Privacy Policy — RFQ Trace

Last updated: August 8, 2026

1. Who We Are

RFQ Trace is a product of Mishhy ("we", "us", "our"). We operate the website rfqtrace.com and the application at rfqtrace.com. If you have questions about this policy, contact us at info (at) mishhy.com.

2. What Information We Collect

We collect the following information when you use RFQ Trace:

• Account information: your name, work email address when you sign up.
• Password: We never see or store your password. Your login details are transmitted securely and instantly handled by Google (Firebase Authentication), a world leader in cloud security.
• Organization information: company name, industry, and size you provide during onboarding.
• Usage data: RFQs, supplier records, quotes, and other data you create inside the app.
• Technical data: IP address, browser type, device type, and pages visited — collected automatically via logs.

We do not collect payment information directly. If we add paid plans in the future, payments will be processed by a third-party provider (e.g., Stripe) under their own privacy policy.

3. How We Use Your Information

• To provide, operate, and maintain RFQ Trace
• To send you account-related emails (login confirmation, password reset)
• To respond to your support requests
• To improve the product based on usage patterns
• To contact you about your pilot program participation

We do not sell your data. We do not use your data for advertising purposes.

4. How We Store Your Data

Your data is stored using Firebase (Google Cloud infrastructure) with servers located in the United States. Data is encrypted in transit (HTTPS/TLS) and at rest. We use Firebase Authentication to manage login credentials securely.

Local caching of your data may occur in your browser using IndexedDB (via Dexie.js) to enable faster load times. This data stays on your device and is cleared when you log out.

5. Who We Share Your Data With

We share data only with the following service providers, each used for the purpose listed:

• Google Cloud / Firebase: authentication, database, file storage, and the server functions that send our email. Data is stored in the United States.
• Vercel: application hosting and deployment
• Google Analytics and Google Ads: website measurement and advertising measurement
• Mailgun: delivery of our outreach email, and reporting on delivery, bounces and unsubscribes
• Brevo: delivery of account email sent from rfqtrace.com — verification codes, invitations, notifications
• Loom: demo video hosting

We do not sell personal data, and we do not share it with data brokers. We do use Google's advertising products as described in the next section.

6. Cookies, Analytics and Advertising

We use cookies that are necessary for authentication — without them you cannot stay logged in.

We also load Google Analytics 4 and a Google Ads tag on our public website. These set their own cookies and collect information about your device, approximate location, and the pages you view, and they are used to measure how our advertising performs. They are not loaded on localhost or for automated browsers, and we do not load them inside the application when you are signed in on a self-hosted page.

You can block these with browser settings, an ad blocker, or Google's own opt-out tools. Blocking them does not affect your ability to use RFQ Trace, though blocking all cookies will prevent you logging in.

7. If We Emailed You And You Are Not a Customer

We send introductory emails to businesses we believe may have a use for RFQ Trace. If that is how you found this page, here is exactly what we hold and what you can do about it.

• What we hold: business contact details — usually a work email address, company name, website, and sometimes a contact name. We do not hold personal information beyond what a business publishes about how to contact it.
• Where it came from: publicly available business sources, such as company websites and public business directories.
• Why we process it: our legitimate interest in telling relevant businesses about a product built for them. We balance that against your interests, which is why the emails are infrequent, stop on request, and always identify who sent them.

To stop hearing from us, use the unsubscribe link in any email, or simply reply with the word STOP. Both are handled automatically and take effect immediately — no reply needed and no further messages will be sent.

When you unsubscribe we keep a record of your address specifically so that we never contact it again. If you would rather we erased it entirely, email us at info (at) mishhy.com and we will fulfill your request promptly. Be aware that erasing the address entirely means we have no record of your preference, which could lead to us finding your business again in a future research batch.

8. Security Architecture & Compliance Certifications

RFQ Trace is designed with robust security controls tailored to small and medium-sized manufacturing teams. Because we inherit enterprise-grade security by building exclusively on top of top-tier cloud providers (Google Cloud and Vercel), we maintain rigorous internal security standards.

Due to our current focus on serving smaller teams and mid-market organizations, we do not maintain standalone SOC 2 or ISO 27001 audit badges. This allows us to avoid redundant administrative costs and pass those savings directly to our customers through highly competitive pricing.

Custom Enterprise Requirements: We recognize that larger organizations or defense-adjacent manufacturing partners may strictly require formal external audits to clear internal procurement processes. If your organization requires a SOC 2 Type II or related framework certification to deploy RFQ Trace at scale, we are fully prepared to initiate and undergo the audit process. Please reach out to us at info (at) mishhy.com to discuss enterprise agreements and compliance roadmaps.

9. Links to Other Websites

Our service may contain links to external sites not operated by us. If you click a third-party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy and terms of every site you visit, as we have no control over and assume no responsibility for their content or practices.

10. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date at the top of this policy. You are advised to review this Privacy Policy periodically for any changes.

11. Contact Us

If you have any questions or suggestions about our Privacy Policy, do not hesitate to contact us at info (at) mishhy.com.