01Information we collect
We collect only what we need to run the intelligence layer and managed programs:
- Account information: name, work email, company, role -- collected when you submit any form on the site (Atlas waitlist, briefing request, scoping conversation, vendor claim, or any other intake form).
- Vendor records: business names, addresses, phone numbers, capability tags, and verification documentation. Enhanced-tier vendor records additionally include the four-marker compliance packet (active Certificate of Insurance authenticated with the carrier, 3+ years operating history under the same legal entity, clean dispute record over the trailing 12 months, and the 15-minute onboarding call where capability detail is captured). The packet is held in PS's audit trail and is not displayed on public listings -- buyers see the Enhanced badge plus last-verified date only.
- Operational data: on managed-programs engagements, we collect order, BOL, POD, and invoicing data necessary to run the engagement.
- Usage telemetry: aggregated, non-identifying request data used to maintain service quality. We do not run third-party advertising trackers on the site.
- Tuesday Read subscriber data: email address only. Used only to send the newsletter and never sold or shared.
- Atlas waitlist signup data: email address, optional ZIP code (Atlas Brief subscribers, used to compute their PADD region for regional briefing tuning at launch), optional DC count estimate (Atlas+ subscribers), and an "interest" tag indicating which tier (Brief, Atlas+, or either) they're waiting for. We also record an IP address briefly to throttle abusive form submissions; IPs are not retained beyond rate-limit lookups.
02How we use information
- To run the Vendor Network, Market Pulse, Atlas+, and managed-programs services.
- To respond to briefing requests, scoping conversations, and security-questionnaire requests.
- To compute aggregated, anonymized benchmarks (PSCI, PSPI, regional demand signals) used in published intelligence -- never with identifying detail.
- To send transactional email (order confirmations, alerts, the Tuesday Read for subscribers).
- To send Atlas waitlist subscribers occasional product progress updates and the launch announcements for the tier they signed up for. Cadence is light during the pre-launch period (not constant), and every email carries a one-click unsubscribe link.
- To compute aggregate signup patterns (e.g. "60% of Brief subscribers are in PADD 2") for product development -- aggregate only, never tied to identifying information.
We never sell, rent, lease, or share personal information with third parties for marketing purposes. Subprocessors listed in Section 03 operate under contract solely to deliver the service you signed up for.
03Data residency and processors
US-only primary data stores. We do not replicate Pallet Solutions data outside US regions. Subprocessors used to operate the service:
- Netlify -- hosting and serverless functions.
- Supabase -- application database (PSOMS).
- Airtable -- vendor and operational records.
- Resend -- transactional email delivery.
- Jotform -- claim, report-a-listing, and managed-quote intake forms.
Each subprocessor is bound by a Data Processing Addendum or equivalent agreement. The current subprocessor list is provided to Atlas+ and managed-programs customers at onboarding under NDA.
04Anonymization rules (the wall)
Pallet Solutions runs both a published-intelligence layer (the Tuesday Read on Market Pulse, the Vendor Network, and Atlas) and a managed-programs book. To prevent the conflict of interest implied by that structure, we apply the following rules:
- Buyer-side benchmarks are anonymized. When buyer transactions feed market benchmarks, identifying detail is stripped before the benchmark is computed or published.
- Vendor-side demand signals are anonymized. Regional demand signals exposed to vendors do not name the buyer behind them.
- Database isolation. The role that computes PSCI/PSPI has no grants on managed-programs operational data. Information flow is blocked at the role level.
- No PII in published intelligence. PSCI, PSPI, and Market Pulse are aggregate federal data and B2B identifiers only. Personally identifying information is never included in published values.
05Cookies and tracking
We use a minimal set of first-party cookies and localStorage entries to remember user preferences (e.g., selected vendor radius, region override on the Pulse tile). We do not run third-party advertising trackers. A full cookie inventory and retention schedule is maintained internally and provided to procurement audit teams on request.
06Your rights
Subject to applicable law, you may request:
- A copy of personal information we hold about you.
- Correction of inaccuracies in that information.
- Deletion of personal information, where lawful and operationally feasible (some records, such as those required for managed-programs invoicing, are retained per applicable record-keeping requirements).
- An opt-out from non-transactional communications.
Requests should be sent to robert.gregg@palletsolutionsusa.com. We respond within timelines required by applicable law.
07Children
Pallet Solutions is a B2B service. We do not knowingly collect personal information from children, and we have no consumer-facing surfaces directed to minors.
08Changes to this policy
Material changes are versioned and disclosed on this page with the effective date. Subscribers and customers are notified of material changes by email. Non-material edits (typo corrections, link updates) do not trigger a versioned notice.
09Contact
All privacy and security inquiries: robert.gregg@palletsolutionsusa.com.