Privacy Policy
Last updated: October 28, 2026
MaterialPro Technology Limited ("we," "us," or "MaterialPro") takes your privacy seriously. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use www.materialpro.io and related services (the "Service").
MaterialPro Inc. markets the Service in the United States. Your contract and billing are with MaterialPro Technology Limited, a company incorporated in Hong Kong, which is the controller of the personal data described in this Policy.
- MaterialPro Technology Limited, Unit 619B, 6/F, Tower B, New Mandarin Plaza, 14 Science Museum Road, Tsim Sha Tsui, Hong Kong
This policy describes the information collected, its purposes, recipients, retention and processing locations, and how you can exercise your rights. Review it before submitting personal information.
MaterialPro Technology Limited, a company incorporated in Hong Kong, is responsible for the personal data we collect for our own purposes, such as account, billing, support and website data. When your organization uploads information about its staff, suppliers, projects or other people to the Service, your organization decides what is collected and why; we process that information on its behalf and on its instructions, under our Terms of Service.
1. Data We Collect
Information may be collected when you register, use the service, upload documents or submit an inquiry:
Required account, workspace and supplier fields are marked in the collection form. Without required information, we cannot complete the requested setup. Other profile details are optional. Marketing updates require a separate opt-in and are not required to use the Service.
1.1 Data You Provide
- Account data: name, email address, phone number, company name, and job title
- Payment data: billing address and payment method (securely handled by Stripe — we never store full card numbers)
- Communications: messages you send via forms, email, or support
- Documents and content you upload, including supplier, project and procurement information
- AI inputs and outputs: document images and text, messages, relevant workspace records and workflow context used when you request AI features
1.2 Data Collected Automatically
- Device and browser information (type, operating system, language settings)
- IP address and approximate location
- Usage data (page views, feature usage, and action timestamps)
- Data collected through cookies and similar tracking technologies
2. How We Use Your Data
We process information electronically through the platform for these purposes:
- Provide and maintain the requested service, including AI processing when you use AI features
- Set up your account and verify your identity
- Process payments and manage billing
- Send service notifications, such as system updates and security alerts
- Respond to your inquiries and provide customer support
- Analyze service usage and operational errors to improve the service
- Detect and prevent fraud and unauthorized activity
- Comply with applicable laws and regulations
3. Sharing and Disclosure
We do not sell your personal information. Information may be shared with your organization’s authorized users, suppliers involved in your procurement workflow, and the following recipients as needed:
- Service providers: We use trusted service providers to operate the platform, including providers for web hosting, database and file storage, authentication, payments, email, background processing and document processing. AI features send relevant uploaded documents, messages and context to third-party AI model providers. These providers process only the information needed for the requested feature. We also use third-party services for support chat and usage analytics.
- Legal requirements: We may disclose your data when required by law or in response to valid legal process.
- Business transfers: If we're involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction.
- With your consent: We may share your data with others when you give us your explicit consent.
See the full list of our subprocessors, with each one's purpose and location.
3.1 AI processing and review
AI features use third-party models to extract document fields, answer questions and assist configured procurement workflows. Inputs may include names, contact details and other personal data contained in your documents or workspace. Only provide data needed for the task. AI output may be inaccurate: review extracted fields and workflow recommendations before approving orders, invoices or payments. AI requests are routed only to vetted inference hosts in the United States or European Union that do not store prompts or train on them (see Subprocessors).
4. Data Security and Breach Notification
We encrypt data in transit with TLS and at rest with AES-256. Row-level security keeps each workspace's data separate, every request is checked against the user's permissions, and sign-in uses one-time codes with optional two-factor authentication that a workspace can require. No internet transmission or electronic storage is completely secure.
See our Security page for details.
If we become aware of a data breach involving personal data we hold, we will act promptly to contain it and assess the risk of harm. Where applicable law requires, we will notify the relevant data protection authority and affected individuals, or the customer organization on whose behalf we process the data, within the time that law sets. Section 9 sets out jurisdiction-specific requirements (Hong Kong, Singapore, Malaysia, Taiwan and the United States).
5. Data Retention
We retain personal information while it is needed to provide the service, handle account and support requests, and meet applicable legal requirements. Canceling a subscription does not itself delete a workspace. You may contact us to request deletion; records that must be retained by law and data in backups may have a different retention period. Transient checkpoints for completed or failed workflow executions are eligible for cleanup after 30 days; pending human reviews are preserved. This cleanup does not delete your chat messages or approval history.
6. Cookies and Analytics
We use cookies and similar technologies to:
- Keep you signed in and maintain your session
- Remember your preferences
- Support service operation and diagnose errors
- Measure how visitors use our website
Our website uses Google Analytics, a web analytics service provided by Google. Google Analytics sets cookies whose names begin with _ga to distinguish visitors and sessions, and collects information such as the pages you view, your approximate location derived from your IP address, and your device and browser details. We use this information in aggregate to understand and improve our website. Google processes it under its own privacy terms, and it may be processed outside your country or region. You can opt out by installing the Google Analytics Opt-out Browser Add-on, by blocking or deleting these cookies in your browser, or by turning analytics off under Your Privacy Choices (section 9.5). Our support chat, provided by Crisp, also uses cookies to keep your conversation available as you move between pages.
You can manage or disable cookies in your browser settings, though doing so may affect some features of the Service.
7. Your Rights
Depending on the data protection law that applies to you, you may have the right to:
- Access, inspect or receive a copy of your personal information
- Supplement or correct your personal information
- Delete your personal information
- Stop collection, processing or use of your personal information
- Request an explanation of how your personal information is used
- Withdraw consent where processing is based on consent
- Receive personal data you provided to us in a structured, commonly used format, or ask us to transmit it to another organization, where the law provides a right to data portability
- Opt out of direct marketing at any time, free of charge
To make a request, email our Data Protection Officer at dpo@materialpro.io or use the contact details in section 12. We may need to verify your identity before acting on a request. We will respond within the time required by the law that applies to you (see section 9) and, if we cannot meet a request in full, we will explain the legal basis for that. Where the law permits, we may charge a reasonable fee for providing a copy of your data and will tell you the amount first. If your data sits in a workspace controlled by your employer or another organization, we may refer your request to that organization. You may choose not to provide information; without required account or contact details, we may be unable to create an account, answer an inquiry or provide the requested service. Optional fields may be left blank. You can also turn analytics off under Your Privacy Choices (section 9.5), and we honor Global Privacy Control.
8. Processing Locations and International Transfers
Our web services, primary database and enabled document processing infrastructure currently include Singapore. The service providers listed above also process and store information using their global infrastructure and service locations. AI requests are processed only by vetted inference hosts in the United States or European Union (see Subprocessors). Your personal data may therefore be processed outside the country or region where you are located, and it is not guaranteed to remain in a single country. Contact us to confirm any processing-location or contractual requirements before uploading restricted information.
When we transfer personal data across borders, we do so on a basis recognized by the applicable law: written agreements with our service providers that require them to protect personal data to a standard comparable to the law of the place where it was collected, and, where relevant, because the transfer is necessary to perform our contract with you or your organization, or because you have consented to it. Section 9 sets out jurisdiction-specific requirements, including transfer rules (Hong Kong, Singapore, Malaysia, Taiwan and the United States).
9. Information for Specific Jurisdictions
We serve customers in several jurisdictions. Depending on where you are located or where your data is collected, the following applies in addition to the rest of this policy.
9.1 Hong Kong
If you are in Hong Kong, we handle personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) and its six Data Protection Principles. You may make a data access request or a data correction request, and we will respond within 40 days of receiving it. We may charge a fee for a data access request that is not excessive. We will not use your personal data in direct marketing without your consent, and you may withdraw that consent at any time free of charge. You may lodge a complaint with the Office of the Privacy Commissioner for Personal Data.
9.2 Singapore
If you are in Singapore, we handle personal data in accordance with the Personal Data Protection Act 2012. We have designated a Data Protection Officer who is responsible for ensuring that we comply with the Act. You can contact our Data Protection Officer at dpo@materialpro.io. We respond to access requests as soon as reasonably possible and generally within 30 days, and we will tell you if we need longer. When we transfer personal data outside Singapore, we take appropriate steps to ensure the recipient is bound by legally enforceable obligations to provide a standard of protection comparable to the Act. If we assess that a data breach is notifiable, because it is likely to result in significant harm to affected individuals or affects 500 or more individuals, we will notify the Personal Data Protection Commission no later than 3 calendar days after that assessment and notify affected individuals where required. Where we process personal data on behalf of your organization, we act as its data intermediary. If you are not satisfied with how we handled your request, you may contact the Personal Data Protection Commission.
9.3 Malaysia
If you are in Malaysia, we handle personal data in accordance with the Personal Data Protection Act 2010, as amended by the Personal Data Protection (Amendment) Act 2024. We have appointed a Data Protection Officer, who can be contacted at dpo@materialpro.io. You may request access to or correction of your personal data, and we will respond within 21 days of receiving your request. You may also ask us to transmit personal data you have provided to another data controller of your choice (data portability), where this is technically feasible and the data formats are compatible. You may withdraw your consent, or ask us to stop processing your personal data for direct marketing, at any time. If a personal data breach occurs, we will notify the Personal Data Protection Commissioner as soon as practicable and within 72 hours, and notify affected individuals without unnecessary delay where the breach causes or is likely to cause significant harm. We transfer personal data outside Malaysia only as the Act permits, for example where the destination has laws substantially similar to the Act or ensures an adequate level of protection, or where the transfer is necessary to perform a contract with you. Where we process personal data on behalf of your organization, we act as its data processor and meet the security obligations that apply to data processors. This policy is available in Bahasa Melayu and English.
9.4 Taiwan
If you are in Taiwan, we handle personal data in accordance with the Personal Data Protection Act. The rights listed in section 7 cannot be waived or limited by contract. We will decide on a request to inquire about, review or copy your personal data within 15 days, and on a request to supplement, correct, stop processing or delete it within 30 days. If necessary, we may extend either period once by no more than the same length, and we will tell you the reason in writing. If personal data is stolen, disclosed, altered or otherwise compromised, we will notify you after investigating the incident.
9.5 United States (including California)
If you live in California or another US state with a consumer privacy law, this section applies to you in addition to the rest of this policy. It describes our practices over the past 12 months. Where we process personal information on behalf of a customer organization, we act as its service provider and may refer your request to that organization.
Categories we collect and their sources: Identifiers (such as name, email address, phone number and IP address); commercial information (such as your subscription, billing records and transaction history with us); professional information (such as company name and job title); internet or other electronic network activity (such as pages viewed, feature usage and device and browser details); approximate location derived from your IP address; and the contents of documents, messages and other information you upload or send. We collect this information from you, from your organization's administrators and users, from suppliers in your procurement workflow, automatically from your device, and from our service providers, such as our payment processor. We do not collect sensitive personal information to infer characteristics about you.
Why we use it: We use each category for the business purposes described in section 2: providing and securing the Service, billing, support, improving the Service, preventing fraud and meeting legal obligations. We disclose it to the service providers listed on our Subprocessors page, to the recipients described in section 3 and to your organization's authorized users, only for those purposes.
How long we keep it: We keep each category as described in section 5: while your account or your organization's workspace is active, and as long as needed to provide support, resolve disputes and meet legal requirements. When a workspace is deleted, its data is erased from our active systems, and copies in backups expire on our providers' backup schedules.
No sale or sharing: We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under California law. We have not done so in the past 12 months, and we do not knowingly sell or share the personal information of anyone under 16. We use Google Analytics only to measure our own website, with Google signals and ad personalization turned off.
Your rights: Subject to legal exceptions, you have the right to know what personal information we have collected about you, including its categories, sources, purposes and recipients, and to receive a copy of specific pieces of it in a portable format; to ask us to delete it; to ask us to correct inaccurate information; to opt out of the sale or sharing of personal information; and to limit the use of sensitive personal information. Because we do not sell or share personal information or use sensitive personal information beyond what the law permits, the Service itself needs no opt-out, but you can still turn website analytics off below.
How to make a request: Email dpo@materialpro.io or use the contact form in section 12. We will confirm receipt within 10 business days and respond within 45 calendar days. If we need more time, we may extend that period once by up to 45 more days and will tell you why. To protect your information, we verify your identity by matching details you give us with the information we hold, for example by asking you to confirm a code sent to your account email. Making a request is free.
Authorized agents: You may use an authorized agent to make a request on your behalf. We will ask the agent for your signed permission and may ask you to verify your identity with us directly, unless the agent holds a valid power of attorney.
No discrimination: We will not deny you the Service, charge you a different price or give you a different level of quality because you exercised any of these rights.
Global Privacy Control: If your browser sends a Global Privacy Control (GPC) signal, we treat it as a valid request to opt out of the sale or sharing of your personal information for that browser. Our website then does not load Google Analytics or record page views for analytics.
Other states and appeals: Residents of other states with comprehensive privacy laws, such as Colorado, Connecticut, Texas and Virginia, can exercise the same rights in the same way. If we decline your request, we will explain why, and you may appeal by replying to our decision. We will respond to your appeal within the time your state's law requires.
Your Privacy Choices
Use this switch to turn website analytics off in this browser. While it is off, our website does not load Google Analytics, does not record page views for analytics and deletes the Google Analytics cookies it can reach. Your choice is saved in this browser only, so set it again on other browsers or devices, or after you clear site data.
10. Children's Privacy
The Service is not directed at anyone under 18, and we don't knowingly collect personal data from children. If we discover we've collected a child's data, we'll take prompt steps to delete it.
11. Changes to This Policy
We may update this Privacy Policy from time to time. The updated version will be posted on this page with a revised "last updated" date. For significant changes, we'll let you know by email or an in-app notice. We encourage you to review this policy periodically.
12. Contact Us
For privacy questions or to exercise your data rights, contact our Data Protection Officer or use the contact form below. Describe your request without including passwords or unnecessary sensitive information.
- Data Protection Officer: dpo@materialpro.io
- General inquiries: hello@materialpro.io
- Website: Contact form
MaterialPro Technology Limited
A Data Processing Addendum is available on request: dpo@materialpro.io