Privacy Policy

1. Information we collect

We collect the following categories of information:

• Account information. Name, email address, organization, and authentication data when you sign up or sign in.
• Procurement requests. The mandates you give the agent, including product details, quantities, destinations, target pricing, minimum order quantities, and lead-time requirements.
• Connected email content.When you connect a mailbox (your Google account, Microsoft where supported, or your own IMAP/SMTP mail server), we access the email needed to run your procurement on your behalf, including messages we send to suppliers and their replies, so the agent can negotiate and extract quote data. See “Connected email accounts” below.
• Mail server credentials.If you connect your own mail server, we store the server settings and the mailbox password you provide. The password is encrypted at rest and used only to send and read mail on your behalf. See “Connected email accounts” below.
• Supplier data. Contact and company information for suppliers the agent discovers through public web sources and enrichment providers. We may create a shadow profile for a supplier before they have a Luray account.
• Quote and deal data. Supplier quotes, the deals you approve, and the contracts generated from them.
• Usage and technical data. Log data, device and browser information, cookies, and AI token-usage records used for metering and abuse prevention.

2. Connected email accounts

If you connect your Google account (or Microsoft, where supported), you grant Luray permission to read and send email from that account so the agent can contact suppliers and process their replies. We request only the scopes needed for this purpose and you can revoke access at any time from your provider’s account settings or by disconnecting the account in Luray.

Luray’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use connected email data only to provide and improve the procurement features you have requested.
• We do not transfer this data to others except as needed to provide the service, for security or legal reasons, or with your consent.
• We do not use this data for advertising, and we do not use it to train generalized AI or machine-learning models.
• We do not allow humans to read this data unless we have your consent, it is necessary for security or to comply with the law, or the data has been aggregated and anonymized.

Self-hosted mail servers: instead of Google or Microsoft, you may connect your own mailbox by providing your IMAP and SMTP server settings and login. We test the connection, then store those settings and your password, with the password encrypted at rest using a key held only by our backend. We use the credential solely to send outreach and read replies on your behalf, and you can remove it at any time by disconnecting the mailbox in Luray.

3. How we use information

We use the information we collect to:

• Run the agent workflow: research suppliers, send outreach, negotiate terms, extract structured quote data, rank results, and generate a contract for the deal you approve.
• Provide, maintain, secure, and improve the platform, including metering AI usage and preventing fraud and abuse.
• Communicate with you about your account and the service.
• Comply with legal obligations and enforce our terms.

4. Suppliers and shadow profiles

To match buyers with manufacturers, Luray gathers supplier contact and company information from public web sources and enrichment providers, and may create a shadow profile to manage outreach before a supplier joins the platform. If you are a supplier and want to access, correct, or delete the information we hold about you, or opt out of outreach, contact us at privacy@luray.ai and we will honor the request.

5. How we share information

We do not sell your personal information. We share information only with the service providers we use to operate the platform, with suppliers as needed to conduct your procurement, when required by law or to protect rights and safety, and in connection with a merger, acquisition, or sale of assets (subject to this policy).

6. Data retention

We retain information for as long as your account is active or as needed to provide the service, comply with legal obligations, resolve disputes, and enforce our agreements. You may request deletion of your data as described below; some records may be retained where the law requires.

7. Security

We use administrative, technical, and physical safeguards designed to protect your information, including encryption in transit, access controls, and tenant isolation. No method of transmission or storage is fully secure, and we cannot guarantee absolute security.

8. Your rights

Depending on your location, you may have the right to access, correct, delete, or port your personal information, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, contact us at privacy@luray.ai. You can disconnect a connected email account at any time, which stops further access to that mailbox.

9. Cookies

We use cookies and similar technologies to keep you signed in, secure the service, and understand usage. You can control cookies through your browser settings; disabling them may affect functionality.

10. Children's privacy

Luray is a business tool not directed to children, and we do not knowingly collect personal information from anyone under 16.

11. International transfers

We operate in the United States and may process information there and in other countries. Where required, we use appropriate safeguards for cross-border transfers.

12. Changes to this policy

We may update this policy from time to time. We will revise the effective date above and, for material changes, provide additional notice.

13. Contact us

Questions or requests about this policy or your data can be sent to privacy@luray.ai.