Privacy Policy

Information you provide

• Account details. When you register: email address, password, name, and for a business account the organization name and account type (business or consumer). Suppliers register through the supplier sign-up.
• Procurement content. The searches and requirements you submit, saved products, RFQs, quotations, purchase orders, messages exchanged with suppliers, uploaded documents, and supplier profile information.
• Integration settings. If a business user connects an ERP or procurement system, the connection details they enter.
• Support and enquiries. What you send through the contact, sales and support forms or by email.
• Sales assistant chat. What you type in the chat. If you ask for a demo or to be contacted, the details you enter in the short form after you tick its consent box. How this chat works, from the code of the separate Complyra chat service:
  • The chat is loaded only after you allow Functional and preferences; nothing is requested from the chat service before that.
  • Nothing is sent to the chat service until you use the chat. Then it receives your message, a random conversation identifier and the path of the page you are on. An email address typed into a chat message is replaced before the message is sent.
  • The chat service keeps the conversation (a redacted transcript) so that reloading the page keeps your chat. Your browser keeps only the conversation identifier and a consent flag, in session storage.
  • The demo or contact form can collect your name, work email, company, job title, what you need, how and when to contact you, and a phone number if you choose to give one. When you submit it with the consent box ticked, the service saves it as a request with your consent recorded, creates a follow-up task for the Complyra team and sends an internal notification. It asks you to confirm your email address through a link, and tells you the request was saved only after the save succeeds.
  • Your IP address is used to apply rate limits to the chat. Messages are processed by an AI model provider to produce answers, and the chat can offer meeting times through a scheduling service when one is configured.
  • OWNER ACTION: how long chat conversations, demo and contact requests and their follow-up records are kept, and who can read them

Technical information

• Sign-in records such as your last sign-in time.
• Your IP address, which the service uses to apply rate limits when there is no signed-in user or API key to key them to.
• Standard web-request information handled by our hosting providers.
• Small items kept in your browser, described in the Cookie Policy.

Information generated by using the service

• Records of activity in the application, such as searches, compliance checks, RFQs and orders linked to your account.
• Public-page analytics: the page viewed, the landing page, the referring site, any campaign tags in the link you followed, and which call to action or tool was used. These events are sent without a user identifier.
• For a small interface experiment, a random anonymous identifier kept in your browser (see the Cookie Policy).

We have not found any code that collects advertising identifiers or builds advertising profiles.

We use service providers to run Complyra. The table lists the kinds of provider the software can use. It shows what the code is able to use, not which providers are switched on in production, and it does not mean every one is active.

When you send an RFQ, the request content and the contact details needed to deliver it go to the suppliers you choose. Suppliers you contact handle that information under their own practices.

OWNER ACTION: confirm the providers actually used in production and whether a published subprocessor list is required

There is no general retention schedule in the code. What the software does do:

• Access tokens last 15 minutes and refresh tokens 7 days by default; they can be revoked when you sign out.
• A business account holder can request erasure from the account settings. The software schedules it with a 30-day grace period during which it can be cancelled. After that, personal data is deleted or anonymised: searches, saved items, preferences and analytics events linked to the account are deleted, while records such as RFQs, orders and audit entries are anonymised rather than removed. The Help page says financial records are kept for 7 years; that period has not been verified as a business decision.
• The job that carries out erasures after the grace period is part of the code; whether it runs on a schedule in production has not been verified.

OWNER ACTION: retention periods for account data, procurement records, chat conversations, analytics events and backups

Complyra serves international buyers and suppliers, and its providers may process information in several countries. The locations and any transfer arrangements have not been documented in the code.

OWNER ACTION: hosting and processing regions and the legal mechanism for any international transfers

Complyra is a business procurement service and is not directed at children. OWNER ACTION: confirm the minimum age and what happens if a child's data is found

Proposed privacy contact: [email protected]. OWNER ACTION: confirm that this inbox is monitored and is the channel for privacy requests, and name a data protection officer if one is required

The Help page lists the same address for product support. It has not yet been confirmed as the privacy contact.

Read the Cookie Policy