Procura is a product under OnyxLabs, a brand operated by Onyx Management, LLC. This Privacy Policy explains how we collect, use, and protect your personal information.

1. Information We Collect

We collect information you provide directly to us, such as when you create an account, request a demo, or contact us for support. This may include:

Name and contact information (email address, phone number)
Company name and job title
Procurement data onboarded to our platform
Communications you send to us
Billing and payment information
User preferences and settings

Information Collected Automatically

When you access or use our services, we automatically collect certain information, including:

Log information (IP address, browser type, access times, pages viewed)
Device information (hardware model, operating system, unique device identifiers)
Usage data (features used, actions taken, time spent on pages)
Location information (based on IP address)

2. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect and track information about your use of our services. Cookies are small data files stored on your device that help us improve our services and your experience.

We categorize cookies into three types:

Essential Cookies: Required for core site functionality such as session management and security. These cannot be disabled.
Analytics Cookies: Help us understand how visitors interact with our platform so we can improve the experience. These are optional and require your consent.
Marketing Cookies: Used for advertising and campaign measurement. These are optional and require your consent.

When you first visit our site, you will be presented with a cookie consent banner where you can accept all cookies, reject non-essential cookies, or customize your preferences. You can change your cookie preferences at any time by clicking "Cookie Preferences" in the site footer.

You can also instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept essential cookies, you may not be able to use some portions of our services.

3. How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve our services
Process transactions and send related information
Send you technical notices, updates, and support messages
Respond to your comments, questions, and requests
Analyze usage patterns to improve our platform
Detect, investigate, and prevent fraudulent or unauthorized activities
Personalize and improve your experience
Comply with legal obligations

4. Information Sharing and Disclosure

We do not sell, trade, or otherwise transfer your personal information to third parties without your consent, except in the following circumstances:

Service Providers: We may share information with third-party vendors who perform services on our behalf (e.g., cloud hosting, analytics, payment processing)
Legal Requirements: We may disclose information if required by law, regulation, or legal process
Business Transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred
Protection of Rights: To protect the rights, property, or safety of Procura, our users, or the public
With Your Consent: We may share information with your consent or at your direction

5. Third-Party Services

Our services may integrate with or contain links to third-party services. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services you access.

Third-party services we may use include:

Cloud infrastructure providers (AWS, Google Cloud, Azure)
AI processing providers (Anthropic) for spend classification and conversational analytics features
Analytics services (if enabled, subject to your cookie consent preferences)
Customer support tools

6. Data Security

We implement appropriate technical and organizational measures to protect the security of your personal information, including:

Encryption of data in transit (TLS/HTTPS) and at rest (infrastructure-level database encryption, application-level credential encryption)
Automated dependency vulnerability scanning in CI
Role-based access controls and multi-factor authentication
Comprehensive audit logging of data access events
Security headers (HSTS, CSP, X-Frame-Options) on all responses

However, no method of transmission over the Internet or electronic storage is completely secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee its absolute security.

7. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that are different from the laws of your country.

When we transfer personal data outside of the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

8. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. The retention period may vary depending on the context of our relationship with you.

When determining the appropriate retention period, we consider:

The nature and sensitivity of the data
The purposes for which we process the data
Applicable legal requirements
Our legitimate business interests

9. Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal information:

Access: Request a copy of the personal information we hold about you
Correction: Request correction of inaccurate or incomplete information
Deletion: Request deletion of your personal information
Portability: Request a copy of your data in a machine-readable format
Restriction: Request restriction of processing of your information
Objection: Object to processing of your information for certain purposes
Withdraw Consent: Withdraw consent where processing is based on consent

To exercise these rights, please contact us using the information provided below. We will respond to your request within the timeframe required by applicable law.

For California Residents (CCPA)

California residents have additional rights under the California Consumer Privacy Act (CCPA), including:

The right to know what personal information is collected, used, shared, or sold
The right to delete personal information held by businesses
The right to opt-out of the sale of personal information
The right to non-discrimination for exercising CCPA rights

We do not sell personal information as defined under the CCPA.

For EEA Residents (GDPR)

If you are located in the European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR). You also have the right to lodge a complaint with your local data protection authority.

10. Children's Privacy

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete such information promptly.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you of any material changes by:

Posting the new Privacy Policy on this page
Updating the "Last updated" date at the top of this page
Sending you an email notification (for significant changes)

We encourage you to review this Privacy Policy periodically for any changes.

12. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us at:

Procura — a product under OnyxLabs, a brand operated by Onyx Management, LLC
Email: hello@get-procura.ai

For data protection inquiries, you may also contact us at legal@get-procura.ai.