Privacy
Last updated Oct 31, 2026
What we store
SaveSame stores purchasing and account data in Cloudflare D1 so we can show exact-match supply comparisons. We do not want patient charts or PHI — do not upload them.
- Account: email, office name, a unique forward-token for inbound supplier mail, created/login timestamps.
- Imported line items (from CSV today): supplier SKU, product description, pack size, quantity, unit price, order number, and order date, linked to an import batch.
- Import batches: source kind (CSV upload, PDF upload, or forwarded email), original filename(s), and a short note — not the full file bytes.
- Match results (when matching has run): manufacturer, MPN, pack, prices compared, confidence, and related match fields.
- Sessions & magic links: hashed tokens and expiry so you can log in by email.
- Billing: subscription status and Stripe customer/subscription IDs only. Card numbers are handled by Stripe; we never store them.
- Transactional email: login links and billing notices are sent via Resend from notify.savesame.com.
- Hosting: site and Functions run on Cloudflare Pages; data in Cloudflare D1.
Uploads, PDFs, and forwarded emails (retention)
- CSV uploads: we parse the file in the request, write line items and a batch row (including the filename) to D1, and do not keep the raw CSV after the request finishes.
- PDF uploads: we accept the upload and record a batch row with the filename(s). PDF bytes are not stored in D1 (and are not written to object storage in the current build); they are discarded when the request ends. Parsing is designed to run as a separate batch job.
- Forwarded supplier emails: inbound ingest records a batch row (from, subject snippet, attachment names). Raw email bodies and attachment bytes are not retained in the current build (object storage for PDFs is planned later). Parsed line items, when written by a batch job, are kept in D1 like CSV imports.
- Public demo pages use labeled synthetic sample data, never a real office’s purchases.
- Gmail connect is coming soon and is not used for customers today.
How long we keep data
Account rows, line items, match results, batch metadata, sessions, and subscription status rows remain in D1 until you delete your data/account (below) or ask us to delete them. Magic-link and session hashes expire on their expiry timestamps. Stripe keeps its own payment records under Stripe’s policies.
How to delete your data
While logged in, open the Dashboard and use Delete my data & account. After you type DELETE to confirm, we cancel any active Stripe subscription immediately (when billing secrets are configured), then permanently remove this office’s import batches, line items, match results, sessions, subscription row, magic links for your email, and the account row from D1. You can also email hello@savesame.com and we will delete the same records.
Your data and your choices
Categories we collect: account information (email, office name); billing information handled by Stripe; usage data (how you use SaveSame); and content you submit (import batches, line items, match results). We do not run third-party advertising or analytics pixels on this site today.
We use data to run and improve the service. For non-Excluded Data (for example account and product-usage information), we may also use it to train and improve AI models, and to create aggregated or de-identified data (“Aggregated Data”), which we may sell or license. We may sell or share certain personal information with partners and other third parties (for example data, analytics, and marketing partners) when those partnerships exist — subject to your choices below. If we are not sharing with partners today, your opt-out is still recorded and honored when sharing begins.
Excluded Data. Supplier invoices, order history, and pricing from a customer’s own supplier accounts, and any patient or practice-identifying data, are used only to provide the service. They are never sold and never used to train AI models. Only Aggregated Data (de-identified so it does not identify you or any individual) may be derived from them.
If you’d rather we not use your data this way, you can opt out anytime. Under US state privacy laws (including California), this opt-out also covers the “sale” or “sharing” of personal information. We honor Global Privacy Control (GPC / Sec-GPC: 1, and navigator.globalPrivacyControl in supporting browsers) as an opt-out of sale or sharing. You can also email hello@savesame.com with the subject “Opt out.”
Save your choices
We’ll store your opt-out in our database and honor it. Excluded Data was already never sold and never used to train AI.
Your rights
If you live in California or another US state that grants similar rights, you may have the right to access, delete, and correct personal information, and to opt out of the sale or sharing of personal information. We will not discriminate against you for exercising these rights. Submit requests via the form above, at Your Privacy Choices, or by emailing hello@savesame.com.
Contact
hello@savesame.com
142 Joralemon Street, 6th Floor, Brooklyn, NY 11201
What Connect reads
When you use one-click Connect (Outlook, QuickBooks Online, Xero, or Gmail):
- Outlook / Gmail: read-only access to messages that match supplier senders and order/invoice subjects. We parse matching messages into supplier line items only. We do not store raw email bodies.
- QuickBooks Online / Xero: read supplier bills and line items only.
- OAuth tokens are encrypted at rest (AES-GCM). We never log tokens or message bodies.
- We never store supplier (Henry Schein, Patterson, etc.) passwords and never log in as you to a supplier site.
- One-click Disconnect revokes the token and deletes the connection plus parsed Connect data.
Supplier names are trademarks of their owners. SaveSame is not affiliated with or endorsed by those suppliers.