Privacy Policy

We collect the following categories of information:

• Account information — name, work email, organization name, role, and password (stored only in hashed form).
• Content you provide — requisitions, RFQs, quotes, purchase orders, supplier records, budgets, inventory data, and any files or documents you upload (for example, supplier quotations in PDF or Excel).
• Usage data — log data such as IP address, browser type, pages viewed, and timestamps, used to operate and secure the Service.
• Cookies — strictly necessary cookies for authentication and session management. We do not use advertising cookies.

• To provide, maintain, and improve the Service.
• To authenticate users and secure accounts.
• To process the documents you upload — including extracting structured data from supplier quotations using AI — solely to deliver the features you request. We do not use your content to train third-party foundation models.
• To communicate with you about your account, security, and product updates.
• To detect, prevent, and address fraud, abuse, and technical issues.
• To comply with legal obligations.

We do not sell your personal information. We share information only as needed to run the Service:

• Service providers (sub-processors) — vetted vendors that provide cloud hosting, database, storage, email delivery, and AI processing on our behalf, under contractual confidentiality and data-protection obligations.
• Members of your organization — content is shared with other authorized users in your Seloria organization according to their roles.
• Legal and safety — when required by law, regulation, legal process, or to protect the rights, property, or safety of Seloria, our users, or the public.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this Policy.

Current sub-processors. We use the following vendors to operate the Service. Each is bound by data-protection and confidentiality obligations:

• Supabase — managed database, authentication, and file metadata. Customer data is hosted in the European Union (Germany).
• Cloudflare — application hosting, global content delivery, bot protection, and encrypted storage for uploaded files and database backups, located in Europe.
• Resend — delivery of transactional and notification emails.
• Anthropic — AI extraction of structured data from documents you upload. Your content is not used to train models.
• Sentry — error monitoring. When something fails in the app or on our servers, it receives the technical report: the error message, the page address (with sign-in codes removed), browser and operating system, the recent steps that led to it, and internal record identifiers. We do not send your documents or attach names or email addresses. Processed in the European Union (Germany).
• Google— optional single sign-on, used only if you choose “Continue with Google”.

We keep this list current as our sub-processors change. To request advance notice of changes, contact privacy@seloria.io.

We retain your information for as long as your account is active or as needed to provide the Service. We will delete or anonymize your information within a reasonable period after account closure, unless we are required to retain it to comply with legal obligations, resolve disputes, or enforce our agreements.

Your organization’s audit history is kept for 7years. When an administrator deletes the organization, we delete its business data, files and user accounts, and keep an internal archive of its audit history and basic identity (organization name, country, dates, and its users’ names and email addresses, stored encrypted) for 2 years from the deletion date, so we can help if you return or ask us to look something up. The archive is not accessible from the Service and is deleted automatically when that period ends.

We keep encrypted backups of the database for 30 days, only to recover from a system failure. Data permanently removed from the Service, for example when an organization is deleted, disappears from the backups as they expire, no later than 30 days after the deletion.

We use technical and organizational measures designed to protect your information, including encryption in transit, access controls, tenant isolation, and least-privilege roles. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Seloria LLC is organized in the United States and may process information in countries other than your own. Where required, we rely on appropriate safeguards for cross-border transfers.

Depending on your location, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To exercise these rights, contact us at privacy@seloria.io. If you use Seloria on behalf of an organization, please direct requests through that organization’s administrator.

The Service is intended for business use and is not directed to individuals under 16. We do not knowingly collect personal information from children.

We may update this Policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, provide additional notice where appropriate.

If you have questions about this Privacy Policy, contact us at privacy@seloria.io, or write to us at: