1. Introduction
[—] ("Pricifly," "we," "us," or "our") operates the Pricifly multi-agent procurement orchestration platform (the "Service"), including the buyer application at platform.pricifly.com. This Privacy Policy explains how we collect, use, disclose, and protect information when you visit our websites, create an account, or use the Service.
This Policy applies to:
- Organization administrators and users who access the buyer portal
- Visitors to our marketing and authentication pages
- Individuals whose personal data appears in procurement records submitted by our customers (e.g., supplier contacts, approvers)
This Policy does not apply to third-party websites, supplier systems, or services you connect to the Service — those are governed by their own policies.
Contact: [—]
Data protection inquiries (EU/UK): [—]
For procurement-related personal data submitted by your employer or customer organization, contact that organization first. This Policy should be read together with our Terms of Service.
2. Roles: Controller and Processor
Understanding who decides why and how data is processed helps determine your rights.
2.1 Pricifly as controller
We act as a data controller for:
- Account registration and authentication data
- Billing and commercial relationship data (when applicable)
- Website analytics and product usage telemetry tied to your Org account
- Security logs, abuse prevention, and service improvement data described in this Policy
2.2 Pricifly as processor
We act as a data processor (or "service provider" under some laws) when we process Customer Content — procurement records, supplier data, documents, messages, and configuration — on behalf of your organization to deliver the Service.
In that case, your organization is the controller (or "business") for Customer Content. Our processing follows your instructions as reflected in your use of the Service, these Terms, and, for enterprise customers, a Data Processing Agreement (DPA).
If you are a supplier contact or employee whose data was submitted by a Pricifly customer, please contact that organization first regarding your procurement-related data. We will assist our customer as required by law.
3. Information We Collect
We collect information in the categories below. Not all categories apply to every user or deployment stage.
3.1 Information you provide directly
| Category | Examples | Purpose |
|---|---|---|
| Account & profile | Name, work email, password (hashed), job title, Org name | Authentication, account management, support |
| Organization setup | Company details, procurement policies, approval rules | Service configuration |
| Procurement content | Requirements, SKUs, budgets, RFQs, quotes, contracts, POs, notes | Core Service functionality |
| Communications | Support tickets, feedback, email/SMS content sent via the Service (when enabled) | Support, Mode 3 clearing |
| Payment information | Billing contact, payment method tokens (via our payment processor) | Subscriptions and invoicing |
| Integrations & vault | API keys, credentials, supplier portal tokens (stored encrypted) | Integrations you authorize |
3.2 Information from authentication providers
If you choose Sign in with a third-party identity provider, we receive information permitted by that provider (typically email address, name, and a provider user ID). We do not receive your password for those providers.
Primary authentication may include email and password (with verification), magic link, optional social or enterprise login, and enterprise SSO when offered under separate agreement. When SSO is enabled, your IT administrator configures the identity provider and we receive attributes permitted by that integration.
3.3 Information generated through use of the Service
| Category | Examples | Purpose |
|---|---|---|
| Agent & workflow logs | Tool calls, orchestration steps, approval events, timestamps | Audit trail, debugging, compliance |
| Semantic memory | Embeddings and retrieved context scoped to your Org/procurement | Agent continuity across long-running workflows |
| Usage & telemetry | Feature usage, performance metrics, error reports | Reliability, product improvement |
| Device & log data | IP address, browser type, session identifiers, request logs | Security, fraud prevention |
3.4 Information from third parties
We may receive business contact information from your organization (invitations), publicly available supplier directories, or integration partners you connect. We process such data only as instructed by you or as permitted by law.
3.5 Sensitive data
The Service is not designed to collect special categories of personal data (e.g., health, biometric, or children's data). Do not submit such data unless you have a written agreement with us that explicitly covers it and appropriate safeguards are in place.
4. How We Use Information
We use collected information to:
- Provide the Service — authenticate users, run AI agents, orchestrate procurement workflows, store documents, and deliver approvals
- Enforce governance — apply policy gates, confidence thresholds, and human-in-the-loop controls before binding actions
- Secure the platform — detect abuse, investigate incidents, maintain tenant isolation through technical access controls
- Communicate with you — service announcements, security alerts, support responses
- Improve and develop — fix bugs, analyze aggregated usage patterns, evaluate agent quality (see Section 5)
- Comply with law — respond to lawful requests, enforce Terms, protect rights and safety
- Bill and administer accounts — when commercial billing is enabled
We do not sell personal information. We do not use Customer Content to train public foundation models unless you explicitly opt in to a separate program documented at the time of opt-in.
5. AI Processing and Automated Decision-Making
5.1 How AI uses your data
The Service uses AI agents powered by third-party foundation models. To perform tasks, agents may:
- Read procurement documents and messages you submit
- Generate drafts (RFQs, negotiation messages, contract summaries)
- Retrieve relevant context from your Org's semantic memory
- Propose actions for human review
Customer Content sent for inference is processed to provide the Service and is handled under contractual and technical safeguards with our service providers.
5.2 Human oversight
Binding decisions — spend commitments, contract execution, payment release — require human approval in the product unless a future enterprise agreement explicitly states otherwise. Automated processing supports your team; it does not replace legally required human review for your organization.
5.3 Accuracy limitations
AI outputs may be incorrect or incomplete. Users should verify outputs before approval. We log agent actions to support audit and troubleshooting.
5.4 Evaluations
We may use de-identified or synthetic data and controlled internal evaluation to measure agent quality. Production Customer Content is not used for public model training.
6. Legal Bases for Processing (EEA, UK, Switzerland)
Where the GDPR or equivalent law applies, we rely on:
| Processing | Legal basis |
|---|---|
| Providing the Service under contract | Performance of a contract (Art. 6(1)(b) GDPR) |
| Security, fraud prevention, service integrity | Legitimate interests (Art. 6(1)(f)) — balanced against your rights |
| Compliance with legal obligations | Legal obligation (Art. 6(1)(c)) |
| Marketing communications (if any) | Consent (Art. 6(1)(a)) or legitimate interests where permitted |
| Processing Customer Content as processor | Instructions of the controller (your Org) under Art. 28 GDPR |
You may object to certain legitimate-interests processing (see Section 12).
7. How We Share Information
We disclose information only as described below.
7.1 Within your organization
Users with appropriate roles in your Org can access procurement data per your configuration.
7.2 Service providers
We use vetted third-party service providers (subprocessors) to host, secure, and operate the Service — including infrastructure, authentication, AI inference, communications, payments, monitoring, and related tooling. They access data only to perform services for us under contractual confidentiality, security, and data-protection obligations.
We do not publish a public subprocessor list in this Policy. Enterprise customers may request current subprocessor information, prior notice of material changes, and a Data Processing Agreement (DPA) by contacting us at [—].
7.3 Suppliers and counterparties (your direction)
When you use the Service to communicate with suppliers (email, API, or other channels), relevant procurement information is shared as you instruct — for example, RFQ details sent to a vendor contact.
7.4 Legal and safety
We may disclose information if required by law, court order, or government request, or if we believe disclosure is necessary to protect rights, safety, or investigate fraud or security issues. We will notify you where legally permitted.
7.5 Business transfers
If we merge, acquire, or sell assets, information may transfer subject to this Policy or notice and your choices where required by law.
8. International Data Transfers
Our infrastructure is hosted in designated data regions chosen for reliability and performance. Specific hosting locations may vary by deployment and may be described in an enterprise DPA.
If you access the Service from the EEA, UK, or other regions with transfer restrictions, data may be transferred internationally. We rely on appropriate safeguards such as:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- UK International Data Transfer Agreement / Addendum where applicable
- Subprocessor certifications and contractual commitments
Contact [—] for a copy of relevant transfer mechanisms or the DPA.
9. Data Retention
We retain information only as long as necessary for the purposes in this Policy.
| Data type | Retention |
|---|---|
| Active account profile | Duration of account + short wind-down |
| Customer Content (procurements) | Until deleted by you or Org admin, or [—] days after account closure |
| Agent & audit logs | [—] months (longer if required for compliance or dispute) |
| Authentication logs | [—] days |
| Backups | Rolling backups purged per schedule (typically [—] days) |
| Billing records | As required by tax/accounting law (often [—] years) |
| Support correspondence | [—] months after resolution |
Org administrators may delete procurements and certain records within the product where supported. Backup and log retention may persist for a limited period thereafter.
A standalone Data Retention Statement will be published before commercial launch.
10. Security
We implement measures appropriate to commercial procurement data, including:
- Encryption in transit (TLS) for web and API traffic
- Encryption at rest provided by our cloud infrastructure
- Tenant isolation via organization-scoped access and database row-level security
- Role-based access control within organizations
- Encrypted credentials vault for integration secrets — scoped, auditable access
- Audit logging of agent actions and approvals
- Least-privilege access for personnel with production access
No system is perfectly secure. You are responsible for protecting your credentials, configuring Org roles, and reviewing approvals. Report vulnerabilities to [—].
11. Cookies and Similar Technologies
11.1 What we use
| Type | Purpose |
|---|---|
| Strictly necessary | Session authentication, security, load balancing |
| Functional | Remember preferences (where implemented) |
| Analytics | Understand usage and improve the product (if enabled — e.g., privacy-respecting analytics) |
We do not use advertising cookies for cross-site tracking of users in the authenticated product.
11.2 Your choices
Strictly necessary cookies are required for the Service. Where analytics cookies are used in jurisdictions requiring consent, we will present a cookie banner or settings control.
Browser settings may block cookies; blocking necessary cookies may prevent sign-in.
12. Your Privacy Rights
Depending on your location, you may have rights to:
- Access personal information we hold about you
- Correct inaccurate data
- Delete data (subject to legal exceptions)
- Restrict or object to certain processing
- Data portability — receive a copy in a structured format
- Withdraw consent where processing is consent-based
- Lodge a complaint with a supervisory authority
12.1 How to exercise rights
Email [—] with your request. We may verify identity before responding. We respond within timelines required by law (e.g., 30 days under GDPR).
12.2 Processor requests
If your data was submitted by an employer or customer Org, we may direct you to that controller or process your request jointly as required by law.
12.3 US state privacy rights
Residents of California and other US states with privacy laws may have additional rights (know, delete, correct, opt-out of "sale"/"sharing"). We do not sell personal information. To exercise rights, contact [—].
13. Children's Privacy
The Service is not directed to individuals under 18 and is for business use only. We do not knowingly collect personal information from children. Contact us if you believe we have collected such data and we will delete it.
14. Third-Party Links and Integrations
The Service may link to third-party sites or allow integrations you configure (identity providers, payment checkout, email or messaging channels). Their privacy practices are governed by their policies. We encourage you to review them before connecting.
15. Changes to This Policy
We may update this Privacy Policy to reflect product, legal, or operational changes. We will post the updated Policy with a new "Last updated" date and provide additional notice for material changes where required.
Continued use after the effective date constitutes acceptance. If you disagree, stop using the Service and contact us to close your account.
16. Contact Us
| Purpose | Contact |
|---|---|
| Privacy inquiries & rights requests | [—] |
| Data Protection Officer (if appointed) | [—] |
| Security incidents | [—] |
| Postal address | [—] |
Appendix A — Summary of Data Categories (quick reference)
CONTROLLER DATA (Pricifly)
├── Account: email, name, auth identifiers
├── Billing: contact, payment tokens (via payment processor)
├── Telemetry: usage, errors, security logs
└── Marketing site: cookies, visit logs
PROCESSOR DATA (on behalf of your Org)
├── Procurement records & documents
├── Supplier & approver contact details
├── Agent logs, memory embeddings, approvals
├── Integration credentials (vault)
└── Mode 3 messages (email/SMS when enabled)
Appendix B — Document history
| Version | Date | Summary |
|---|---|---|
| 1.0 | [—] | Initial publication |
Entity details, jurisdiction, contact information, retention periods, and subprocessor schedules for enterprise customers are confirmed under separate agreements where applicable and are not listed publicly here.