Last updated 7 November 2026
Draft, not final. This is a good-faith, best-practice policy covering how ProcureLite actually handles data today. It has not yet been reviewed by counsel and will be replaced with a fully reviewed version before general availability. If anything here is unclear or you need a formal statement for procurement purposes, please get in touch.
ProcureLite is a procurement platform (requisitions, purchase orders, contracts, invoices, payments and a supplier portal) built and operated by the ProcureLite team. This policy covers both the public marketing site (getprocurelite.com) and the ProcureLite application itself.
When you submit the demo request or "express interest" form, we collect your name, work email, company name, and anything else you choose to provide (phone, company size, plan interest, message).
When your organisation becomes a customer, the application stores the business data you and your team put into it -- requisitions, purchase orders, supplier records, contracts, invoices, expenses and payments -- along with account data (name, email, role) for each user, and system-generated activity logs (see "Security" below).
To make payments by bank transfer, the application also stores bank details: those of your suppliers and freight forwarders, your own company's (shown on the invoices you send), and, if you use expenses, each employee's account for paying them back. Any change to a supplier's or your company's bank details has to be confirmed by a second person before it is used. Suppliers paid through Stripe give their bank details to Stripe directly, and we never see them.
Marketing-site submissions are used only to respond to your enquiry -- we do not sell this information or share it with third parties for their own marketing.
Application data is used to provide the service to your organisation: running your procurement workflows, sending the notifications and emails you've configured, and (only with your permission) dispatching documents to the ERP or e-invoicing connections you set up in Settings.
Unless your organisation opts out (Settings → Benchmarking), we use aggregate measures calculated from your application data (percentages, durations and unit prices by product code) to produce anonymised peer comparisons for participating businesses. We do not include your business's name, supplier names or the names of any individuals. A figure is only published when at least five businesses contribute to it, and figures are rounded. Because the published figures cannot be linked to you or to any person, they are not personal data. The Terms of Service (section 19) explain how to opt out.
We use a small number of subprocessors to run the service: Supabase (database, sign-in and file storage, hosted in the EU in Ireland), Vercel (application hosting), Resend (sending notification emails), Stripe (subscription billing and supplier payouts), Anthropic (the optional AI features: the chat assistant, contract drafting, invoice reading and suggesting a product code for an order line, which sends only that line's description), Sentry (error monitoring) and Zoho Mail (our own business email). None of them use your data for their own purposes beyond providing that service to us.
We do not sell personal data, and we only share application data with a third party (like your own ERP or a PEPPOL access point) when you explicitly configure that connection.
We keep account and business data for as long as your organisation has an active subscription. When a subscription ends, we keep the data until your organisation confirms it has exported what it needs, or asks us to delete it, and then delete it within 30 days. If we hear nothing, we delete it six months after the subscription ends, after at least two written reminders. Encrypted backups are deleted within a further 35 days. Marketing-site enquiries that don't convert to a customer are kept only as long as needed to follow up, and deleted or anonymised after.
If you're in the EU/UK or a similar jurisdiction, you have the right to access, correct, export or delete your personal data, and to object to or restrict certain processing. Application users can self-service most of this directly: an export and an erasure request tool are built into the product's data privacy settings. For anything else, or for marketing-site enquiries, contact us via the contact form.
The marketing site and application use only the cookies strictly necessary to keep you signed in and remember basic preferences (like light/dark mode). We don't run third-party advertising or tracking cookies.
Application access is protected by row-level authorization scoped to your organisation, optional multi-factor authentication (TOTP) for every user, and a centralized security event log covering sign-ins and sensitive actions. Data in transit is encrypted (TLS). No system is perfectly secure, but this is the real, current state of the platform, not aspirational copy.
ProcureLite is a B2B product intended for business use and is not directed at, or knowingly used to collect data from, children.
As this policy moves from draft to final, and as the product evolves, we'll update this page and the "last updated" date above. Material changes will be communicated to active customers.
Questions about this policy, or requests relating to your data, can be sent via the contact form.