PruvatoPrivacy Policy.
Last updated 25 September 2026.
This policy describes what Pruvato collects and does with your data.
Four categories, four different reasons.
Contact details. When you email us, we have whatever you sent — your name, email address, and anything else in your message. Used only to respond to you.
What you paste into the live demo. The RFQ text you paste at demo.pruvato.com is used to run the matching engine and shown back to you on screen. It is not sent to a customer, and not shared into another tenant's catalogue. On your first successful match, we set one first-party cookie — an opaque id, nothing else, lasting about a year — so we can tell a returning visitor from a new one; it's never used to track you elsewhere. We also keep the RFQ text itself, tied to that same id, so we can tell how many real visitors use the demo and how often — not to build a profile of any one visitor.
Aggregate visit and funnel counts, site-wide. We use Umami, a self-hosted, cookieless analytics tool running on our own UAE servers — never a third party, on every page including the live demo — to see how many people visit, and how many reach each step of the demo (paste, match, download), as aggregate counts only. It sets no cookie and cannot identify you individually. On the marketing pages only (never the live demo), we also run Google Analytics, a standard third-party cookie-based analytics tool — see “Who else sees it” below.
Your catalogue and quotes, if you connect your Zoho account. For a customer with an active connection, the matching engine reads your customers and price list to ground a quote in your real data, and writes a draft quotation back. What that connection can and can't do is fixed and enumerated — see “Who else sees it” below.
Retention, by category.
The demo. Your pasted RFQ text is kept for up to 30 days from when you paste it, then removed. The visitor-recognition cookie lasts about a year; if you clear it or don't come back, a later visit is simply treated as a new one. There is no sign-up and no account, so there is nothing else to delete.
A connected customer's data is held in two places, under two different rules. A permanent record — fingerprints of documents, verdicts of checks, identities that made decisions, timestamps — never contains your commercial values (amounts, customer names, quote content), which is what makes it safe to keep indefinitely. The actual quote content and read-back snapshots live separately, in an evidence store, under a retention policy you set — default: for as long as you're a customer.
Three named third parties, and nobody else.
Your accounting provider (Zoho, for a connected customer) sees whatever it needs to operate its own system — that's your existing relationship with them, not something we add. The connection itself is limited by design: it can create a draft quotation after you approve it, read your customers and price list, and read a quotation back to confirm it arrived as approved. It cannot send anything to your customer, change a quotation's status, edit or delete anything already in your books, or touch invoices or payments.
The AI model provider we use to parse RFQ text — the demo's and, for a connected customer, the real thing — sees the message text at the moment of parsing only. It does not see historical data, prices, or customer names, and does not retain what it saw. We don't sell data, and we don't use your commercial data to train anything.
Google, through Google Analytics — on the marketing pages only (never demo.pruvato.com), for standard, aggregate traffic reporting. It sees ordinary page-view data the way any website's analytics does; it never sees anything you paste into the live demo, which runs Umami instead (see above), not Google Analytics. We don't sell data, and we don't use your commercial data to train anything.
The application and all storage run on our own servers in the UAE, always. Pasting an RFQ into the live demo is handled end to end on that infrastructure with nothing in between — that connection doesn't route through a third-party network. Browsing the rest of this site is served through a content-delivery network for speed and abuse protection, which relays those pages' bytes on the way to you even though the application and storage behind them never leave the UAE either way.
The AI model provider routes through its own regional infrastructure; the specific region depends on the model and can be requested for a specific customer. Your accounting provider stores your data wherever you've already configured it to — that's outside our control, same as it always was.
Export, deletion, and asking what we hold.
As a connected customer, you can request deletion of your data in the evidence store at any time, and export everything in it in a portable format that doesn't require us to read it. You can ask what's been deleted and when.
To exercise any of these, or to ask a question this page doesn't answer: [email protected], subject “Privacy Request.” We reply within one business day.
If how we handle data changes in a way that matters, this page is updated and the “last updated” date above changes with it. We won't quietly narrow your rights under an old version by changing the words without changing the date.