Legal
Privacy Policy
Draft — requires legal review before this is a binding policy
The sections below describe what RegMend actually does today, factually. The legal entity name, registered address, governing jurisdiction, and formal data-subject-rights process have not been finalized and are marked below — do not treat this page as complete legal wording until those are filled in by counsel.
Who this covers
This policy covers RegMend, an early-stage B2B pilot product for EUDR regulatory exception remediation. The formal legal entity name and registered business address have not yet been established and will be published here once they are.
What we collect
From a prospective pilot: the information submitted through our pilot request form (name, work email, company, role, commodity, and any optional details provided).
From an activated customer account: the profile information created when your organization invites you (name, work email), and the supply-chain exception data your organization uploads for remediation (source records, supplier/producer information, geolocation data, evidence documents, correspondence with suppliers through the platform).
Where data is stored
Production data — the database, authentication records, and uploaded evidence files — is hosted by Supabase in the ap-northeast-2 (Seoul, South Korea) region. See Subprocessors for the full list of services involved in processing your data.
How data is protected
Tenant-isolated access enforced at the database layer, private (non-public) file storage for uploaded evidence, immutable original-data snapshots, an audit trail of case activity, and automated off-site encrypted backups with a tested recovery process. See Security for details.
Data retention
Pilot request submissions that do not convert to a customer relationship are retained for internal review purposes. We have not yet defined a formal, published deletion schedule for these — if you’d like a submission removed at any time, ask us via the form you submitted it through or by replying to any email we’ve sent you, and we will delete it. Backups of active customer data are retained on a rolling 7-day basis.
Your rights / requests
A formal, published data-subject-request process has not been established yet. Until it is, the way to reach us is through the pilot or case submission forms — note that your message is a privacy request, and we will handle it directly. Activated customers can also reach us through their organization’s point of contact with RegMend.