Privacy Policy — procure.bn AI Assistant

procure.bn is committed to protecting your privacy and handling your personal data in a transparent and responsible manner, in accordance with applicable data protection laws of Brunei Darussalam.

1. Who We Are

The procure.bn AI Assistant is operated by procure.bn ("we", "us"). If you have any questions about this Privacy Policy or how we handle your data, please contact us at support@procure.bn.

2. Information We Collect

When you register for and use the Assistant, we collect the following categories of personal information:

Data Category	Examples	Purpose
Identity data	Full name, username	Account creation and identification
Contact data	Email address, phone number	Account notifications and support
Organisational data	Company or department name	Access management
Authentication data	Hashed password, MFA secret, SSO provider	Secure account access
Usage data	Questions asked, login timestamps, IP address	Service improvement and security monitoring

3. How We Use Your Information

We use your personal information to:

Create and manage your user account
Authenticate your identity and protect your account
Respond to your queries through the Assistant
Send you account-related notifications (approvals, password resets)
Monitor and improve the security and performance of the service
Comply with legal obligations

4. Data Storage and Security

Your data is stored securely on servers hosted within a managed cloud environment. We implement appropriate technical and organisational measures to protect your personal data, including:

Bcrypt password hashing — passwords are never stored in plain text
JWT-based session authentication with 8-hour expiry
Two-factor authentication (optional for users, mandatory for administrators)
Rate limiting and security headers on all API endpoints
HTTPS encryption for all data in transit

5. Data Retention

We retain your personal data for as long as your account is active. Activity logs are retained for a maximum of 12 months. If you wish to have your account and associated data deleted, please contact support@procure.bn.

6. Third-Party Services

The Assistant uses the following third-party services to operate:

Groq — AI language model processing (query responses)
Voyage AI — Document embedding and semantic search
Resend — Transactional email delivery
Microsoft Azure — Optional Microsoft account authentication
Google — Optional Google account authentication

Please note that questions you submit to the Assistant are processed by Groq's API. We recommend that you do not include sensitive personal information in your queries.

7. Your Rights

You have the right to:

Access the personal data we hold about you
Request correction of inaccurate data
Request deletion of your account and associated data
Withdraw consent where processing is based on consent

To exercise any of these rights, please contact support@procure.bn.

8. Cookies

The Assistant does not use tracking or advertising cookies. We use only technically necessary session mechanisms (JWT tokens stored in browser memory) to maintain your authenticated session.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be reflected by the "Last updated" date at the top of this page. Continued use of the Assistant following any update constitutes your acceptance of the revised policy.

10. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy, please contact us at support@procure.bn.