Privacy Policy

Last updated: May 28, 2026 · ProfessionUp, LLC DBA Bobcat Medical

The short version: We collect only what we need. We never sell your data. We never store the text of documents you analyze — only the scores. You can delete your account and data at any time.

1. Who We Are

ProfessionUp, LLC, a California limited liability company doing business as Bobcat Medical, operates Bobcat Toolbox Pro. References to "we," "us," or "our" refer to ProfessionUp, LLC.

Contact: privacy@bobcattoolbox.com

2. What We Collect

Data type	What specifically	Why we collect it	How long we keep it
Account info	Email address, full name	Login, communication, support	Until account deletion
Plan & billing	Subscription plan, trial status	Access control, billing	Until account deletion
Analysis metadata	Document name, date, readability scores, compliance status	History, reporting, export	Until account deletion or manual deletion
Document text	Text you paste for analysis	Scoring only — processed in memory	Never stored — discarded immediately after scoring
Usage data	Pages visited, features used, error logs	Product improvement, debugging	90 days
Payment info	Payment method (tokenized), billing history	Subscription billing	As required by Stripe and tax law

3. What We Never Collect

The text content of documents you submit for analysis
Patient names or any Protected Health Information
Precise location data
Browsing history outside our platform
Device contacts or microphone/camera access

4. How We Use Your Data

We use the data we collect to:

Provide, maintain, and improve the Service
Process payments and manage your subscription
Send transactional emails (welcome, receipts, password reset, service alerts)
Respond to support requests
Monitor for abuse and security issues
Comply with legal obligations

We do not use your data for advertising. We do not share your data with third parties for marketing purposes.

5. Third-Party Services

We use the following third-party services to operate the platform. Each processes your data only as necessary to deliver their service:

Service	Purpose	Data shared	Privacy policy
Supabase	Database & authentication	Account info, analysis metadata	supabase.com/privacy
Vercel	Hosting & serverless functions	Request logs, IP addresses	vercel.com/legal/privacy-policy
Stripe	Payment processing	Email, payment method (tokenized)	stripe.com/privacy
Resend	Transactional email	Email address, name	resend.com/privacy

6. Data Security

We implement industry-standard security measures:

All data encrypted in transit (TLS 1.3) and at rest (AES-256)
Row Level Security in Supabase ensures users can only access their own data
Automatic daily backups with 7-day retention
API keys stored as environment variables — never in code
No document text stored anywhere in our infrastructure

No method of transmission over the internet is 100% secure. We cannot guarantee absolute security but we take every reasonable precaution.

7. HIPAA

Bobcat Toolbox Pro is designed with HIPAA compliance in mind. Because we do not store document text, the risk of PHI exposure through our platform is minimized by design. Team and Enterprise customers may request a Business Associate Agreement (BAA) at compliance@bobcattoolbox.com. Users are responsible for ensuring they do not submit PHI through accounts without a valid BAA.

8. Your Rights (California Residents — CCPA)

Under the California Consumer Privacy Act (CCPA), California residents have the right to:

Know what personal information we collect, use, disclose, and sell
Delete personal information we hold about you
Opt out of the sale of personal information (we do not sell personal information)
Non-discrimination for exercising your privacy rights

To exercise these rights, email privacy@bobcattoolbox.com. We will respond within 45 days.

9. Data Retention and Deletion

You may delete your account at any time from Dashboard → Settings → Account → Delete Account. Upon deletion:

Your account and analysis history are queued for deletion
Data is permanently deleted within 30 days
Stripe retains billing records as required by law (typically 7 years)
Anonymized, aggregated usage statistics may be retained indefinitely

10. Cookies

We use only essential cookies required for authentication (Supabase session cookies). We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

11. Children

The Service is not directed at children under 13. We do not knowingly collect personal information from children under 13. If we become aware of such collection, we will delete the information immediately.

12. Changes to This Policy

We will notify registered users of material changes to this Privacy Policy via email at least 14 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.

13. Contact

Privacy questions: privacy@bobcattoolbox.com
HIPAA/Compliance: compliance@bobcattoolbox.com
ProfessionUp, LLC DBA Bobcat Medical · California