Privacy policy

For personal data our customers upload to or generate within the Platform, our customer is the controller (or "Data Fiduciary" under India's DPDP Act) and Procurabl acts as the processor (or "Data Processor") under the applicable Data Processing Agreement. For personal data we collect for our own purposes, including website visitors, prospects, marketing contacts, job applicants, employees, and contractors, Procurabl acts as the controller / Data Fiduciary.

Registration data. When you register, we collect personal information, which may include your name, business email address, username, phone number, employer, and job role.

Commercial and procurement execution data. We process bills of materials (BOMs), engineering specifications, RFQ histories, quoted pricing, supplier capability declarations, purchase-order records, and the identifiers of authorised users who execute those workflows.

Technical, network, and system activity data. We collect IP address, browser type, operating system, hardware model, session data, navigation paths, timestamped execution logs, and inputs provided to our matching algorithms.

Managed operations and geolocation data. For managed procurement services, we may process approximate geolocation derived from IP address, shipping addresses, on-site quality-inspection logs, freight-forwarding records, and contact details of personnel involved in inspection, transfer, or delivery.

Financial and billing information. We process billing addresses and transaction histories for platform access and supplier verification or activation fees. We do not store full payment-card numbers or bank-account details on our servers.

For California users, the categories of personal information we collect may include: identifiers; customer-record information; commercial information; internet or network activity; approximate geolocation; professional or employment information; and inferences drawn from procurement activity to reflect platform preferences. We do not intentionally collect protected classifications, biometric data, sensory data, or education data other than where users voluntarily or inadvertently include it in content they submit.

We do not solicit or systematically process Sensitive Personal Information under the CPRA or Special Categories of Personal Data under the GDPR. If users voluntarily or inadvertently include such information in support tickets, communications, or unstructured BOM files, we use it only to provide the requested service, apply heightened safeguards, and isolate it from automated matching environments where practicable.

Under the GDPR and UK GDPR, we rely on contractual necessity, legitimate interests, legal obligations, and consent depending on the purpose of processing. Under India's Digital Personal Data Protection Act, 2023, we process digital personal data on the basis of consent and certain legitimate uses permitted by law, including data voluntarily provided for a specified purpose, employment-related purposes, and compliance with legal orders.

We collect information you provide during registration, onboarding, procurement transactions, support requests, surveys, newsletter signups, supplier capability declarations, facility profiles, search queries, part specifications, and agentic-AI prompts. We also collect information automatically through logs, device and connection metadata, cookies, local storage, and similar technologies needed to secure and operate the Website and Platform.

We use information to operate and secure the Website and Platform; personalise workflows and agentic-AI interactions; provide requested products and managed services; execute procurement workflows, billing, supplier setup, logistics, and support; send administrative notices; prevent fraud and abuse; comply with law; and improve system performance through anonymised or aggregated analytics. We send marketing communications only in accordance with applicable law, and you may opt out at any time.

Cookies are small text files placed on your device; for this Policy, "cookies" also includes similar technologies such as browser local storage. We do not use cookies for behavioural advertising, cross-site tracking, or data monetisation.

• Strictly necessary and functional cookies are required for security, network management, authentication, and preferences.
• Analytics and performance cookies are off by default and load only after you accept them through our cookie banner. When enabled, we use PostHog as a processor for product analytics and session replay. User-input text fields are masked and excluded from session replay, and PostHog data is hosted on EU-based infrastructure.

You can change your choice by clearing cookies and local storage in your browser; if a Cookie settings control is available on the site, you may also use it to update your preference.

We encrypt data in transit using TLS. The Website is hosted on Railway, built on Google Cloud Platform, and Cloudflare provides DNS, edge networking, and TLS termination. Internal access to personal information is limited to authorised personnel and protected by mandatory authentication. Procurabl is working toward its own SOC 2 Type II, ISO/IEC 27001, and ISO/IEC 42001 certifications. No method of transmission or storage is completely secure; you are responsible for keeping your account credentials confidential.

If a personal data breach occurs, we will notify affected customers and individuals as required by applicable law. Where Procurabl acts as a Data Processor, we will notify the customer without undue delay, typically within 72 hours of becoming aware or as specified in the applicable Data Processing Agreement. Where Procurabl acts as controller / Data Fiduciary, we will comply with timelines under the GDPR, UK GDPR, DPDP Act and applicable DPDP Rules, and relevant U.S. state breach-notification laws.

We may share personal information with subsidiaries, affiliates, contractors, service providers, and other third parties who support our operations, all under contractual confidentiality and data-protection obligations. We may also disclose information to fulfil the purpose for which it was provided; to a buyer or successor in a merger, restructuring, or asset sale; to comply with law or legal process; to enforce our Terms of Use and other agreements; or to protect the rights, property, or safety of Procurabl, our customers, or others. We may disclose aggregated or de-identified information that does not identify any individual without restriction.

You can set your browser to refuse some or all cookies, but parts of the Website or Platform may not function properly if you do. Because analytics are off by default and load only with your consent, you control non-essential tracking through the cookie banner and can change your choice by clearing cookies and local storage in your browser. To exercise data-subject rights, email privacy@procurabl.com.

We retain personal data only as long as necessary for the purposes for which it was collected, including legal, regulatory, accounting, and reporting requirements. Indicative retention periods are: account profile data for the lifetime of the account plus 90 days; authentication and audit logs for 12-24 months; support tickets and conversation data for the customer subscription term plus 30 days or as instructed in the applicable DPA; telemetry and usage metrics for 13 months in identifiable form; billing and transaction records for 7 years; marketing contact data until unsubscribe or 24 months of inactivity; and job applicant data for 12 months after a hiring decision unless you consent to longer retention. Enterprise customer data follows the customer's instructions in the applicable Service Agreement and Data Processing Agreement.

Lexa is an agentic AI-powered procurement platform. We use AI, including large language models and retrieval-augmented generation, to extract and parse BOM data, match part specifications against supplier capability profiles, generate RFx documents, score supplier responses, and detect anomalies. Inputs may include user identifiers, BOM files, part specifications, supplier profiles, and procurement context. We do not use customer personal data to train or fine-tune Procurabl models or third-party LLMs unless the customer expressly opts in under a written agreement. Our current LLM provider is Google (Gemini), and our LLM sub-processors operate under no-training contractual terms. Decisions with legal or similarly significant effects on individuals include human review before action. You may request human review, request information about categories of inputs and logic used, and object to automated processing by contacting privacy@procurabl.com.

We are headquartered in India, and personal information may be transferred to, stored, and processed in India and other countries where we or our service providers operate. For transfers from the EEA, UK, and Switzerland to India or other countries, we rely on one or more appropriate safeguards, including the European Commission's 2021 Standard Contractual Clauses, the UK International Data Transfer Addendum or ICO Addendum to the EU SCCs, and adequacy decisions where applicable. We carry out transfer impact assessments where required.

You may request access, rectification, erasure, restriction, objection, portability, withdrawal of consent, and protection against solely automated decisions with legal or similarly significant effects. Email privacy@procurabl.com or write to us at the address below. We will respond within 30 days of receipt. You may also lodge a complaint with your supervisory authority or with the UK's Information Commissioner.

This section applies to Data Principals located in India. Procurabl acts as Data Fiduciary for personal data we collect through website interactions, platform registrations, and managed services where we determine the purpose of processing, and as Data Processor when processing personal data under documented instructions of enterprise customers. Where we process on consent, we obtain consent that is free, specific, informed, unconditional, and unambiguous. Under the DPDP Act you have rights to a summary of personal data and processing activities; correction, completion, updating, and erasure; grievance redressal; nomination; and withdrawal of consent. Our Website and Platform are intended for enterprise B2B use and are not directed at children.

Grievance Officer (India): Privacy Officer, Procurabl Solutions Private Limited, Unit No. 126, Cloud 9 Bungalow Society, NIBM Annex, Sainik Vihar Gate, Pune, MH 411048, India. Email: privacy@procurabl.com.

Procurabl does not sell personal information and does not share it for cross-context behavioural advertising. Subject to legal exceptions, California residents may request to know, delete, or correct personal information; request limitation of sensitive personal information; and exercise rights without discrimination. You may appeal a refusal by replying to our response with the word "Appeal." We respond to verifiable requests within 45 days. Contact privacy@procurabl.com.

If you reside in a U.S. state with a comprehensive consumer privacy law, you may have rights to confirm processing, access a portable copy of your data, correct or delete personal information, opt out of sale, targeted advertising, and certain profiling, limit use of sensitive personal information, and appeal a refusal. Contact privacy@procurabl.com to exercise these rights.

The Website and Platform are intended for B2B workplace use. We do not knowingly collect personal information from children. In the United States, we will delete any personal information collected from a child under 13 without verifiable parental consent. In India, we require verifiable parental or guardian consent to process data of a child under 18 and prohibit targeted advertising or tracking directed at children. In the EU and UK, we apply the applicable age of digital consent and comply with applicable age-appropriate design requirements.

In commercial emails, we will not use false or misleading subjects or addresses; we identify advertising messages where required; include our physical address; honour opt-out requests promptly; and provide an unsubscribe option.

We will post changes to this Policy on this page and update the "Last Updated" date. Where required by law, we will notify you of material changes by email.

Procurabl uses third-party service providers for cloud infrastructure, edge networking and DNS, product analytics, payment processing, AI processing, communications, and operational support. Current providers include Railway / Google Cloud Platform, Cloudflare, PostHog, and Google / Gemini. A current list of sub-processors and their data-handling commitments is available on request by emailing privacy@procurabl.com.

If you believe content on our Platform infringes your copyright, send a written DMCA takedown notice to privacy@procurabl.com or by post to Procurabl Solutions Private Limited, Attn: DMCA Notice, Pune, Maharashtra, India.

Privacy Officer (Global): privacy@procurabl.com

Grievance Officer (India): Privacy Officer - privacy@procurabl.com

Postal address: Procurabl Solutions Private Limited, Unit No. 126, Cloud 9 Bungalow Society, NIBM Annex, Sainik Vihar Gate, Pune, MH 411048, India