Privacy Policy
Written from the schema outward. Section 02 lists what the database actually holds, item by item, in terms specific enough to check.
Scope
This policy covers the Purceivo web application, its API and the emails it sends. Purceivo is a business service; most of what it holds describes a firm. The personal data it does hold is listed below, in full.
What we collect
Everything below is either given to us by you or generated by your use of the product. We do not buy personal data, and we do not enrich your record from third-party data brokers.
Account and identity
- Your name and work email address.
- A bcrypt hash of your passphrase. The passphrase itself is never written to disk and cannot be recovered from the hash. If you lose it, we reset it.
- Your role in the firm (owner, admin or member), and which firm you belong to.
- If you enable two-factor authentication, the secret needed to verify your codes.
- Pending email-change requests, until they are confirmed or expire.
Your firm profile
- Firm name, trading name, website, headquarters, year founded, headcount and revenue band.
- Capabilities, industries, NAICS codes, set-aside eligibility, geographies served, contract types and preferred role.
- Your contract value window, your relevance floor, and your hard exclusions.
- Free-text you write about your firm and its representative past work.
- A primary contact name and email.
What your firm does in the product
- Triage decisions (watch, pursue, pass), with who made them and when.
- Reasons and notes recorded when declining a solicitation.
- Comments and annotations your colleagues write on items.
- Bid outcomes you record: pursued, submitted, won, lost.
- Coverage requests: solicitations you told us we should have had.
- Pursuit workspaces: the compliance matrix, outline, calendar, colour-review verdicts and findings for each bid your firm opens, with who changed what and when. Purceivo practitioners can see a pursuit only while a firm administrator has shared it with us, and lose access the moment it is withdrawn.
- Notification preferences, and whether a notification has been read.
- Invitations you send: the invited email address, the role offered, and who sent it. Only a hash of the invitation token is stored, never the token itself.
- An activity feed of firm-level events, so a colleague's action is never invisible to the rest of the desk.
Technical and security records
- Sessions: a random session identifier, the account it belongs to, its expiry, and the IP address and browser user-agent string captured when the session was created, so you can review and revoke your own active sessions.
- Audit log: security-relevant events (sign-in, failed sign-in, passphrase change, invitation, firm deletion and similar), each with the acting account, the IP address, and a short description.
- API keys and webhooks you create: the endpoint, a hash of the key, and its metadata. A key's secret is displayed once at creation and stored only as a hash.
- Spend ledger: per-call model cost and token counts for your firm, so spend can be capped and shown to you.
- Ordinary server logs generated by our hosting provider, which include IP addresses and request paths.
What we do not collect
We also do not collect payment card numbers (when billing exists, a payment processor will handle card data and we will not see full card numbers), government identifiers, precise geolocation, biometrics, or any special-category personal data. Do not put such data into free-text fields; the product has no use for it.
We do not sell personal data, and we do not share it for cross-context behavioural advertising, under the CCPA's definitions of those terms or any other.
Why we process it
| Purpose | Data used | Basis (UK/EU GDPR) |
|---|---|---|
| Provide the service | Account, firm profile, product activity | Performance of a contract |
| Score solicitations for your firm | Firm profile, firm memory, solicitation text | Performance of a contract |
| Keep accounts secure | Sessions, audit log, IP addresses | Legitimate interests: security |
| Send notifications you asked for | Email address, notification preferences | Performance of a contract |
| Cap and account for model spend | Spend ledger | Legitimate interests: running the business |
| Meet legal obligations | Whatever a specific obligation requires | Legal obligation |
We do not use your data for automated decisions producing legal or similarly significant effects on any individual. Scoring judges a solicitation's fit to a firm and makes no judgement about any person.
Where your data goes: the model provider
This is the disclosure most relevant to a firm deciding whether to put its profile into our product, so it gets its own section.
To score a solicitation we transmit, to our model provider (Anthropic, operating the Claude API):
- the text and metadata of the solicitation being scored;
- your firm profile, including your capabilities, past-performance text, exclusions and contract window; and
- your firm memory: the durable signals derived from bids you have won, lost or declined.
We do not transmit your colleagues' names, your email addresses, your comments, your session records or your audit log to the model provider.
Anthropic's commercial terms state that inputs and outputs submitted through their API are not used to train their models. We rely on that commitment, we do not independently control it, and we would rather point you at their terms than have you take our summary for it.
A deterministic pre-filter runs before any model call and rejects solicitations on your own stated criteria: exclusions, contract window and deadline. Anything the pre-filter rejects is never sent to the model at all. It exists to control cost, and it has a real privacy effect: the large majority of the corpus is never transmitted anywhere.
Solicitation data is not your data
The corpus itself (solicitations, amendments, attachments and extracted text) comes from public procurement sources such as SAM.gov and, in future, other portals and feeds. It is public record information about government and institutional purchasing. It holds no personal data about you, and it is shared across the service instead of held per firm.
What is scoped to your firm is the judgement layer on top of it: your scores, your rationales, your withheld record, your triage. Those are yours and are never exposed to another firm.
Who else touches it
A current list of every subprocessor, what each receives and why, is maintained at Subprocessors. In summary: a hosting provider, a model provider, and an email delivery provider.
We may also disclose data if required by law, to protect against fraud or a security threat, or in connection with a merger or acquisition. In that case this policy travels with the data and you would be told before it becomes subject to a different one.
How long we keep it
| Record | Retention |
|---|---|
| Account & firm profile | Until the firm is closed or the seat is removed |
| Product activity, comments, bid ledger | Until the firm is closed |
| Sessions | Expire 30 days after sign-in; expired rows are deleted automatically |
| Audit log | Retained while the account exists, as a security record |
| Invitations | Until accepted, revoked or expired |
| Spend ledger | Retained for billing and accounting purposes |
| Solicitation corpus | Retained indefinitely, as public record data that belongs to no customer |
| Backups & hosting logs | Limited period set by our hosting provider, then overwritten |
Closing a firm genuinely deletes its records. The deletion cascades through every table keyed to the firm. Nothing is soft-deleted, and there is no shadow copy kept for our own purposes. Data may persist briefly in backups after deletion until those backups age out.
Your controls and your rights
Inside the product, without asking us:
- See and correct your account details and your firm profile from the settings page.
- Export your firm's data as JSON. An administrator can do this at any time.
- Revoke active sessions and API keys.
- Delete the entire firm, by typing its exact name to confirm.
- Choose which notifications you receive.
Depending on where you live, you may also have rights to access, correct, delete, restrict or object to processing, to data portability, and to withdraw consent, including under the UK/EU GDPR and the CCPA as amended. We extend the substance of these controls to everyone, whatever your jurisdiction.
Write to privacy@purceivo.com and we will respond within 30 days. We will not charge you for a request, and we will not discriminate against you for making one. If you are unsatisfied, you may complain to your local data protection authority.
If your firm's administrator asked us to process data about you, we may direct your request to them, since they control that account.
Security
How accounts and data are protected, and which assurances we do not yet have, is set out at Security. We list the gaps openly and claim no certification we have not earned.
Where it is stored
Data is stored and processed in the United States. If you use the service from outside the US, you are sending your data to the US, where privacy law differs from your own. Where a transfer of personal data out of the UK or EEA requires a safeguard, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) with the relevant subprocessor.
Children
Purceivo is a business service, is not directed at children, and is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, write to us and we will delete it.
Changes to this policy
The version and dates at the top of this document change when the document does. Material changes are notified by email to account administrators before they take effect. We will not retroactively reduce your rights over data already collected without asking you.
Contact
Purceivo LLC (in formation)
[ registered address, on formation ]
privacy@purceivo.com
Related: Terms of Service · Subprocessors · Security · Cookie Notice