Drillbit procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | unknown | “As a business operating out of Austin, Texas, we are not currently subject to specific legal frameworks or regulations like GDPR or CCPA. Your data is stored within supabase and is SOC2 compliant. ” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “We retain personal information as long as necessary for our business purposes or as required by law. We will retain your information for as long as your account is active or as needed to provide you services. We will retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. ” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “If you choose to use our application features that connect with Google services, we adhere to the Google API Services User Data Policy. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. This means:” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “Our app may contain links to third-party websites. We are not responsible for the privacy practices of these external sites. ” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “b) We do not transfer this data to third parties except with your explicit consent, for security purposes, to comply with laws, or as part of a merger/acquisition (with prior consent).” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “We currently do not share personal data with third parties except as explicitly described in this policy. Any future changes to this practice will be reflected in updates to this policy. No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties ” | Captured 2026-07-20Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.