Privacy

Scope

This notice covers the Certo Procure application, its supplier portal and the emails it sends. Certo's public website has its own privacy notice. Each customer organization's use of Certo Procure is also governed by the agreement signed with it.

Information we process

We process the information your organization, its users and its suppliers record to run the procure-to-pay flow:

• Accounts and access: each user's name, work email, language, companies and roles, and two-step verification data. Passwords are stored as a hash, never as text.
• Purchasing: requests, approvals and their comments, quotes, purchase orders, receipts (including the photo or PDF of a delivery), catalogs, budgets and cost centers.
• Invoices and electronic invoicing: supplier invoices and their lines, and the FEL document data (issuer, tax ID, authorization number and UUID, amounts and taxes) read from the XML, together with its match against the order and the receipt.
• Suppliers: legal name, tax ID, address, contacts, portal users, compliance documents (such as the RTU tax registration) and the bank accounts registered to pay them.
• Payments: payment proposals, withholdings, prepared payment files and confirmations.
• Attached documents: the files users or suppliers upload.
• Audit log: who took which action, when and with what result. It is never edited or deleted, because it supports internal control.
• Integrations: if an administrator connects a Google or Microsoft mail or calendar account, or an ERP, we process the access tokens and the data the enabled feature needs.

How we use it

We use the information to run your organization's purchasing, invoices and payments; apply its controls (approvals, matching, dual control and segregation of duties); send service notices and emails such as invitations and password recovery; provide support and protect the service. We do not sell personal information or use it for advertising.

Nova and AI features

Nova recommends and never decides: approvals, matches and payments are always confirmed by a person. When your organization turns it on, Nova processes the content each task needs (for example, a request and its lines, or the document you ask it to read) through Google Cloud Vertex AI.

Service providers and retention

Certo Procure runs on Google Cloud (Cloud Run, Cloud SQL, Cloud Storage and Secret Manager; Vertex AI for Nova). Service emails are sent through Resend. The service subscription is billed through Stripe, which takes no part in supplier payments. Google or Microsoft integrations are involved only if an administrator connects them.

We keep information for as long as needed to provide the service to your organization, meet applicable obligations, including tax and audit obligations, and protect our services.

Security

Each organization's data is isolated from every other organization's. Bank account numbers and integration tokens are stored encrypted, and screens show only the last four digits of each account. Files are scanned for malware before they become available, sessions expire and sign-in supports two-step verification.

Your choices

If you use Certo Procure as part of a customer organization, its administrator manages your account: you can ask them for access to, correction or removal of your data. If you are a supplier, ask your customer's purchasing team to change your tax details; bank accounts are changed through a request in the portal. In every case you can write to privacy@certo.team.

Data controller and contact

Certo is a product of Boldr AI · Central America. This notice is governed by the law applicable in Boldr AI's jurisdiction.

Certo · privacy@certo.team