Privacy Policy

The data controller is Matej Sakelšek, operating ProcFlow, based in Slovenia, European Union.

If you have any questions about this policy or want to exercise your rights, contact us at hello@procflow.net. We respond personally, usually within a few business days.

Account and profile data

When you create a buyer account we collect your name, work email address, company name, job title, and phone number. When you create a supplier account we collect your name, email, and company name. We need this to operate the service — identify you, send you notifications, and display your information to counterparties in the RFQ process.

RFQ and procurement data

RFQs, supplier lists, quotes, BOM files, delivery addresses, and uploaded specification documents you create or upload are stored so the service can function. This data is yours — it lives in your account and we don't use it for any purpose beyond operating ProcFlow.

Usage and analytics data

We collect anonymised data about how you use ProcFlow — which pages you visit, which features you use, what actions you take. This helps us understand what's working and what to improve. Analytics cookies are only set after you explicitly accept them via the cookie banner. If you decline, no analytics cookies are placed.

Error and diagnostic data

When the application encounters an error, we capture a technical report that includes your user ID, email address, and a description of what went wrong. This is used solely to fix bugs. We use Sentry for this (see the processors section below).

Payment data

We do not store payment card details. Stripe processes all payments and handles payment data directly. We receive confirmation of payment success or failure and a subscription status, but never see or store your card number, CVV, or bank account details.

Email communication

We send transactional emails — RFQ invitations, quote notifications, team invitations, and lifecycle messages (e.g. trial started). These are sent using Resend. We don't send marketing emails without your consent.

When a buyer uses ProcFlow to send an RFQ, they provide us with their suppliers' contact details — typically a name, email address, and company name. This data comes from the buyer's own supplier relationships; we receive it because the buyer entered it into ProcFlow.

We use this data to:

• Send RFQ invitation emails to suppliers on the buyer's behalf
• Notify suppliers of award decisions (won or not selected)
• Allow the buyer to track whether invitations have been viewed and responded to
• Allow registered suppliers to log in and manage their quotes via the supplier portal

The invitation email itself discloses that the buyer's company is using ProcFlow to manage their RFQ process and that the supplier's contact details were entered by that buyer. No supplier contact data is shared with any other buyer or third party.

If you received a ProcFlow email as a supplier contact and want to know what data we hold about you, have it corrected, or be removed from a buyer's supplier list, email us at hello@procflow.net. We will action removal requests within 30 days and inform the relevant buyer.

Cookies are small text files stored in your browser. ProcFlow uses three categories:

Essential cookies — always active

These are required for the service to function. You cannot opt out of them while using ProcFlow.

Analytics cookies — require consent

These are only set if you click Accept in the cookie banner. If you click Decline or dismiss the banner, these cookies are not set.

You can change your cookie preference at any time by clearing your browser cookies and reloading the page — the consent banner will reappear. You can also manage analytics cookies through your browser settings or a browser extension such as uBlock Origin.

We do not sell your data to anyone. We share data only with the service providers ("processors") listed below, and only to the extent necessary to operate ProcFlow.

"EU SCCs" means the European Commission's Standard Contractual Clauses — the legal mechanism that allows personal data to flow from the EU to the US with appropriate safeguards.

We may also disclose data if required by law or to protect the rights and safety of our users.

When you upload a specification document or BOM file and ask ProcFlow to extract information from it, the document content is sent to Anthropic (Claude) or OpenAI (GPT-4) for processing. We do not use your documents to train these models — both providers contractually agree to this for API customers. Document content is used only for the immediate extraction task and is not retained by the AI providers beyond their standard API request logging window.

To request deletion of your account and all associated data, email us at hello@procflow.net. We'll process deletion requests within 30 days.

As an EU resident, you have the following rights over your personal data:

• Access. Request a copy of the personal data we hold about you.
• Rectification. Ask us to correct inaccurate or incomplete data.
• Erasure. Ask us to delete your data (subject to legal retention obligations).
• Portability. Receive your data in a structured, machine-readable format.
• Restriction. Ask us to limit how we process your data while a dispute is resolved.
• Objection. Object to processing based on legitimate interests.
• Withdraw consent. Withdraw analytics consent at any time by clearing your cookies and declining in the banner that appears on reload.

To exercise any of these rights, email hello@procflow.net. We will respond within one month. No charge applies for reasonable requests.

If you believe we are processing your personal data in breach of GDPR, you have the right to lodge a complaint with the supervisory authority in your country of residence.

In Slovenia, the supervisory authority is the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec):

• Website: www.ip-rs.si
• Phone: +386 1 230 97 30
• Email: gp.ip@ip-rs.si

You may also contact the supervisory authority in any EU member state where you reside or work.

We'll update this policy when our data practices change. For material changes — new data categories, new processors, new legal basis — we'll notify account holders by email at least 14 days before the change takes effect. The "last updated" date at the top of this page always reflects the current version.