data displayed within the platform is refreshed at minimum every 30 days and is never stored beyond that period, in accordance with the YouTube API Services Developer Policies. Users may revoke Supply Finder's access to YouTube API data at any time via Google's security settings page: https://security.google.com/settings/security/permissions.
At the user's explicit request, BuyrBox may create or configure deals within SSP platforms via an integrated API. BuyrBox acts as a technical processor, in accordance with the user's explicit instructions. No independent recording or secondary use of deal data is carried out by BuyrBox.
Collected data is hosted on Fly.io and MongoDB, both operated from Paris, France data centers, whose infrastructure is compliant with GDPR. BuyrBox ensures that all technical partners meet security standards equivalent to those required by European legislation.
BuyrBox implements the following security measures:
In the event of a data breach, BuyrBox commits to notifying the competent supervisory authority (CNIL) within 72 hours and, where applicable, affected users without undue delay.
Under the GDPR, you have the following rights:
To exercise your rights, please contact us at: support@supply-finder.com. A response will be provided within 30 days.
Supply Finder uses:
You can manage your cookie preferences via our Cookie Banner.
This privacy policy may evolve. Significant changes will be communicated via email and a banner on the platform. Continued use of the service constitutes acceptance of the updated policy.
BuyrBox integrates data protection by design and by default in the development of all its features.