Privacy

Searching, on the site and through assistants

Search, company and facility pages, and filters return published catalogue data. So do the MCP server at https://physicalvalidation.com/mcp and the API at /api/v1, which assistants such as ChatGPT and Claude use. Connector directories use this same public catalogue. None of these needs an account, and none stores what was searched for.

To refuse bursts of requests, the server counts API requests per IP address for one minute, and MCP calls both per IP address and as a site-wide total for one minute. It uses a one-way hash of the address for the per-IP counts, keeps each count only for that minute, and does not link a count to what was asked.

Cloudflare, which hosts the site, keeps request logs for up to seven days to run and debug the service. Search text in the address is removed from those logs.

Requests an assistant prepares

An assistant can prepare a request with the prepare_request tool. It sends what the work is, the budget and any shortlist, never your name or contact details. The server places those words in the request form's options and returns a link to /request with the draft in the part of the address after #, which browsers do not send to the server. Nothing is stored. The draft becomes a stored request only if you open the link, add your details, agree to the terms and send it.

Accounts

An account is optional. You need one only to keep your requests as a buyer, or to represent your company as a service provider. Sign-in is run by WorkOS (AuthKit), which checks your email address, for example with a one-time code. WorkOS processes your email and sign-in for Halmos Labs; Physical Validation never sees or stores a password.

An account stores:

• Your email, whether WorkOS has verified it, and the WorkOS user id.
• Whether you chose Buyer or Service provider, when you chose it, and the version of these terms you accepted.
• When you signed up and when you last signed in.
• A record of sign-ins, sign-outs and account changes, with a one-way hash of the connecting IP address. The address itself is not stored.

Signing in sets a cookie that keeps you signed in for 30 days. It holds a random token; only a hash of it is stored, and signing out deletes it. A second cookie that holds no data, only that you are signed in, lets the page header say “Account”. Sign-in also sets a short-lived cookie for the 10 minutes the sign-in takes. Physical Validation sets no advertising or tracking cookies.

A service provider's company claim stores the email domain it was checked against and the decision of the Halmos team. Corrections a provider submits are kept with every earlier version, and are published only after review, marked as submitted by the company.

What a sourcing request stores

A request is stored when you submit the form at /request, after you consent. The form submits with POST /api/requests. The agent in the search box can draft it for you; nothing is stored until you submit the form. The Halmos team reviews the stored request. Suppliers are not contacted automatically.

The stored document includes:

• Contact name, email, company, and role, and a phone number when one was provided.
• The work: title, description, services, and any modality, quality, material, quantity, scale, deliverables, need-by date, and location constraints.
• The budget, and any shortlisted company ids.
• An idempotency key, when one was sent with POST /api/requests.

A file attached on the form is stored with that request and is visible only to the Halmos team.

Halmos Labs keeps the request in its database and shows it in the admin request list. A Slack message to the Halmos team includes the request title, the contact's company name, the services, and the budget. That message does not include the person's name, email, or phone.

Email with us

The Physical Validation team writes to buyers and service providers about requests, accounts and company profiles, and you can reply. Mail is sent and received through Resend, which processes it for Halmos Labs.

We keep each conversation: the messages, who sent them and when, whether they were delivered, and the original of each message you send us. Only the Halmos team reads them. A buyer and a service provider are never in the same conversation, and neither sees the other's messages unless both agree to an introduction.

If mail to an address bounces or is reported as spam, we stop writing to it. Outreach to companies always says how to stop it.

How long it is kept

Halmos Labs keeps the request until someone at Halmos Labs deletes it. There is no automatic expiry.

Conversations by email are kept until someone at Halmos Labs deletes them, or until you ask us to.

An account is kept until you ask for it to be deleted. Write to the address below from the account's email; Halmos Labs deletes the account, its sessions and its WorkOS user. Published company corrections stay on the company page as the company's own statement.

Repeated submissions are counted by IP address and by email so a burst can be refused. Those counters are not the request record.

Who else receives it

The request is stored for the Halmos team to review. It is not sold. Suppliers are not contacted automatically. The Slack notification described above is the only automatic copy, and it omits the person's name, email, and phone.

WorkOS processes account sign-in for Halmos Labs. Account data is not sold or shared with suppliers.

Contact

Questions about a stored request or an account, and requests to delete one: inquiry@physicalvalidation.com. The support page has the same address. Terms are at /terms.