Privacy Notice

Proquri is operated by Nastrond Harridsleff (org. nr. 936 340 369), made in Oslo, Norway. For anything in this notice, or to exercise any of the rights below, contact us at privacy@proquri.com.

Proquri helps you track, understand, and negotiate your company's SaaS contracts. To do that, we process the account details you give us, the contract documents you upload, and how you use the app — including sending contract text to a small number of AI providers to extract and analyze it. We never sell personal data. This notice explains what we collect, why, who we share it with, and the rights you have over it — including a dedicated section on GDPR, since it applies to us directly as a Norwegian (EEA) company, not only because some of our customers are in the EU.

• Account data: your name, work email, company name, and password (stored hashed, never in plain text) when you sign up; your company's headcount and, if you choose to give it, the country it's based in.
• Contract documents and their extracted content: the PDFs you upload, and every field our AI extracts from them — pricing, terms, renewal dates, and so on. The contract text itself can include personal data about people who aren't you or your organization — for example signatory names or contact details. We don't extract or keep the name of your vendor's sales representative as a field of its own.
• Negotiation and usage records: notes and updates you log against a contract, messages you send to the AI Deal Copilot chat, and corrections you make to extracted fields.
• Billing data: handled directly by Stripe when you subscribe to a paid tier — we never see or store your card number.
• Technical data: standard connection logs (IP address, timestamps) our infrastructure generates automatically, and the date and time you were last active in the app.
• Cookies and similar technologies: see our Cookie Policy for the full detail — in short, a strictly-necessary login session and Google Analytics on our public website and on our invite-only demo environment, sandbox.proquri.com, including its signed-in pages (never inside the signed-in app on proquri.com), with your prior consent.

We share personal data only with the service providers that help us run Proquri, and only to the extent each one needs to do its job. See the table below for the full list, what each one does, where it processes data, and its data protection safeguards. We never sell personal data, and we never share contract documents with any other customer — the anonymized benchmarking pool is the one place data crosses between customers. Only structured, rounded or grouped values go into it — for example a price per unit, a seat-count band, the signing month, a notice period rounded to 15 days, yes/no terms, your company's country and region, the contract's annual value in euros rounded to two significant figures with its size band, and — when a negotiation closes with a signed agreement — the agreed price change as a whole percentage, which recommended terms were raised and achieved, the month it takes effect and the vendor and product; and when a renewal takes effect without a negotiation, the price change and what the contract's price-escalation clause allowed — never contract text, names or other free text, never an exact amount, and never a reference that identifies you, your users or your contracts, so it can't be traced back to you or your contract. Each pool entry carries only a code computed from your account with a secret key held only by Proquri, used only to count how many different customers contributed. It is never shown to anyone, and Proquri does not use it to identify which customer contributed an entry.

Other customers only ever see aggregates from the pool — medians and ranges, percentages, counts and size-band labels, and only once enough customers contribute (at least three customers, and at least five for a narrower view such as a country, region or contract size). They never see another customer's amounts or individual result.

We use aggregated, anonymised pool data to review and adjust our ratings, estimates and recommendations. Such changes are reviewed and decided by Proquri staff, not made automatically.

Several of our service providers process data in the United States. Every transfer outside the EU/EEA relies on Standard Contractual Clauses as its primary safeguard — we don't rely on the EU-US Data Privacy Framework alone, given its currently uncertain status under active legal challenge. See the subprocessor table above for the safeguard used for each provider.

We keep your account and contract data for as long as your account is active, plus a reasonable period afterward for backups and legal/accounting requirements. If you delete your account, we delete your account and contract data within 30 days of your request; residual copies in encrypted backups are purged on a rolling cycle within 90 days. We keep billing records for as long as we're required to by law. Anonymized benchmark data, which holds no reference that identifies you, your users or your contracts (described above), is retained indefinitely as aggregate market data, since it isn't personal data about you.

Under GDPR, and wherever else applicable law gives you these rights, you can ask us to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your data ("right to be forgotten")
• Restrict or object to certain processing
• Receive your data in a portable format
• Withdraw consent at any time, for anything we process based on consent (like analytics cookies), without affecting processing before that point

To exercise any of these, email privacy@proquri.com. You also always have the right to lodge a complaint with a supervisory authority — ours is Datatilsynet (the Norwegian Data Protection Authority, datatilsynet.no), or, if you're in the EU/EEA, your own country's data protection authority.

Nastrond Harridsleff is established in Oslo, Norway — an EEA state where GDPR applies as national law via the EEA Agreement. That means GDPR is our own primary data protection law from day one, for every user, not a rule that only attaches because a customer happens to be based in the EU.

A few specific points worth being explicit about:

• Controller vs. processor: For your own account data, we're the data controller. For the personal data of third parties that appears inside contracts you upload — like a signatory's name in the contract text — we also act as a controller for our own processing purposes (extraction), separately from your own relationship with your vendor. Such names never enter the anonymized benchmarking pool.
• Legal basis: see the table above for each processing activity.
• International transfers: see the section above — Standard Contractual Clauses as the primary safeguard for every transfer outside the EEA.
• Your rights: see the section above — the same rights apply regardless of where you or we are located, since GDPR is our own law, not a foreign standard we extend as a courtesy.

Proquri is a business tool built for procurement and IT professionals. It isn't directed at, and we don't knowingly collect data from, anyone under 16.

Proquri staff can see account information needed to run and support the service: company and user names, email addresses, roles, sign-up and last-active dates, your plan, counts of your contracts, reports and negotiations, which vendors and products you have contracts with, and how many AI Deal Copilot questions have been asked per contract (a count only — never the questions or answers). Our internal tools do not give staff access to your contract documents or their contents, prices, comments, negotiation notes or AI Deal Copilot conversations. Staff also see portfolio-wide totals across all customers — the combined annual value of the contracts in Proquri, the number of negotiations closed and the savings achieved — never any single customer's figures. Staff also see aggregated statistics from the anonymised pools in our internal Insights pages — counts, medians and ranges across several customers, never a single customer's result. When an account is created, staff are notified by email with the name, email address and company entered (plus the role for someone who joins through an invitation, and the marketing-email choice for a sandbox demo account).

On our invite-only demo environment, sandbox.proquri.com, we measure how the demo is used with Google Analytics only after you accept it in the cookie banner, in a data stream kept separate from our public website's. No account data is sent to Google — not your name, email address or company, nor any user, organization or role identifier; Analytics receives a page's address without any query string or vendor name. Measurement of a demo account stops when the account is deleted, 14 days after sign-up.

We use encryption in transit and at rest, isolate each customer's data from every other customer's, and contribute only structured, rounded or grouped values — never text or names — to the benchmarking pool shared across customers. No system is perfectly secure, and we'll tell you if that ever matters to your data specifically.

We'll update the effective date above whenever we make a material change, and for significant changes, we'll make a reasonable effort to let active customers know directly.

privacy@proquri.com — Nastrond Harridsleff, made in Oslo, Norway.