Privacy Policy

1. Information We Collect

a. Account and Organisation Information

When you register, we collect your name, email address, and organisation details (company name, address, phone, website). Administrators may also upload a company logo.

b. Procurement and Order Data

We store the data you enter into the Service: supplier names and contact details, product catalogues, RFQ records, supplier quotations, order records, and client information. This data belongs to you and is used solely to provide the Service.

c. Usage Information

We may collect basic usage information — such as pages visited and features used — to help us understand how the Service is being used and to improve it. This data is aggregated and not used to profile individual users.

d. Payment Information

Subscription payments are processed by Razorpay. We do not store your full payment card details. We may receive a transaction identifier, payment status, and billing contact information from Razorpay.

e. Communications

When you use the Service to send communications — such as RFQ links to suppliers or password-reset emails — the relevant message content and recipient addresses are processed to deliver those communications.

2. How We Use Your Information

• To create and manage your account and workspace.
• To provide and operate the features of the Service.
• To authenticate users and maintain secure sessions.
• To send transactional emails (password resets, RFQ notifications to suppliers).
• To process and manage subscription payments.
• To respond to support requests you send us.
• To improve and develop the Service.
• To comply with legal obligations.

We do not use your data for advertising. We do not sell, rent, or share your personal information with third parties for their own marketing purposes.

3. Sharing of Information

We share your information only in the following circumstances:

• Razorpay — to process subscription payments. Razorpay's privacy policy governs how they handle your payment information.
• Cloud infrastructure and database providers — to host the application and store data. These providers act as data processors on our behalf and are not permitted to use your data for their own purposes.
• Email delivery services — to send transactional emails on your behalf (e.g., RFQ links to suppliers, password resets).
• Law enforcement or regulatory authorities — where required by applicable law, court order, or to protect the rights and safety of users or the public.

If we are involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify affected users before any such transfer takes effect.

4. Cookies and Session Storage

We use a single HTTP-only session cookie (rfq_token) to authenticate your logged-in session. This cookie is strictly necessary for the Service to function. It does not track you across other websites and is deleted when it expires or when you log out.

We do not use advertising, analytics, or third-party tracking cookies.

5. Data Storage and Security

Your data is stored on cloud infrastructure. We apply reasonable technical and organisational measures — including encrypted connections (HTTPS), HTTP-only cookies, and access controls — to protect your data against unauthorised access, disclosure, or loss.

No system is completely secure. While we take data security seriously, we cannot guarantee that your information will never be accessed, disclosed, or altered by a third party despite our efforts.

In the event of a data breach that is likely to affect your rights or interests, we will notify you as required by applicable law.

6. Data Retention

We retain your data for as long as your account is active. After account termination or subscription cancellation, we retain data for a reasonable period (typically up to 90 days) to allow for dispute resolution or account reactivation, after which it is deleted or anonymised.

Certain information may be retained for longer periods where required by applicable law (for example, billing records).

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access — request a copy of the personal information we hold about you.
• Correction — request that we correct inaccurate or incomplete information. (You can update most information directly within your account settings.)
• Deletion — request that we delete your personal data, subject to legal retention obligations.
• Portability — request your data in a structured, commonly used format.
• Objection or restriction — object to or request restriction of certain processing activities.

To exercise any of these rights, contact us at privacy@procurpilot.com. We will respond within a reasonable timeframe and in accordance with applicable law.

8. Children's Privacy

The Service is intended for business use by adults. We do not knowingly collect personal information from individuals under the age of 16. If you believe we have inadvertently collected such information, please contact us and we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or through a notice in the Service before the changes take effect. We encourage you to review this page periodically.

10. Contact

For questions, requests, or concerns about this Privacy Policy, contact us at privacy@procurpilot.com.