1. Who is responsible
Nextoria Information Technology LLC, of Al Garhoud, Dubai, United Arab Emirates, is the controller of the personal data described here. You can reach us at info@purchosmart.com.
Two different groups of people appear in this policy: the buyers who hold accounts with us, and the suppliers our agent contacts on a buyer's behalf. Both are covered, and the differences are called out where they matter.
2. What we collect
- Account data
- Your name, email address, password (stored only as a hash), mobile number, company name, city and address, your base currency, and your profile picture if you sign in with Google. We record when you signed up, when you last signed in, and failed sign-in attempts so that we can lock an account under attack.
- Request data
- Everything that describes a sourcing job: the product, the quantity, the specification, the country and region, your delivery location, notes you write, and any document you upload — including previous invoices and quotations, which may contain the name and price of a supplier you already use.
- Conversation data
- The clarification chat you have with us when you create a request, including voice notes you record, which are transcribed so they can be read.
- Call data
- For each supplier called on your behalf: the number dialled, the time and duration, an audio recording of the connected call, a transcript, a summary, and the quote details extracted from it. WhatsApp and email follow-ups and any replies are stored the same way.
- Supplier data
- Business contact details for the suppliers a request reaches — company name, telephone number, address, website and business email — obtained from public listings and search results, or supplied by you.
- Billing data
- If you pay by card: your Stripe customer reference, the plans and extra minutes you have bought, the amounts paid, invoice numbers and billing dates. We also show the card's brand, last four digits and expiry date on your Billing page; we read these from Stripe when the page loads and do not store them.
- Usage and technical data
- Talk minutes consumed, requests run, plan status, and the ordinary technical records a web application produces: IP address, browser and device type, timestamps, and error logs.
Card payments are handled by Stripe, our payment provider (see section 5). Your card details are entered on Stripe's payment page, and we never receive or store your full card number or security code. We do not knowingly collect special categories of personal data, and you should not upload them.
3. Why we use it, and on what basis
- To perform our contract with you: creating and securing your account, running your requests, placing calls, sending follow-ups, producing reports and emailing them to you, measuring your usage against your plan, and taking payments and sending you invoices and receipts.
- For our legitimate interests: keeping the service secure and available, preventing abuse, diagnosing faults, understanding aggregated usage so we can improve the product, and contacting suppliers to obtain the quotations a buyer has asked for.
- With your consent, where consent is what applies: optional marketing email, and sharing your WhatsApp number with a supplier — which happens only if you have chosen to provide it.
- To comply with legal obligations, including tax, accounting and lawful requests from a competent authority.
We do not use your data to train general-purpose AI models, and we do not sell personal data to anyone.
4. Calls, recording and transcription
Calls, recordings and transcripts are the part of the service that collects the most personal data, so they are set out separately.
When you submit a request, an automated voice agent telephones suppliers. Those calls are recorded and transcribed, and the recording, transcript and extracted quote are stored against your request and shown in your account. The agent identifies itself as an automated assistant calling about a purchase enquiry.
A supplier who asks not to be called is not called again for that request, and a supplier may ask us to remove their details or the recording of their call by writing to the address at the end of this policy.
Recording law varies by country. Where you ask us to call suppliers outside the United Arab Emirates, you are responsible for ensuring that the enquiries you have asked for may lawfully be made and recorded there.
6. Google user data
Information we receive from Google APIs is covered by this section — when you sign in with Google, and when you connect a Gmail account so that supplier outreach is sent from your own address.
- What we access
- With Google Sign-In: your name, email address and profile picture. With a connected Gmail account: permission to send email on your behalf (the gmail.send scope) and the email address of that account. We cannot read, search, list or delete the mail in your inbox, and we do not request any scope that would allow it.
- How we use it
- Only to provide the features you asked for: signing you in, and sending the supplier quotation requests, reminders and follow-ups that you create or approve in PurchoSmart, from your own address. The content of those messages is written by you or by PurchoSmart. It is not obtained from your mailbox.
- How we store it
- The access and refresh tokens Google issues are encrypted at rest and are never shown to anyone, including our staff. We keep a record of the messages we sent for you so that supplier replies can be matched to the right request.
- Sharing
- We do not sell Google user data. We do not share it with third parties, except as needed to provide the feature (Google itself, to send the email), to comply with the law, or as part of a merger or acquisition with your notice. No person reads your Google user data unless you ask us to for support, it is needed for security, or the law requires it.
- Deleting it
- Disconnect the mailbox in PurchoSmart settings and we revoke the grant with Google and delete the stored tokens immediately. You can also remove access at any time from your Google Account (myaccount.google.com/permissions). To delete your account and everything in it, use Delete account on your Account page, or write to us at the address in section 14.
No AI or machine-learning training. Google Workspace APIs are not used to develop, improve, or train generalized or non-personalized AI and/or ML models. We do not use data obtained through Google Workspace APIs, including Gmail, for that purpose, whether in our own models or a third party's, and we do not transfer it to anyone for that purpose. Supplier replies reach us through our own reply address, not by reading your Gmail.
The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. PurchoSmart's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
7. Where your data goes
We are based in the United Arab Emirates, and several of the providers above process data in the United States and the European Union. That means your data may be transferred outside the UAE.
Where it is, we rely on the provider's contractual commitments — including standard contractual clauses where they apply — to keep it protected to the standard described in this policy.
8. How long we keep it
- Account data: while your account is open, and for a reasonable period afterwards to settle accounts and meet legal and tax obligations.
- Payment records (invoices, receipts, amounts and dates): for as long as the law requires us to keep financial records, even after your account is closed.
- Requests, quotes, recordings and transcripts: while your account is open, so that a past price can be compared against a new one. Deleting a request in the dashboard removes its quotes, recordings and transcripts from PurchoSmart.
- Deleting your account (Account page → Delete account) removes your profile, requests, quotes, call details and connected mailboxes from PurchoSmart straight away, cancels any subscription and removes your saved card. Only de-identified payment records are kept, as described above.
- Call recordings and transcripts held by our voice-call provider: these may be kept after you delete a request or your account, for quality, security and legal purposes.
- Supplier contact details: while they remain useful for sourcing, and removed on a supplier's request unless we must keep them.
- Technical and security logs: a short period, typically measured in months.
When we no longer need personal data we delete it or de-identify it so that it can no longer be linked to you.
9. Security
Traffic to the site is encrypted in transit. Passwords are stored only as hashes. Access to production data is restricted to the people who need it to run the service, sign-in is rate limited, and repeated failed attempts lock an account.
No service can promise perfect security. If a breach affects your personal data we will tell you and any regulator we are required to tell, without undue delay.
10. Your rights
Subject to the law that applies to you, you may ask us to:
- give you a copy of the personal data we hold about you;
- correct anything inaccurate — most of it you can edit yourself on your account page;
- delete your data, including your account and everything on it — you can do this yourself with Delete account on your account page;
- restrict or object to a particular use, including any use based on our legitimate interests;
- withdraw a consent you gave, without affecting what was done before you withdrew it;
- provide your data in a portable format.
Write to info@purchosmart.com and we will respond within thirty days. If you are not satisfied with our answer you may complain to your data protection authority.
Suppliers who have been contacted by our agent have the same rights, and may write to the same address to ask what we hold, correct it, or have it removed.
12. Children
The service is for business use and is not directed at anyone under 18. We do not knowingly collect data from children, and we will delete it if we discover we have.
13. Changes to this policy
We may update this policy. The date at the top of this page shows when it last changed substantively, and we will tell you by email or in the product before a material change takes effect.
14. Contact
Questions, requests and complaints about privacy go to info@purchosmart.com, or by post to Nextoria Information Technology LLC, Al Garhoud, Dubai, United Arab Emirates.