Privacy Policy

1. Information We Collect

X-Ray Contractor ("we", "our", "the Service") collects and processes the following information when you use our platform:

• Account Information: Email address and password (stored via Supabase Auth) when you create an account.
• Company & Profile Data: Company name, industry, and settings you provide to configure your bid automation.
• Google Account Data (via OAuth): If you connect a Gmail / Google Workspace email account, we request access to read your email messages (gmail.readonly), send email on your behalf (gmail.send), and view your email address (userinfo.email). A refresh token is stored encrypted at rest to maintain access.
• Portal Credentials: Credentials you provide to access third-party bidding portals for automated bid retrieval.
• Usage Data: Task runs, scrape results, and billing events are logged for operational and audit purposes.

2. How We Use Your Information

We use your information solely to provide the Service:

• Automate bid discovery, retrieval, and response via connected accounts
• Send email notifications and bid responses through your connected Gmail
• Maintain and improve platform reliability and security
• Track usage for billing and tier management

3. Data Storage & Encryption

All sensitive credentials (OAuth tokens, portal login credentials, IMAP passwords) are encrypted at rest using AES-256-GCM via PostgreSQL pgcrypto. Encryption keys are environment-specific and never exposed to client-side code. OAuth token data is transmitted via short-lived encrypted cookies during the connection handshake.

Your data is hosted on Supabase (Canada Central region) and Vercel (global edge network). We do not store data outside these infrastructure providers.

4. Data Sharing

We do not sell your personal data. We do not share your data with third parties except:

• As required to operate the Service (Supabase, Vercel, GitHub Actions)
• When you explicitly authorize a connection to a third-party system (bidding portal, email)
• To comply with applicable law or valid legal process

5. Data Retention

We retain your account data and credentials for the duration of your active subscription. Upon account deletion, all associated data including OAuth tokens and credentials are permanently deleted within 30 days.

6. Your Rights

You may revoke Google OAuth access at any time viamyaccount.google.com/permissions. You may disconnect credentials and delete your account through the dashboard settings. For data access or deletion requests, contact us at privacy@elola.tech.

7. Security

We implement industry-standard security measures including encryption at rest, TLS in transit, CSRF protection on OAuth flows, and row-level security on all tenant data. However, no system is 100% secure — use at your own risk within your organization's risk tolerance.

8. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email or in-app notice.

9. Contact

Elola Technologies
Email: privacy@elola.tech
California, USA