The minimum we need to run a shop-management product: account info (name, email), shop data you choose to enter (customers, suppliers, jobs, inventory, time entries, drawings), and basic operational logs needed to deliver and secure the service.
What we don’t do
No advertising or ad networks.
No selling, renting, or trading personal information.
No training AI models on your shop’s data.
No public URLs for your uploaded files — access is via signed URLs.
Analytics and product improvement
We use analytics only to understand where the website or product is confusing, slow, or failing to help users complete a workflow. If you allow optional browser analytics, Google Analytics measures activity on public and sign-in pages, while PostHog measures product usage and associates signed-in events with your account and shop. Browser session recording is disabled. We never sell this data, use it for advertising, or share it with data brokers.
Whether or not you allow optional browser analytics, we keep essential operational logs and a limited set of server-side account milestones — such as whether shop setup or onboarding steps were completed — so we can operate the service, provide support, and understand where onboarding fails.
You can change your optional browser analytics choice at any time.
Sub-processors
We use a small set of vendors to deliver and improve the service: Supabase (database, auth, file storage), Vercel (hosting and edge analytics), Resend (transactional email), Anthropic (AI document extraction, only on files you submit), Google Analytics (optional website measurement), and PostHog (product analytics and limited server-side account milestones). We do not share data beyond what these vendors require for those purposes, and we never sell it.
AI document ingest
When you upload a supplier document for AI extraction, the file is sent to Anthropic to read. Anthropic does not train on data submitted via the API. You can opt out of AI ingest by simply not using it — the rest of the product works without it.
Your rights
You can export, correct, or delete your shop data at any time. Email info@metalshophq.com and we’ll handle it within a few business days.
Jurisdiction
MetalShopHQ is operated from British Columbia, Canada, and handles personal information in line with PIPEDA and provincial equivalents. If your shop is based outside Canada, you consent to your data being processed in Canada.
Changes
We’ll update this page when our practices change. Material changes will be announced in-app before they take effect.
