Data Processing

Where data may move during a project.

Exact providers depend on the selected package and the customer's accounts. Polymai keeps browser-facing apps on publishable configuration and moves privileged work to server-side functions or provider environments.

Website leads

Contact and project-interest details

Lead form submissions are stored in the configured Supabase project and can trigger a transactional email notification through the configured email provider.

Build workspace

Prompts, plans, code, screenshots, and checks

Project context is processed in the development workspace, source repository, static hosting workflow, and selected AI tools needed to create or repair the app.

Customer app runtime

App data, auth, storage, payments, and email

Runtime data is processed in the customer's configured services, such as Supabase, payment providers, transactional email, storage, and hosting.

Support

Diagnostics and issue context

Support work may inspect logs, screenshots, source files, checker output, and configuration metadata. Secrets should be provided only through approved provider environments.

AI Use

AI is used to build and repair software, not to silently operate customer data.

Polymai can use AI systems to plan app structure, generate code, summarize implementation context, repair checks, and prepare developer-readable handoffs. Production AI features inside a customer app are scoped separately.

Minimum useful context

Prompts should include the code, task, schema, screenshots, and logs needed for the change. Sensitive personal data should be omitted unless it is necessary and approved.

Human review

Generated files are inspected through code review, browser preview, screenshot checks, and service contract checks before a customer treats work as ready.

Provider controls

AI provider data-use and retention terms depend on the configured business account, API, model, region, and customer agreement.

Security

Controls designed around generated app risk.

Request security review

Secret boundaries

Provider keys, service roles, webhook secrets, and database credentials stay outside browser code and public assets.

App-scoped data

Supabase schemas, tables, storage paths, and auth storage keys are planned per app so generated projects do not share generic data surfaces.

Server-only functions

Email, AI calls, payment sessions, webhooks, and privileged fetches are routed through Edge Functions or provider backends.

Preview checks

Visual screenshots, contract checks, syntax checks, and runtime readiness checks are used to catch broken UI, missing references, and unsafe setup drift.