Privacy Policy

1. Data Controller

ProcureLabs Pte. Ltd. (UEN: 202606070W) determines the purposes of its account administration, billing, security and marketing records. Customer organisations normally determine the purposes of personal data uploaded for procurement services; we process that data under their applicable instructions and agreements.

For any data protection inquiries, please contact our Data Protection Officer at admin@procure-labs.com

Our designated Data Protection Officer serves Singapore PDPA responsibilities. This designation does not establish a GDPR DPO appointment or independence; the separate GDPR applicability and independence assessment remains unresolved.

2. Data We Collect

We collect and process the following categories of personal data:

• Account Information: Email address, full name, organization name, when you accepted our terms, and your profile picture link if you sign in with Google
• Usage Data: Pages and features you use, session length, and your preferences. Page-view tracking and Google Analytics run only if you accept analytics cookies.
• Procurement Data: Spend data, supplier information, and other business data you upload
• AI Interactions: Chat messages and queries with our AI assistants
• Technical Data: IP address, browser type and device information, sign-in attempts and active sessions, used for security and analytics

ProcureLabs does not intend to process special categories of personal data (such as health, religious beliefs or trade-union membership), and our Acceptable Use Policy prohibits uploading them. Where our automated checks detect such data, it is removed from text before that text is sent to AI providers through our AI orchestrator, and a CSV import whose column headers name it is refused. The checks recognise English wording only and do not catch everything, and text they detect remains stored in your workspace until you delete it.

Personal data we receive from others

Some personal data does not come from you directly:

• From your organisation: if it uses single sign-on or SCIM provisioning, its identity provider sends us your name, email address and, where configured, the groups that set your role. An administrator may instead enter your email address to invite you. If your organisation connects Microsoft Teams, we receive your Teams name and ID when you use our bot. We use this to create and run your account.
• From the documents and data your organisation uploads or connects: names, business contact details and job titles of its staff and its suppliers' staff, and the names and titles of people who sign contracts, found in contracts, invoices, supplier lists and connected business systems. A buyer may also invite you to its supplier portal by entering your email address, and a colleague may add you with your name and email address. We process this for that organisation, which decides how it is used.
• From public registers and sanctions lists, when your organisation uses supplier discovery, conflict-of-interest or sanctions screening: company officers' names, roles and appointment dates (UK Companies House, which also gives nationality, occupation and country of residence; and OpenCorporates), public filings from US SEC EDGAR that mention the name of one of your organisation's staff, and names on government sanctions lists (OFAC, EU, UN and UK) that match a supplier. We use this to assess suppliers and to screen for conflicts of interest and sanctions, on that organisation's instructions.

3. Legal Basis for Processing

We process your personal data under the following legal bases:

• Contract Performance: To provide our services as agreed in our terms of service
• Consent: AI processing depends on the applicable customer instructions and lawful basis, the selected purpose and the service settings. Optional analytics requires the applicable cookie consent. An AI preference alone does not establish permission for every purpose, provider or overseas transfer.
• Legitimate Interest: For security, abuse prevention, and service improvement
• Legal Obligation: To comply with applicable laws and regulations

4. Third-Party Data Sharing

We share data with third-party service providers, including those below. The complete list, with locations, is on our Subprocessors page.

Supporting services include AWS hosting, Supabase database and authentication, Stripe billing, Sentry error monitoring, Resend email delivery, Inngest workflows, Upstash caching and rate limiting, and Microsoft 365 / SharePoint business correspondence and company documents. Data shared depends on the feature and configuration. See the Subprocessors page for the service inventory.

5. Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the following rights:

Where GDPR applies, the law requires a response without undue delay and within one calendar month of receipt. Complexity or the number of requests may justify up to two further months; extension notices must be given within the initial month and give reasons. Other applicable laws may have different requirements.

You can email the privacy contact to exercise applicable rights without an active account or subscription. We may request proportionate identity verification. For customer-controlled data we assist the customer controller. You may complain to the Singapore PDPC or, where GDPR applies, the competent supervisory authority.

6. Data Retention

We retain your data for the following periods:

• Retention follows the applicable data category, customer instructions, legal holds and provider terms. Chat history, derived content, audit records and provider logs have separate retention conditions. Deletion requests are handled under the DPA and applicable law.

7. Data Security

We implement industry-standard security measures to protect your data:

• HTTPS protects data in transit and hosting services provide encryption at rest with service-specific key management. Tenant access uses scoped permissions and database row-level policies where applicable. Multifactor authentication applies to supported provider accounts and specified privileged actions. Security records, coverage and retention depend on the service; customer-managed keys require a separately agreed and configured arrangement.
• SOC 2 Type II preparation programme is in progress; our own audit has not yet begun and no completed Type II report is available.

If there is a data breach

If a breach affects personal data for which we are the controller and is likely to put you at high risk, or to cause you significant harm, we will tell you without undue delay. We notify Singapore's Personal Data Protection Commission within 3 calendar days of assessing that a breach is notifiable and, where the GDPR applies, the competent supervisory authority within 72 hours of becoming aware of the breach. If the breach affects data we process for your organisation, we tell your organisation within 72 hours, and it decides how to inform you.

8. Cookies

We use cookies and similar technologies for:

• Essential: Authentication and security (required)
• Analytics: Understanding usage patterns (optional)
• Preferences: Remembering your settings, such as your language

You can change your cookie preferences at any time with “Cookie preferences” in the site footer or in Settings → Account. For a detailed list of cookies, see our Cookie Policy.

9. International Transfers

Our hosting records list Singapore as the primary location; the actual application and database service locations remain to be verified. Selected providers may process data elsewhere, including the United States; Singapore storage does not mean all processing stays in Singapore. Transfer safeguards depend on the recipient, processing and applicable contractual or adequacy arrangements. Contact our privacy contact for details; no European residency option is promised.

10. Automated Decision-Making (GDPR Article 22)

ProcureLabs uses automated processing to support procurement decisions, including:

• Transaction Integrity: Automated scoring of invoices and transactions for potential irregularities (e.g., duplicate payments, split purchases, ghost vendors)
• Supplier Risk Scoring: Automated composite risk assessments based on financial, compliance, and performance data
• Compliance Flagging: Automated identification of potential regulatory or policy violations

Your rights regarding automated decisions:

We keep a written data protection impact assessment of our AI features and automated decisions, reviewed at least annually and whenever they change significantly.

11. Age Restriction

ProcureLabs is a business-to-business enterprise platform. Our services are not directed at, and we do not knowingly collect personal data from, individuals under the age of 18. If you are under 18, you may not use this service. Anyone who signs up must confirm that they are 18 or older, and we do not create the account without that confirmation. If you believe a minor has provided us with personal data, please contact us at admin@procure-labs.com.

12. Updates to This Policy

We may update this privacy policy from time to time. When we do, we publish the new version on this page and change the “Last updated” date at the top. Your continued use of the service after such updates constitutes acceptance of the revised policy.