Development-stage policy · Updated 11 October 2026 · Version 2.28 · Obtain qualified legal review before commercial launch.
Guided account onboarding and support
New portal applicants use a private, unlisted onboarding area before full workspace access. We store onboarding progress, required name and job-role details, the selected public company number or manually entered organisation name, completion and submission times, account review status and limited account audit events. A secure essential session allows an applicant to resume setup and contact support before approval, but does not grant access to the main portal. Main portal access requires a confirmed email address, completion of the required profile fields and an active account. Onboarding support requests use the existing support-ticket service and store the account, current onboarding step, subject, message, ticket status, timestamps and basic browser diagnostics supplied with the request. We limit new onboarding support requests to reduce abuse. The onboarding page is excluded from search indexing and is not linked from the public website.
Portal notifications
The signed-in portal creates in-app notifications for selected social and account events, such as connection requests and acceptances, follows, comments, replies, and account or company-association review decisions. A notification stores the recipient, event type, acting member or company where relevant, a short message, destination, creation time and read state. Notifications are visible only to the recipient, are removed after 90 days, and do not themselves create or send an email. Signal-email preferences and delivery records remain separate.
Private portal messaging
Approved members who have accepted a connection may exchange private messages in the portal. We store the conversation participants, message content, reply references, emoji reactions, timestamps, read position, mute and archive settings, and a sender-generated identifier used to prevent accidental duplicate delivery. A sender may unsend their own message; its content is then replaced in the participant view by an unsent marker and its reactions are removed. Conversation history remains visible to its participants if they later disconnect, but new messages and reactions require an accepted connection and are prevented when either participant has blocked the other. A member may report a received message; we then store the report reason, optional details and a snapshot of the reported message for authorised review and service safety. A report snapshot and related audit record may remain available to authorised reviewers even if the sender later unsends the live message. Blocking, reporting, message-send and message-unsend events create limited account audit records. Cloudflare provides the database, real-time connection and security infrastructure; real-time availability is not used for advertising or behavioural tracking.
Company Signal emails
Approved users can separately enable Companies House update emails and new contract-award emails for companies they track. We store the selected frequency, tracked company number, a checkpoint representing the last company details notified, and a delivery record for each contract award already queued or sent. Companies House emails are created only when monitored official fields materially change. Contract-award emails use the procurement notice publication time, the award's first-seen time and a recipient-specific delivery ledger so routine refreshes and historical backfills are not presented as new awards. Delivery records include the recipient account, company, procurement and award identifiers, message reference, status and timestamps. Signal emails are delivered through our configured transactional email provider and can be disabled independently in the portal.
Portal posts, comments and abuse prevention
Approved portal members may publish profile or company posts, comments, replies and images, subject to the selected audience and the portal's social features. We store the content, author or acting company, audience, images, reactions, relationships and timestamps needed to display and manage it. To protect members and the service, the Portal Worker checks posting frequency, duplicate content, repeated and shortened links, link counts and suspicious address formats. When a submission is blocked, the account audit log records the content type and block reason without copying the rejected post, comment or URL into that event. Images are stored in Cloudflare object storage and are removed when their post is deleted. External threat-intelligence checking is not active at the date of this notice.
Customer portal and shared sign-in
The customer portal at portal.procuraaxis.com uses the same approved ProcuraAxis account, session records and private company matching profile as the public website at procuraaxis.com. Where a domain handoff is needed, a short-lived, single-use sign-in handoff may create a separate secure essential session cookie for the public website after the customer signs in through the portal. The handoff token expires within minutes, cannot be reused and is not an advertising or analytics identifier. The portal provides authenticated access to the company, buyer, sector, procurement and award information already described in this notice; it does not make a customer profile public.
Monthly Companies House snapshots
Authorised administrators may upload all CSV parts from the official monthly Companies House Basic Company Data snapshot to private object storage. We scan the complete set to find records relevant to unresolved awarded suppliers, copy only those relevant public company records into the local database, and retain upload, processing, matching and audit metadata. Matching prefers a published company number, then one active exact company-name candidate, and may accept one active safely normalised current-name candidate across the complete snapshot set. The normalised comparison covers presentation differences such as punctuation, brackets, consecutive initials, spacing, “&”/“and” and equivalent legal suffixes; it does not spell-correct or reorder substantive words. Missing, conflicting and ambiguous suppliers remain unresolved for review or the controlled live API workflow. Snapshot files are retained only while needed to operate, verify and recover this matching service.
Expanded published tender and buyer details
Opportunity detail pages may display more of the information already published in official procurement releases, including buyer and supplier contact names, business email addresses, locations, submission instructions, criteria, contract terms and award information. Buyer organisation pages combine published organisation details with the open, closed, awarded and cancelled notices linked to that buyer, including combined published tender values by status. Source-specific buyer records are grouped only where the same official identifier is supplied, or where a safely normalised name and compatible postcode support the link; ambiguous records remain separate. We keep a bounded detail copy in the local procurement database and retain the original published release in our source archive. Existing releases may be backfilled from that archive without making a new request to the publication service. The original notice remains the authoritative record; contact information must be used only for appropriate procurement-related purposes.
Administrator-directed company imports
Administrators may search Companies House for companies to add to the local company database. A search preview contains the search term, up to 25 returned company records, the administrator account and a 15-minute expiry; expired previews are removed during later searches. Confirmed additions create import-queue and audit records, including the search term and import counts. Full public Companies House profiles are fetched in controlled batches and retained as described below. These searches do not use advertising or analytics tracking.
Customer company matching profiles
An approved, signed-in customer may select an existing public Companies House record and save a private matching profile containing capability keywords, target procurement sectors, delivery regions and preferred minimum and maximum contract values. Selecting a company associates that public record with the customer’s ProcuraAxis account for opportunity discovery; it does not verify ownership, employment, representation or authority and does not alter the public company record. ProcuraAxis uses the profile to produce deterministic opportunity scores from disclosed CPV sector mappings, capability keywords, published locations and values. The profile and recommendations are available only within the signed-in account and are not published on the company page.
AI Agent test area
The administrator-only AI Agent can send a selected public company record, SIC descriptions, up to 20 locally shortlisted open procurement records, an administrator’s question and optional supplier-capability or interest information to OpenAI for a structured opportunity-matching analysis. Do not enter secrets, passwords, special-category data or unnecessary personal information. Account details, passwords, administration notes and unrelated customer records are excluded. Requests use a pseudonymous safety identifier and are made with provider-side response storage disabled. We retain the generated result, selected company, model settings, token usage, estimated cost, duration, administrator account and audit events; optional capability and interest fields are used for the request but are not deliberately stored by ProcuraAxis. OpenAI may process limited API data outside the UK under its applicable safeguards and may retain abuse-monitoring logs in accordance with its API data controls. AI output is informational and can be inaccurate.
Manual supplier review
Authorised reviewers can inspect historical unmatched award suppliers, request live Companies House searches and profiles, and confirm or undo a company link. They may also save an exact-name acknowledgement rule for a supplier believed to be outside the current UK company directory. Future unmatched awards with that name can then be acknowledged automatically without creating a company link. We retain the rule, reviewer, affected tender and supplier references, whether each acknowledgement was manual or automatic, and decision timestamps in the review history. Undoing a rule stops future automatic acknowledgements and returns awards acknowledged by that rule to review; the audit history remains. Company-link decisions retain the selected company, previous link, reviewer and timestamp while needed for the service and audit integrity. A profile preview is valid for 15 minutes; expired previews are removed on subsequent lookups. Cancelled previews do not change company records or award links. Confirmed manual company links take precedence over automatic matching. Undo restores the previous link and retains the company record.
Who operates this service
ProcuraAxis is a UK procurement-intelligence project in active development. For privacy enquiries or requests, email privacy@procuraaxis.com. The legal identity and registered address of the final service operator must be added before commercial launch.
Information you provide
Registration and guided onboarding collect your first and last name, work email address, organisation, job title or role and password. We store a securely derived password hash rather than a readable password, together with onboarding progress, account status, review events, session and security timestamps. If you create a customer company matching profile, we store your selected public company, capability keywords, target procurement sectors, delivery regions and preferred contract-value range. Portal posts, comments, replies, images, likes, follows, connection requests, private messages, support requests and related safety reports are stored to provide the requested features, respect their selected audience and protect members. Information entered into search and filter controls is used to return requested results. In the protected AI test area, optional supplier capabilities, delivery coverage, capacity, evidence and user interests are processed for the current request and are not deliberately stored by ProcuraAxis. Email alerts operate only when the relevant portal setting is enabled.
Information from public sources
We obtain company names, company numbers, registered-office and filing information, business classifications and related public company information from Companies House. We obtain buyers, suppliers, procurement descriptions, values, dates, documents and award information from Find a Tender, Contracts Finder, Public Contracts Scotland and Sell2Wales. These sources can include business contact or sole-trader information that is personal data. Source records may be cached or stored locally to operate search, matching, audit and update services. Awarded suppliers from historical notices, as well as new notices, may be placed in a rate-limited queue for a Companies House profile or company-name lookup. We may retry earlier unsuccessful lookups when correcting a matching error, using the same protected rate limits. We retain lookup outcomes, comparison indicators, previous attempts and import errors to operate and review matching.
Technical and security information
Cloudflare processes IP address, request, device, network, security and diagnostic information to deliver and protect the service. Cloudflare Turnstile processes technical signals to distinguish legitimate users from automated abuse. Google Fonts may receive ordinary request information when fonts are loaded. Server logs may record requests, errors and security events.
Broken-link diagnostics
When a public page returns a 404 response, ProcuraAxis records the requested path, query-parameter names but not their values, the referring origin and path without its query string, browser family, operating-system family, coarse device type, broad traffic classification, country code, Cloudflare data-centre code and event time. We do not deliberately store the raw IP address or full browser user-agent in this 404 analytics record. This operational record helps us repair broken links, understand search-engine and AI-crawler discovery, and separate useful reports from automated security scans. It does not set a visitor identifier or depend on optional analytics cookies.
Purposes and lawful bases
We use account information to process registration requests, provide requested access and administer the service, relying on steps connected with a service request and our legitimate interests in operating the project. We use security and diagnostic information for our legitimate interests in preventing abuse, maintaining availability and investigating faults. We process public company and procurement information for our legitimate interests in providing procurement research and transparency tools. Where optional tracking or marketing requires consent, it will remain disabled until consent is given.
Cookies and local storage
The service uses essential storage for sign-in, security, human verification and remembering your choices. Secure sign-in sessions can last up to 30 days. The customer portal and public website use separate secure cookies, joined only through the short-lived single-use sign-in handoff described above, so an approved customer can move between the services without entering their password again. Local storage remembers company refinements, your privacy choice and a random non-identifying signup-prompt counter so the prompt is not shown too often. Session storage remembers opportunity refinements for the current browser session. ProcuraAxis records aggregate signup-prompt impressions, dismissals, starts and completed registrations to assess whether the feature is useful; this does not use browser fingerprinting or advertising technology. If you accept optional analytics, the public website stores random visitor and session identifiers on your device and records the page path, coarse device category, referring hostname, country code and whether the visit was signed in. It does not store the IP address, full referring URL or browser fingerprint in the analytics dataset. Known bots and automated clients are filtered before storage. Choosing Essential only leaves this visitor analytics collection disabled. ProcuraAxis does not use advertising cookies or third-party analytics trackers.
Sharing and international processing
Information is processed by infrastructure and security providers such as Cloudflare and by other suppliers needed to operate the service. AI Agent request data described above is processed by OpenAI. Requests for externally hosted fonts can be sent to Google. These providers may process information outside the UK under their applicable contractual and legal safeguards. We do not sell personal data.
Retention
Company and procurement records are retained while needed to provide historical and current intelligence, meet source-licence obligations and maintain audit integrity. Live Companies House responses are refreshed after approximately 24 hours. Portal notifications are retained for up to 90 days. Private conversations are retained while participant accounts and the messaging service remain active, and reported-message snapshots and related audit records are retained while reasonably needed for safety review, administration, disputes and security. Consented first-party visitor analytics events and operational 404 diagnostics are retained for up to 13 months. A customer company matching profile is retained until it is changed or deleted, or while the account remains active, subject to a reasonable period afterwards for administration, dispute and security purposes. AI Agent results and usage/audit records are retained while needed to evaluate, secure and account for the test service; optional capability and interest inputs entered only in the AI test area are not deliberately stored by ProcuraAxis. Sign-in sessions expire after 30 days. Account applications and security records are retained while the account or project is active and for a reasonable period afterwards for administration, dispute and security purposes. Preference storage remains on your device until it expires or you clear it.
Your rights
Depending on the circumstances, UK data-protection law may give you rights of access, correction, deletion, restriction, portability and objection. You can withdraw consent for optional processing at any time through “Privacy choices”. Public-source corrections should also be raised with the originating authority where appropriate. You may complain to the Information Commissioner’s Office at ico.org.uk.
Automated matching and scores
Supplier-to-company matching first uses a published or clearly embedded Companies House number, then a consistent prior reviewer-confirmed supplier-name and postcode link, one unique exact current company name, one unique active safely normalised current name, or one unique active previous name. ProcuraAxis may convert a recognised legacy registered-society identifier to its canonical Companies House format. Safe normalisation treats punctuation, brackets, repeated spacing, consecutive initials, “&”/“and” and equivalent terminal legal suffixes as presentation differences without changing stored names. A numeric name such as “400” may be compared with its written form only when one active candidate has the same postcode. It does not spell-correct, reorder or otherwise discard substantive words. Short names, conflicting numbers, names or postcodes and multiple candidates remain unresolved for review; postcode is supporting evidence and is never used alone. Local company records are checked before a controlled live Companies House search, and successful name-search results may be cached for approximately 24 hours to reduce external calls. Cross-source opportunity grouping first uses a shared Open Contracting ID when supplied, then compares exact titles, buyers, values and deadlines within a narrow publication-date window so the same notice can be presented once while retaining links to each source. Customer opportunity recommendations use a deterministic score based on the selected CPV sectors, capability-keyword overlap, delivery-region overlap and published contract-value range; this feature does not use AI. The AI test agent separately can rank a locally selected opportunity shortlist using official records and administrator-supplied statements. ProcuraAxis scores, AI analyses, matches and groupings are informational indicators; they do not make decisions producing legal or similarly significant effects. A missing or low match does not mean a supplier is unregistered, unsuitable or ineligible.
Changes
We review this notice when releases materially change accounts, tracking, data sources, matching, scoring, retention or third-party processing. The updated date and version will change when the notice is revised.