Privacy Policy
Last updated: May 2026
This policy explains what data NAND Solutions collects, why we collect it, and how we use it. We've written it plainly because we think that's the right way to handle information about your business.
What data we collect
Account data: When you sign up, we collect your name, email address, company name, and billing information (processed by Stripe; we never see your full card number).
Inventory and operations data: The core of what you store in the IMS — lot numbers, quantities, locations, transactions, vendors. This is your data. We process it to run the service and never use it for any other purpose.
Usage data: We collect logs of how the application is used (page visits, feature interactions, errors) to improve reliability and performance. These logs are never sold or shared with third parties.
Support communications: If you contact us, we keep records of that conversation to follow up and improve our support.
Website analytics: We use privacy-respecting analytics (no third-party ad tracking, no fingerprinting) to understand how people use our marketing site.
How we use it
We use account data to provide and bill for the service. We use inventory data to run the IMS — full stop. We use usage data to fix bugs, improve performance, and prioritize features. We use support communications to help you.
We do not sell data. We do not use your inventory data to train machine learning models. We do not share your data with advertisers.
Third-party processors
We rely on a small number of sub-processors to run the service. The current list is maintained at /trust/sub-processors. Key processors include:
- Stripe — payment processing
- Supabase / AWS — database hosting and infrastructure
- Resend — transactional email
- Vercel — application hosting
All sub-processors are contractually bound to process your data only for the purposes we specify.
Data retention
We retain your account and inventory data for the duration of your subscription, plus 90 days after termination (to allow re-activation). After the 90-day window, we permanently delete your data from production systems. Encrypted backups are rotated on a 30-day cycle. If you request deletion before the window expires, we'll act within 30 days.
Your rights
You have the right to access, correct, export, and delete your data. You can exercise most of these rights directly in the IMS admin portal. For anything you can't do yourself — or if you're under GDPR jurisdiction — email us at privacy@nandsolutions.com. We'll respond within 30 days.
If you're in the EU or UK, you can also lodge a complaint with your local supervisory authority, though we'd prefer you contact us first so we can fix whatever went wrong.
Contact
Questions about this policy? Email privacy@nandsolutions.com. We're a small team and we read every email.