Privacy policy

For personal data our customers upload to or generate within the Platform, our customer is the controller (or "Data Fiduciary" under India's DPDP Act) and Procurabl acts as the processor (or "Data Processor") under the applicable Data Processing Agreement. For personal data we collect for our own purposes, including website visitors, prospects, marketing contacts, job applicants, employees, and contractors, Procurabl acts as the controller / Data Fiduciary.

Registration data. When you register, we collect personal information, which may include your name, business email address, username, phone number, employer, and job role.

Commercial and procurement execution data. We process bills of materials (BOMs), engineering specifications, RFQ histories, quoted pricing, supplier capability declarations, purchase-order records, and the identifiers of authorised users who execute those workflows.

Technical, network, and system activity data. We collect IP address, browser type, operating system, hardware model, session data, navigation paths, timestamped execution logs, and inputs provided to our matching algorithms.

Managed operations and geolocation data. For managed procurement services, we may process approximate geolocation derived from IP address, shipping addresses, on-site quality-inspection logs, freight-forwarding records, and contact details of personnel involved in inspection, transfer, or delivery.

Financial, banking, and billing information. We process billing addresses, transaction histories, and supplier banking information, including account number, bank name, branch, and routing identifiers, where required for KYC, verification, payments, or procurement operations. We do not store full payment-card numbers on our servers. Payment-card information is processed by authorised payment providers.

For California users, the categories of personal information we collect may include: identifiers; customer-record information; commercial information; internet or network activity; approximate geolocation; professional or employment information; and inferences drawn from procurement activity to reflect platform preferences. We do not intentionally collect protected classifications, biometric data, sensory data, or education data other than where users voluntarily or inadvertently include it in content they submit.

We do not solicit or systematically process Sensitive Personal Information under the CPRA or Special Categories of Personal Data under the GDPR. If users voluntarily or inadvertently include such information in support tickets, communications, or unstructured BOM files, we use it only to provide the requested service, apply heightened safeguards, and isolate it from automated matching environments where practicable.

Under the GDPR and UK GDPR, we rely on contractual necessity, legitimate interests, legal obligations, and consent depending on the purpose of processing. Under India's Digital Personal Data Protection Act, 2023, we process digital personal data on the basis of consent and certain legitimate uses permitted by law, including data voluntarily provided for a specified purpose, employment-related purposes, and compliance with legal orders.

We collect information you provide during registration, onboarding, procurement transactions, support requests, surveys, newsletter signups, supplier capability declarations, facility profiles, search queries, part specifications, and agentic-AI prompts. We may also create or enrich supplier business profiles using information obtained from publicly available business sources. We collect information automatically through logs, device and connection metadata, cookies, local storage, and similar technologies needed to secure and operate the Website and Platform.

We use information to operate and secure the Website and Platform; personalise workflows and agentic-AI interactions; provide requested products and managed services; execute procurement workflows, billing, supplier setup, logistics, and support; send administrative notices; prevent fraud and abuse; comply with law; and improve system performance through anonymised or aggregated analytics.

We may publish designated company-level supplier information through the public Procurabl supplier directory, including company name, logo, website, general location, description, capabilities, materials, industries served, and certifications. Public profiles may contain supplier-declared information, Procurabl-verified information, or information obtained from publicly available business sources. We do not publish KYC records, banking information, private contact details, bids, pricing, RFQ materials, buyer documents, or other information marked private as part of a public supplier profile.

We send marketing communications only in accordance with applicable law, and you may opt out at any time.

Cookies are small text files placed on your device; for this Policy, "cookies" also includes similar technologies such as browser local storage. We do not use cookies for behavioural advertising, cross-site tracking, or data monetisation.

• Strictly necessary and functional cookies are required for security, network management, authentication, and preferences.
• Analytics and performance cookies are off by default and load only after you accept them through our cookie banner. When enabled, we use PostHog as a processor for product analytics and session replay. User-input text fields are masked and excluded from session replay, and PostHog data is hosted on EU-based infrastructure.

You can change your choice by clearing cookies and local storage in your browser; if a Cookie settings control is available on the site, you may also use it to update your preference.

We encrypt data in transit using TLS. The Website is hosted on Railway, built on Google Cloud Platform, and Cloudflare provides DNS, edge networking, and TLS termination. Internal access to personal information is limited to authorised personnel and protected by mandatory authentication. Procurabl is working toward its own SOC 2 Type II, ISO/IEC 27001, and ISO/IEC 42001 certifications. No method of transmission or storage is completely secure; you are responsible for keeping your account credentials confidential.

If a personal data breach occurs, we will notify affected customers and individuals as required by applicable law. Where Procurabl acts as a Data Processor, we will notify the customer without undue delay, typically within 72 hours of becoming aware or as specified in the applicable Data Processing Agreement. Where Procurabl acts as controller / Data Fiduciary, we will comply with timelines under the GDPR, UK GDPR, DPDP Act and applicable DPDP Rules, and relevant U.S. state breach-notification laws.

We may share personal information with subsidiaries, affiliates, contractors, service providers, and other third parties who support our operations, all under contractual confidentiality and data-protection obligations. We may also disclose information to fulfil the purpose for which it was provided; to a buyer or successor in a merger, restructuring, or asset sale; to comply with law or legal process; to enforce our Terms of Use and other agreements; or to protect the rights, property, or safety of Procurabl, our customers, or others. We may disclose aggregated or de-identified information that does not identify any individual without restriction.

You can set your browser to refuse some or all cookies, but parts of the Website or Platform may not function properly if you do. Because analytics are off by default and load only with your consent, you control non-essential tracking through the cookie banner and can change your choice by clearing cookies and local storage in your browser. To exercise data-subject rights, claim a supplier profile, or request correction or removal of public-profile information, email support@procurabl.com.

We retain personal data only for as long as reasonably necessary to provide the services, maintain security and auditability, comply with legal, tax, accounting, and regulatory obligations, resolve disputes, and enforce agreements. Retention periods vary by data category, customer agreement, and applicable law. When information is no longer required, we delete or de-identify it, subject to limited retention in secure backups and records preserved for legal or regulatory purposes. Enterprise customer data is handled according to the applicable Service Agreement and Data Processing Agreement.

Lexa is an agentic AI-powered procurement platform. We use AI, including large language models and retrieval-augmented generation, to extract and parse BOM data, match part specifications against supplier capability profiles, generate RFx documents, score supplier responses, and detect anomalies. Inputs may include user identifiers, BOM files, part specifications, supplier profiles, and procurement context.

Procurabl uses OpenRouter as an AI inference gateway to access selected model providers. We configure AI processing to route customer data only to model endpoints designated for zero data retention and no training on customer inputs or outputs. If a compliant endpoint is unavailable, the request fails rather than being routed to a non-compliant endpoint. We do not use customer personal data to train or fine-tune Procurabl models or third-party models unless the customer expressly authorises that use in writing.

Decisions with legal or similarly significant effects on individuals include human review before action. You may request human review, request information about categories of inputs and logic used, and object to automated processing by contacting support@procurabl.com.

We are headquartered in India, and personal information may be transferred to, stored, and processed in India and other countries where we or our service providers operate. For transfers from the EEA, UK, and Switzerland to India or other countries, we rely on one or more appropriate safeguards, including the European Commission's 2021 Standard Contractual Clauses, the UK International Data Transfer Addendum or ICO Addendum to the EU SCCs, and adequacy decisions where applicable. We carry out transfer impact assessments where required.

You may request access, rectification, erasure, restriction, objection, portability, withdrawal of consent, and protection against solely automated decisions with legal or similarly significant effects. Email support@procurabl.com or write to us at the address below. We will respond within 30 days of receipt. You may also lodge a complaint with your supervisory authority or with the UK's Information Commissioner.

This section applies to Data Principals located in India. Procurabl acts as Data Fiduciary for personal data we collect through website interactions, platform registrations, and managed services where we determine the purpose of processing, and as Data Processor when processing personal data under documented instructions of enterprise customers. Where we process on consent, we obtain consent that is free, specific, informed, unconditional, and unambiguous. Under the DPDP Act you have rights to a summary of personal data and processing activities; correction, completion, updating, and erasure; grievance redressal; nomination; and withdrawal of consent. Our Website and Platform are intended for enterprise B2B use and are not directed at children.

Grievance Officer (India): Privacy Officer, Procurabl Solutions Private Limited, Unit No. 126, Cloud 9 Bungalow Society, NIBM Annex, Sainik Vihar Gate, Pune, MH 411048, India. Email: support@procurabl.com.

Procurabl does not sell personal information and does not share it for cross-context behavioural advertising. Subject to legal exceptions, California residents may request to know, delete, or correct personal information; request limitation of sensitive personal information; and exercise rights without discrimination. You may appeal a refusal by replying to our response with the word "Appeal." We respond to verifiable requests within 45 days. Contact support@procurabl.com.

If you reside in a U.S. state with a comprehensive consumer privacy law, you may have rights to confirm processing, access a portable copy of your data, correct or delete personal information, opt out of sale, targeted advertising, and certain profiling, limit use of sensitive personal information, and appeal a refusal. Contact support@procurabl.com to exercise these rights.

The Website and Platform are intended for B2B workplace use. We do not knowingly collect personal information from children. In the United States, we will delete any personal information collected from a child under 13 without verifiable parental consent. In India, we require verifiable parental or guardian consent to process data of a child under 18 and prohibit targeted advertising or tracking directed at children. In the EU and UK, we apply the applicable age of digital consent and comply with applicable age-appropriate design requirements.

In commercial emails, we will not use false or misleading subjects or addresses; we identify advertising messages where required; include our physical address; honour opt-out requests promptly; and provide an unsubscribe option.

We will post changes to this Policy on this page and update the "Last Updated" date. Where required by law, we will notify you of material changes by email.

Procurabl uses third-party service providers for cloud infrastructure, edge networking and DNS, product analytics, payment processing, AI processing, communications, and operational support. Current providers include Railway / Google Cloud Platform, Cloudflare, PostHog, OpenRouter, and the selected model providers available through OpenRouter's zero-data-retention routing. We configure AI requests to deny provider data collection and require zero-data-retention endpoints. A current list of sub-processors and their data-handling commitments is available on request by emailing support@procurabl.com.

If you believe content on our Platform infringes your copyright, send a written DMCA takedown notice to support@procurabl.com or by post to Procurabl Solutions Private Limited, Attn: DMCA Notice, Pune, Maharashtra, India.

Privacy Officer (Global): support@procurabl.com

Grievance Officer (India): Privacy Officer - support@procurabl.com

Postal address: Procurabl Solutions Private Limited, Unit No. 126, Cloud 9 Bungalow Society, NIBM Annex, Sainik Vihar Gate, Pune, MH 411048, India