Privacy policy

1. Who we are

SourcePro is procurement software for companies, offered by SourcePro Technologies Private Limited, of Office 1, Example Business Park, Pune 411001 ("SourcePro", "we"). Questions about this policy: privacy@sourcepro.com.

2. Who decides about your data

• A company's records (its vendors, requests, RFQs, quotations, prices, contracts, approvals, files and the emails about them) belong to that company. The company decides what goes in and why; we process it on its behalf, under our agreement with it. For those records the company is the data fiduciary and we are its data processor.
• Your account on SourcePro (your name, work email, sign-ins) is kept by us to run the service and keep it secure. For your account we are the data fiduciary.

3. What we keep

• Your name, work email, phone number when given, your company and your role in it.
• Sign-in records: when and from which browser and network address, how each sign-in ended, the tries on your account that did not get in and why (a try at an address that has no account is not recorded), and the browsers you told us to remember after an emailed code. Your company's administrator can read the sign-ins to your company's site, and SourcePro's Super admins those of SourcePro's staff to the admin site; every such reading is recorded, and you can read your own under Your sessions.
• What you and your colleagues put into SourcePro, and who changed what, when (the audit trail).
• If you connect your own mailbox (Gmail, Microsoft 365 or your company's own mail server): its address; the access to it (for your company's own mail server, your password for it), encrypted with a key kept in a separate vault, never shown to anyone, your company's administrators and SourcePro's staff included, never written to a log, and forgotten when you disconnect; the emails SourcePro sends from it for you; and the replies to them or mail from your company's known vendors about their open RFQs. Nothing else in your mailbox is read or kept, and nothing is moved or deleted.
• Chat with your colleagues, when your company switches it on: the messages you write, the files and pictures you send, who is in each conversation, and your mute and read marks. Only the people in a conversation can read it. Your company's administrators and SourcePro's staff cannot, and the audit trail records only that a group was made or changed, never a word. The one exception is a message a member reports: the administrators your company has chosen to settle reports then read that one message, as it was reported and with nothing around it. A bell or an email about a chat never carries the words of a message.
• What you ask the AI assistant and what it answers, when your company switches it on. These are kept for the days your company chose (or not at all, if your company keeps no words), and your company's administrators can read them: each reading is recorded and the chat tells you so. SourcePro's staff do not read them.
• For a vendor on the vendor portal: the vendor's details and documents it hands in.
• Technical logs of the service (requests, errors, times), kept for 180 days as Indian law requires, to find faults and misuse.

4. Why

• To provide SourcePro to your company, as agreed with it.
• To keep it secure: sign-in codes, checks of files for viruses, finding misuse.
• To help when you or your company ask for support.
• To meet what the law requires of us.

A company's records are processed on the company's instructions, and the company answers for why it holds them. Your account is kept on the notice you confirm when you join, which you may withdraw by asking us to close it (section 10); SourcePro cannot then be used with it. We keep what the law requires on the grounds the law gives.

We do not sell your data, show advertising, or use your company's records to train AI models. Features that read documents with AI, when your company switches them on, use them only to fill SourcePro's screens for a person to check. The assistant answers a question from what the person asking may already open.

5. Where it is kept, and who helps us

SourcePro's own copies of your company's data are kept in India. These services help us run SourcePro, each only for its task and under its own obligations to us:

• Hostinger VPS, Mumbai, India: runs SourcePro and its database, so holds everything in it.
• Microsoft Azure, Central India: keeps the files people add, the nightly backups, the service's technical logs, and the keys that encrypt mailbox access.
• Amazon Web Services, Mumbai: sends the emails SourcePro sends itself, such as sign-in codes and invitations; it receives the address and the email.
• Microsoft Azure AI (Azure OpenAI and Azure AI Foundry), South India, when your company switches AI on: it receives the words of a question, or a document being read, to answer it. It may process them in another Azure region (section 6).
• Google or Microsoft, when you connect your own mailbox from them: SourcePro sends and reads through your mailbox, as described in section 3; your mail stays where your provider keeps it.

Files are checked for viruses on SourcePro's own server; no other company sees them for that.

6. What may be processed outside India

• AI. The AI models Microsoft runs for SourcePro may process a question or a document in an Azure region outside India. Microsoft does not use them to train any model, and may keep them for up to 30 days only to detect misuse of its service.
• Your own mailbox. Google and Microsoft keep your mail wherever your mailbox is kept, as agreed between you or your company and them.

Nothing else leaves India. We will not send personal data to a country the Government of India restricts.

7. How long

• Your company's records, with their audit trail, are kept while it uses SourcePro. When it stops, it can take a copy of them; they are then deleted from SourcePro within 90 days, and from the backups as those roll over, within a further 35 days. What the law requires us to keep longer (for example tax records) is kept for that long only.
• Sign-in records are kept for a year.
• Technical logs are kept for 180 days.
• Chat messages are kept for the days your company chose (a year at first; your company may choose a longer time, as the law and its own agreements allow), and what people ask the AI assistant for the days it chose (90 days at first). Each night, what is older is erased with its files. A message you delete loses its words at once.
• Backups roll over within 35 days.

8. Security

Every connection is encrypted; each company's records are kept apart from every other's; mailbox access is encrypted and never shown; new browsers need an emailed code; files are checked for viruses; and every change is recorded with who made it. Our security page says more, and how to report a weakness.

9. If something goes wrong

We watch the service for faults and misuse, and look into anything unusual at once. If personal data is exposed, we tell each company affected without delay what happened, which data, and what we are doing about it, and help it tell the Data Protection Board of India and its people, as the law asks of it. For SourcePro's own accounts we tell the Board and the people affected ourselves. We report cyber incidents to CERT-In as Indian law requires. If you think something is wrong, write to privacy@sourcepro.com.

10. Your rights

You may ask for a summary of your personal data and how it is used, to correct or complete it, to erase it where the law allows, and to nominate someone to act for you. Ask from My data in your account menu on SourcePro, or by email to privacy@sourcepro.com; each request shows the day its answer is due, at most 90 days after you ask. For your company's records your company answers; for your account we do. If you are not satisfied, write to our grievance officer (section 14).

11. Google and Microsoft data

SourcePro's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data from Microsoft 365 is used in the same way: only to send your RFQs and bring your vendors' replies onto them, never for advertising, and never read by people except with your consent, for security, or where the law requires it.

When a vendor replies with a quotation as a PDF or a photo, SourcePro can send that file, and only that file, to an AI model that reads its figures into a draft for you to check and confirm. The model is run for SourcePro by Microsoft Azure and may process the file outside India (section 6); it is not used to train any model, and nobody at SourcePro reads the file except with your consent, for security or where the law requires. Your company's administrator can switch this off.

12. Children

SourcePro is for companies and their staff; it is not meant for anyone under 18.

13. Changes

A new version of this policy shows its date at the top; your company's administrator is told of important changes. The cookie notice and the terms are part of how we work too.

14. Grievance officer

Grievance Officer, SourcePro Technologies Private Limited, Office 1, Example Business Park, Pune 411001. Email: privacy@sourcepro.com. Say who you are and what you ask; we answer within 90 days. If we do not resolve it, you may complain to the Data Protection Board of India.