Privacy notice

This notice explains what information Firmgraph holds, why, who can see it, and how it is protected. Firmgraph is operated by Morad Nosrati Habibi.

What Firmgraph holds

• Account details: name, work email, title, office, discipline, years of experience and reporting line.
• Project experience that people record or import, and text read from resumes they upload.
• Pursuits (text read from RFPs), fee models, Bench bookings and project records.
• A security log of sign-ins (including failed attempts and the internet address they came from), access changes, sharing, downloads and deletions.
• A record of AI use: which feature ran, how many tokens it used and its cost.

How it’s used

Only to run Firmgraph for your organization and keep it secure. It is not sold, not used for advertising, and Firmgraph uses no tracking or advertising cookies. The only cookies are the ones needed to keep you signed in, sign you out after 8 hours without activity, and let an administrator view the app as someone else.

Who can see it

Your organization’s administrators decide who can use each tool. By default people see only their own resume, managers also see and verify their team’s records, and fee models and pursuits stay private to whoever created them unless they share them. Administrators can see everything in their organization’s Firmgraph and the security log.

Service providers

• Supabase: database and sign-in. Data is encrypted in transit and at rest.
• Vercel: hosting.
• Anthropic: when someone uses an AI feature, the relevant text (for example an RFP or resume, or verified experience for a staffing search) is sent to Anthropic’s API to produce the result. Under Anthropic’s commercial terms, API data is not used to train its models by default.
• Resend: notification emails, sent only to people who have a sign-in.

Security

All traffic is encrypted (HTTPS). The browser never reads the database directly: every request is checked on the server against the person’s access before any data is returned, and the database refuses public access. Sign-in pauses after repeated failures, sessions end after inactivity, and important actions are logged.

Keeping and deleting information

Information is kept while your organization uses Firmgraph. Administrators can correct records, turn off sign-ins and remove people. To ask what is held about you, or to have it corrected or deleted, contact your administrator, who can reach Morad Nosrati Habibi.

Changes

If this notice changes, the date above will change too.