AcuSpend legal
Privacy Policy
This notice explains the information AcuSpend processes, how it is used and protected, how long it is kept, and how to exercise your privacy rights.
Last reviewed: October 18, 2026
1. Who is responsible for your information
For service-operation data, the controller is the AcuSpend operator. AcuSpend currently operates without an incorporated legal entity; incorporation in Bulgaria is planned. Controller legal name and registered address: [to be published here before AcuSpend opens to the public]. AcuSpend has not appointed a Data Protection Officer. Contact support@acuspend.com for operator and privacy information. Section 2 explains the distinction between workspace content and service-operation data.
2. Controller and processor roles
Your buying organisation controls the procurement content in its workspace: requests, briefs, supplier and quotation information, messages, documents, and decisions. AcuSpend processes that workspace content only to provide the service to your organisation, on its behalf and under the applicable service agreement and data processing terms; the organisation's instructions are expressed through its workspace members' ordinary use of the product and its administrator settings. For account, access-control, security, and service-operation data such as authentication records, audit logs, and support correspondence, and for the supplier contact details described in section 8, the AcuSpend operator acts as controller as described in section 1. If your personal data sits inside a customer workspace, address access, correction, or deletion requests to that organisation first; AcuSpend assists workspace administrators with verified requests.
3. Information AcuSpend processes
AcuSpend processes account and authentication information; profile and workspace membership details; free-sourcing applications (contact details and sourcing-profile answers submitted before signup); procurement requests and structured sourcing briefs; supplier, RFQ, quotation, and comparison information; recommendation and buyer-decision records; collaboration messages and activity history; and documents uploaded to the workspace. Depending on how you use the service, that information may include business contact details and other personal data contained in user-provided content.
4. Why we process it and the legal basis
Where the GDPR applies, AcuSpend processes information to create and secure accounts, provide workspace features, manage access, store and retrieve user content, and support requested procurement workflows. The expected legal bases are performance of a contract or steps taken at your request before a contract; legitimate interests in security, fraud prevention, service reliability, contacting suppliers on a client's behalf, and improving the service; compliance with legal obligations where applicable; and consent only where AcuSpend specifically asks for it, such as optional measurement. The applicable basis depends on the purpose and circumstances of the processing activity.
5. How access is limited
The application separates buyer workspaces from staff operations. Access is controlled through authenticated accounts, organisation membership, platform roles, tenant-aware access checks, and database Row Level Security. Buyers do not automatically receive internal sourcing notes, quotation data, supplier source documents, or comparison drafts. These controls reduce access but do not remove the need for users to manage their workspace memberships carefully.
6. Service providers and disclosures
Always-on processors: - Supabase: database, authentication, and private file storage. - Vercel: application hosting; only after optional measurement consent, performance measurements through Speed Insights and anonymous page-view counts through Web Analytics. Only when an administrator explicitly enables them: - Resend: controlled RFQ, support, and buyer-notification email. - OpenAI: assisted features (see section 7). - Exa: live supplier-discovery search (search terms only). - Cloudflare: scheduling of background checks and optional Turnstile abuse protection. - Sentry: error monitoring when a DSN is configured. Error reports exclude request data, user identity, breadcrumbs, and session replays. Each processor acts only on AcuSpend's instructions under its data processing terms. Contact support@acuspend.com for the current list of processors, their processing locations, and the agreements that apply to your service configuration. Staff VAT checks query the EU's public VIES registry, which is a verification lookup rather than a processor: only the VAT number itself is transmitted. AcuSpend may also disclose information to professional advisers, competent authorities, or another party where required by law or necessary to protect rights and safety. AcuSpend does not sell personal data, does not buy contact lists or enrichment data, and sets no advertising trackers.
7. AI processing and no-training commitment
Assisted features such as request analysis, clarification help, quote extraction, supplier-discovery search, and buyer Acu answers run on the configured provider. The default local provider processes content inside AcuSpend and sends nothing externally. Where an administrator enables OpenAI-backed features, only the minimum content needed for the task is sent through the OpenAI API with response storage turned off; OpenAI's API terms state that API content is not used to train models, and AcuSpend does not permit training on workspace content. Supplier-discovery queries sent to Exa contain only the search terms derived from the sourcing brief. AI output is advisory and human-reviewed: no automated step selects a supplier, enters a contract, or awards a purchase (see section 13). If a new AI provider is introduced, this notice will name it and fresh consent or agreement will be obtained where required before activation.
8. Suppliers AcuSpend contacts
When a client asks AcuSpend to source a product or service, AcuSpend staff may contact suppliers to request quotations. For this, AcuSpend processes supplier business contact details: company name, contact person, business email address and phone number, website, location, and VAT number, together with the quotations and replies the supplier sends. Sources: the supplier's own website and other public business sources found by staff or by supplier-discovery search, and information the supplier provides to AcuSpend. Purpose and legal basis: requesting, receiving, and comparing quotations for AcuSpend's clients, based on AcuSpend's and its clients' legitimate interest in sourcing goods and services. Supplier details and quotations may be shared with the client that requested the sourcing. Your choice: every RFQ email links to this notice. A supplier can ask AcuSpend at any time to stop contacting them by replying to an RFQ or writing to support@acuspend.com. AcuSpend then marks the supplier as do not contact, cancels any queued emails, and blocks future RFQs to them. AcuSpend keeps only the minimum record needed to honour that request.
9. International transfers
AcuSpend's production database, authentication, and file storage are hosted by Supabase in the European Union (Ireland), and the application's server functions run in Vercel's Dublin region. Some providers are based in, or may process data in, the United States or other countries outside the EEA: Vercel's global network that delivers pages, and, when enabled, OpenAI, Resend, Sentry, Exa, and Cloudflare. For those transfers AcuSpend relies on the safeguards in each provider's data processing terms: the EU–US Data Privacy Framework where the provider is certified, or the European Commission's Standard Contractual Clauses. Contact support@acuspend.com for a copy of the relevant safeguards.
10. Retention and deletion
AcuSpend keeps information only as long as it needs it: - Account, profile, and workspace content: while the account or workspace is active. A closed workspace, including its requests, documents, and files, is erased 12 months after it is closed, or earlier on the customer organisation's verified request. - Activity and audit history: 24 months. - AI assistance logs and agent traces: 12 months. - Free-sourcing applications: 12 months after the last update. - Email delivery and provider callback records: 90 days. - Sign-in and abuse-protection counters: 30 days. These hold keyed hashes, never raw IP addresses. - Optional measurement events, which contain no identifiers: 13 months. - Commerce customer snapshots: 90 days unless a store sets an override; Shopify-mandated redaction always takes precedence. - Supplier contact details: while they remain useful for sourcing for clients, or until the supplier asks AcuSpend to stop contacting them or to delete them. Expired records are deleted automatically every day. Deleted data leaves AcuSpend's hosting provider's rolling backups when those backups expire. AcuSpend may keep information longer where the law requires it or to establish or defend legal claims.
11. Security
AcuSpend uses authenticated access, role and organisation checks, Row Level Security, private document storage, and server-side secrets for configured integrations. These measures are designed to reduce unauthorised access; no online service can promise absolute security. Users must protect credentials and report suspected security incidents through the applicable AcuSpend support channel.
12. Your privacy rights
Subject to applicable law, you may have rights to request access, correction, erasure, restriction, objection, portability, and information about processing. Where processing relies on consent, you may withdraw it at any time. You may also complain to the data-protection authority where you live or work; in Bulgaria this is the Commission for Personal Data Protection (cpdp.bg). How to make a request: write to support@acuspend.com, ideally from the email address on your account so AcuSpend can verify you. If that is not possible, AcuSpend will ask for the minimum information needed to confirm your identity; do not send identity documents unless asked. AcuSpend replies within one month, which can be extended by two further months for complex requests, in which case you are told why. What to expect: an access or portability request is answered with a structured, machine-readable (JSON) copy of your data. An erasure request removes your account, profile, memberships, and preferences. Records you wrote inside a customer workspace, such as messages, approvals, or decisions, belong to that customer organisation; AcuSpend keeps them under an anonymous ID unless the organisation asks for them to be deleted.
13. Cookies, local storage, and automated processing
Strictly-necessary cookies keep you signed in (Supabase session cookies) and protect access to non-public environments such as staging. Your device's local storage keeps your theme choice, your cookie decision, and whether you have dismissed one-time product tips; these stay on your device and are never sent to AcuSpend. AcuSpend sets no advertising or cross-site tracking cookies. When you explicitly allow optional measurement, AcuSpend records only a fixed event type, its on-page placement, and a server timestamp for landing-page views, request CTA clicks, pilot-form starts, and successful pilot submissions. The same consent also enables Vercel Speed Insights at a 25% sample rate and Vercel Web Analytics, which counts page views without cookies using the page path, referring site, and coarse browser, device, and country information. Paths are cleaned before sending, so no query string, invitation token, or record ID is included, and staff and sign-in pages are never measured. AcuSpend sends that service a normalized route label and performance measurements only: no email address, query string, form response, workspace content, invitation token, or record ID. Declining keeps the platform on necessary-only storage, and browsers broadcasting a Global Privacy Control signal are treated as Decline. You can change your choice at any time with the “Cookie preferences” control in the page footer; the updated consent version will ask again before optional measurement resumes. The product supports human-reviewed procurement workflows and does not make an automated decision that independently selects a supplier, enters a contract, or awards a purchase.
14. Children and updates to this notice
AcuSpend is designed for business procurement use and is not intended for children. Do not knowingly submit children's personal data through the service. This notice may be updated as the service, legal operator, providers, or data practices change. The review date is shown above. Contact support@acuspend.com with privacy questions.