Privacy Policy

Name: Porcia
Price: 4 USD
Availability: InStock
Author: Porcia

Effective Date: September 12, 2026
Last Updated: September 12, 2026
Version: 1.0

1. Introduction

This Privacy Policy explains how Arunkumar Chaubey, an individual resident of India, doing business as Porcia, collects, uses, shares, and protects information when you use our website at porcia.org, our application at app.porcia.org, our browser extension, our integrations, and any related services (collectively, the "Service").

Porcia is a B2B SaaS platform that helps businesses discover, manage, and optimize their software spend through email intelligence, SSO discovery, a browser extension, AI-powered negotiation, and vendor intelligence.

By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you are using the Service on behalf of an organization, you represent that you are authorized to accept this Privacy Policy on that organization's behalf.

If you do not agree with this Privacy Policy, please do not use the Service.

Contact Us:

General: [email protected]
Privacy Inquiries: [email protected]
Security: [email protected]

2. Definitions

Customer means the business or organization that subscribes to Porcia
Authorized User means an individual granted access to Porcia by a Customer
Customer Data means any data submitted to or collected by Porcia on behalf of a Customer through use of the Service
Personal Data means any information relating to an identified or identifiable natural person
Processing means any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion
Subprocessor means a third-party service provider engaged by Porcia to process Customer Data
Workspace means a Customer's isolated environment within the Porcia platform

3. Roles and Responsibilities

3.1 When Porcia Is a Data Processor

When a Customer connects integrations (email, SSO, browser extension) or uploads data to Porcia, the Customer is the Data Controller and Porcia is the Data Processor. This applies to:

Employee directory data obtained via SSO integrations
Email content processed transiently and derived email metadata retained by Porcia
Browser extension usage data collected from Authorized Users
Contracts and vendor documents uploaded by Customers
Any other Customer Data submitted through the Service

In this capacity, Porcia processes Customer Data only on the Customer's documented instructions and in accordance with our Data Processing Addendum (DPA).

3.2 When Porcia Is a Data Controller

Porcia acts as a Data Controller for:

Account registration and profile data of Authorized Users
Billing and payment information
Usage analytics and telemetry about how the Service is used
Communications with our team (support, sales, feedback)
Website visitor data (cookies, IP addresses, browsing behavior on porcia.org)
Aggregated, anonymized benchmarking data

4. Data We Collect

4.1 Account and Identity Data

When you register for Porcia, we collect:

Data	Purpose
Full name	Account identification, in-app display
Work email address	Authentication, notifications, communications
Company/organization name	Workspace creation, billing
Job title/role	Personalization (optional)
Password	Authentication (hashed with bcrypt; never stored in plaintext)
Profile photo	In-app display (optional)
Workspace name and slug	Workspace identification

4.2 Email Integration Data

Porcia's email intelligence feature supports administrator-authorized OAuth connections to Google Workspace or Microsoft 365 for available organization-wide email signals. Vendor-email forwarding may also be available for specific workflows.

Email content and attachments are processed ephemerally in memory for the requested analysis. Raw email content is not persisted in Porcia databases, logs, backups, or analytics systems. Porcia may retain derived, non-content discovery signals and integration metadata as described in this policy.

The organization-wide scope depends on administrator authorization, provider permissions, and the scopes configured for the integration. Porcia does not claim to access every mailbox unless the connected provider and permissions make that data available.

What we process transiently, depending on the enabled integration and permissions:

Email metadata: Sender address, recipient address, subject line, timestamp, message ID
Email content: Email body text used during the requested analysis and then discarded
Email attachments: Documents used during the requested analysis and then discarded
OAuth tokens: Google Workspace or Microsoft 365 access and refresh tokens (encrypted and stored securely)

What we extract from emails:

Vendor name and contact information
Pricing and subscription details
Contract renewal dates and terms
Invoice amounts and payment terms
Service terms and changes

What we do NOT do with email data:

We do not use email data to serve advertisements
We do not use email data to train generalized AI models
We do not sell or share email data with third parties for their own purposes
We do not allow human access to email content except where necessary for customer support (with your consent), security incident investigation, or legal obligation

Google API Limited Use Disclosure: Our use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4.3 SSO Integration Data

When a Customer connects an identity provider (Google Workspace, Microsoft Azure AD / Entra ID, or Okta), Porcia accesses:

Data	Source
Employee names and email addresses	Identity provider directory
Job titles	Identity provider directory
Group/team memberships	Identity provider directory
Application assignments and permissions	Identity provider directory
Login frequency and last login timestamps	Identity provider directory
Application metadata (names, descriptions, logos)	Identity provider directory

OAuth scopes requested are documented below. Exact permissions depend on the connection method and administrator consent.

Google Workspace interactive OAuth / Marketplace connection

Porcia requests:

https://www.googleapis.com/auth/admin.reports.audit.readonly — Workspace audit activity, including SSO and OAuth-token events
https://www.googleapis.com/auth/admin.reports.usage.readonly — Workspace usage reports
https://www.googleapis.com/auth/admin.directory.user.readonly — User profiles, status, administrator status, 2-Step Verification status, recovery email, and organizational unit path
https://www.googleapis.com/auth/admin.directory.user.security — OAuth tokens and connected-app grants
https://www.googleapis.com/auth/admin.directory.orgunit.readonly — Organizational-unit information
https://www.googleapis.com/auth/admin.directory.group.readonly — Groups and group membership
https://www.googleapis.com/auth/admin.directory.domain.readonly — Domains registered to the Workspace organization
https://www.googleapis.com/auth/cloud-identity.groups.readonly — Cloud Identity group metadata
https://www.googleapis.com/auth/apps.groups.settings — Google group settings
https://www.googleapis.com/auth/gmail.readonly — Read-only Gmail access for SaaS discovery, invoice analysis, and subscription-related email analysis
https://www.googleapis.com/auth/userinfo.email — Email address of the authorizing administrator or user

Google Workspace Domain-Wide Delegation

For service-account or Domain-Wide Delegation connections, Porcia requests:

https://www.googleapis.com/auth/gmail.readonly
https://www.googleapis.com/auth/admin.directory.user.readonly
https://www.googleapis.com/auth/admin.directory.user.security
https://www.googleapis.com/auth/admin.reports.audit.readonly
https://www.googleapis.com/auth/admin.directory.group

When impersonating individual employee mailboxes, Porcia uses:

https://www.googleapis.com/auth/gmail.readonly
https://www.googleapis.com/auth/admin.directory.user.readonly

admin.directory.group and admin.directory.group.readonly are different Google scopes. Domain-Wide Delegation requires the exact scope configured in the Google Admin Console.

Microsoft Entra ID organization-wide connection

The organization-wide Microsoft flow requests https://graph.microsoft.com/.default, which requests all configured Microsoft Graph application permissions for which administrator consent has been granted:

AuditLog.Read.All — Sign-in and audit logs
Directory.Read.All — Directory-wide organization, application, and service-principal data
User.Read.All — User profiles and account information
Group.Read.All — Groups and group membership
Application.Read.All — Registered applications and service-principal metadata
Policy.Read.All — Conditional Access policies
DelegatedPermissionGrant.ReadWrite.All — Delegated OAuth permission grants, including revocation workflows
IdentityRiskEvent.Read.All — Identity-risk events
User.ReadWrite.All — Account-management workflows such as disabling accounts or resetting passwords, where separately authorized
Mail.Read — Read mailbox messages for SaaS discovery, invoices, subscription confirmations, and renewal messages

User.ReadWrite.All and DelegatedPermissionGrant.ReadWrite.All can support administrative actions. They are not read-only permissions and require appropriate Microsoft Entra roles and explicit authorization; they are not enabled by consent alone.

Individual Microsoft Outlook connection

Porcia requests:

Mail.Read
User.Read
offline_access

Mail.Read — Read the connected user's mailbox
User.Read — Read the connected user's basic profile
offline_access — Obtain a refresh token for continued authorized access

Okta

okta.apps.read — Read application information
okta.users.read — Read user information

Important notes:

SSO data is synced automatically every 24 hours while the integration is active
The Customer (employer) is the data controller for employee data accessed via SSO
We strongly recommend that Customers inform their employees when Porcia is integrated with their identity provider
OAuth credentials are encrypted and stored securely

4.4 Browser Extension Data

The Porcia browser extension helps discover SaaS applications used by your team by detecting login and signup activity across business websites.

What we collect:

Domain names (not full URLs) of websites where login or signup activity is detected
Time spent on each domain
Login events detected on websites
Signup events detected on websites
Trial and onboarding detection (when applicable)
Whether a work email domain was used (boolean only - we never collect or transmit the actual email address)
Event type (login, signup, or app_usage)
Timestamps of activity
User identifier (your Porcia user ID)
Workspace identifier (your organization's workspace ID)

What we do NOT collect:

Full URLs (no query parameters, paths, or fragments)
Page content, form data, or anything you type
Passwords or credentials
Personal emails, chats, or messages
Files, documents, or screenshots
Clipboard data or browsing history
Activity in incognito/private browsing mode

Privacy commitments:

The extension detects login and signup events on business websites; consumer domains (social media, streaming services, shopping sites) are automatically excluded
The extension never tracks personal websites or general internet activity
The extension requires explicit user installation and consent
Users can pause tracking, exclude specific domains, or uninstall at any time
All data is encrypted in transit and at rest

4.5 Vendor and Subscription Data

Vendor names and contact information
Subscription details (pricing, number of seats, billing frequency)
Contract documents uploaded by you
Renewal dates and contract terms
Negotiation history and outcomes
Invoice and payment records

4.6 Billing and Payment Data

We use Dodo Payments as our third-party payment processor.

What Dodo Payments collects: Credit/debit card information, billing address
What Porcia stores: Billing name, billing address, payment method type, transaction history, subscription status
What Porcia does NOT store: Full credit card numbers, CVVs, or raw payment credentials

4.7 Usage and Analytics Data

Feature usage data (pages visited, buttons clicked, features used)
Session duration and frequency
IP address
Device type, operating system, and browser information
Referring URL
Error logs and performance metrics

4.8 Communication Data

Support tickets and chat messages
Feedback and feature request submissions
Email communications with our team

We use cookies and similar technologies for session management, security, analytics, and preferences. See our Cookie Policy for full details.

5. How We Use Data

5.1 To Provide and Operate the Service

Create and manage your account and Workspace
Process and analyze vendor emails to discover subscriptions, contracts, and renewals
Sync and analyze SSO data to discover applications and usage
Track SaaS application usage via the browser extension
Provide AI-powered contract analysis and negotiation recommendations
Generate vendor intelligence and pricing benchmarks
Display dashboards, reports, and insights

5.2 AI Processing

Porcia uses AI models provided by Microsoft Azure OpenAI Service (via Azure AI Foundry) for various analysis and automation features.

Critical commitments regarding AI:

No model training: Your data is NOT used to train, fine-tune, or improve any AI model
Human-in-the-loop: All AI-generated negotiation emails require your explicit approval
Ephemeral email analysis: Raw email content is not written to Porcia logs, databases, backups, or analytics systems
Accuracy: AI-generated content may contain errors. Not legal, financial, or professional advice

For more details, see our AI Data Usage Policy.

5.3 Billing and Payments

Process subscription payments via Dodo Payments
Generate and deliver invoices
Manage subscription upgrades, downgrades, and cancellations
Comply with tax and financial reporting obligations

5.4 Product Improvement and Analytics

Understand how features are used to prioritize development
Identify and fix bugs and performance issues
Conduct A/B testing and improve user experience
Analyze usage patterns (in aggregate) to guide product decisions

5.5 Security and Fraud Prevention

Detect and prevent unauthorized access, fraud, and abuse
Monitor for anomalous activity
Enforce our Terms of Service and Acceptable Use Policy
Investigate security incidents

5.6 Communications

Send transactional emails (account confirmations, password resets, integration notifications)
Respond to support requests and feedback
Send product updates and feature announcements (you can opt out)
Send marketing communications (only with your explicit consent; you can unsubscribe)

5.7 Legal Compliance

Comply with applicable laws, regulations, and legal processes
Respond to lawful requests from government and regulatory authorities
Enforce our legal rights and resolve disputes

6.1 With Subprocessors

We share data with third-party service providers who help us operate the Service. See our Subprocessor List for the current list.

Key subprocessors:

Provider	Purpose	Location
Cloud Provider	Cloud hosting, database, storage	United States
Microsoft Azure OpenAI	AI processing	United States
Pinecone	Vector database (no customer PII)	United States
Brevo	Transactional email delivery	EU / United States
Dodo Payments	Payment processing	Varies

6.2 As Required by Law

We may disclose data if required to:

Comply with applicable law, regulation, or legal process
Protect the rights, property, or safety of Porcia, our Customers, or the public
Enforce our Terms of Service
Investigate potential violations

6.3 In Connection with a Business Transfer

If Porcia is involved in a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before your data becomes subject to a different privacy policy.

6.4 Aggregated and Anonymized Data

Porcia may use aggregated, anonymized data derived from Customer Data to:

Improve our vendor intelligence database
Provide market insights and pricing benchmarks
Enhance AI-generated recommendations
Publish industry reports

Our commitments:

Data is stripped of all identifying information
We will never attempt to re-identify anonymized data
Customers may opt out by contacting [email protected]

We may share your data with third parties when you have given us explicit consent.

6.6 What We Do NOT Do

We do NOT sell your Personal Data
We do NOT share your data for advertising or marketing purposes
We do NOT use your email, SSO, or browser data to serve advertisements

7. International Data Transfers

7.1 Where Your Data Is Stored

Your data is primarily stored in the United States on secure cloud infrastructure.

7.2 Transfers from the EU/EEA/UK

If you are in the EU/EEA/UK, your data may be transferred to the United States. We protect such transfers using:

Standard Contractual Clauses (SCCs) approved by the European Commission
Data Privacy Framework (DPF) certifications (where applicable)
Supplementary measures including encryption and access controls

8. Data Retention

Data Type	Retention Period
Active account data	While your account is active
Data after account closure	Retained for up to 90 days for account recovery, then deleted from production systems
Raw email content and attachments	Not stored; processed ephemerally in memory and discarded after analysis
Derived email discovery metadata	While the account is active; deleted by the end of the 90-day account recovery window
SSO integration data	While integration is active; deleted by the end of the 90-day account recovery window after disconnection or account closure
Browser extension data	Up to 90 days from collection; account data follows the 90-day account recovery window
AI processing logs	30 days where applicable; raw email content is not retained in logs
Billing and payment records	7 years (tax and legal compliance)
Aggregated, anonymized data	Indefinitely (contains no Personal Data)
Backup copies	Up to 90 days after deletion from production, where backups exist

9. Data Security

We implement technical and organizational measures to protect your data:

Encryption in transit: TLS 1.2+ for all connections
Encryption at rest: AES-256 for databases and storage
Secrets management: Encrypted secrets management with access controls
Access controls: Role-based access control (RBAC), workspace isolation
Password security: bcrypt hashing
Input validation: Sanitization of all user inputs
CSRF protection: Anti-CSRF tokens on all forms
API security: Rate limiting, authentication, request validation
Monitoring: Real-time error tracking, performance monitoring, security monitoring
Audit logging: All sensitive actions logged

For more information, see our Security Page.

10. Your Rights

Right of Access: Request a copy of your Personal Data
Right to Rectification: Request correction of inaccurate data
Right to Erasure: Request deletion of your Personal Data
Right to Restrict Processing: Request that we limit how we use your data
Right to Data Portability: Receive your data in a machine-readable format
Right to Object: Object to processing based on legitimate interest
Right to Withdraw Consent: Withdraw consent at any time
Right to Lodge a Complaint: File a complaint with your supervisory authority

10.2 Rights Under CCPA/CPRA (California)

Right to Know: Know what Personal Information is collected and how it's used
Right to Delete: Request deletion of your Personal Information
Right to Correct: Request correction of inaccurate information
Right to Opt-Out: We do NOT sell Personal Information
Right to Non-Discrimination: Not be penalized for exercising rights

We do NOT sell Personal Information.

10.3 How to Exercise Your Rights

Email: [email protected]
In-App: Account Settings → Privacy & Data
Response Time: Within 45 days, subject to applicable law and permitted extensions

Legal Basis	Processing Activities
Contract Performance	Providing the Service, managing account, processing emails/SSO, billing
Consent	Marketing communications, optional analytics, browser extension
Legitimate Interest	Product improvement, security, fraud prevention, aggregated analytics
Legal Obligation	Tax records, regulatory compliance, legal process

12. Children's Privacy

Porcia is a B2B service designed for business use. The Service is not directed at individuals under 16. We do not knowingly collect Personal Data from children.

13. Third-Party Links

The Service may contain links to third-party websites. We are not responsible for their privacy practices.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

Material changes: We will notify you by email and/or in-app notice at least 30 days before changes take effect.

Minor changes: We will update the "Last Updated" date.

15. Contact Us

Privacy Team: [email protected]
General: [email protected]
Security: [email protected]

Arunkumar Chaubey
Doing business as Porcia
C/13 Mangalmurti Society, Ghatkopar West
Mumbai, Maharashtra, India

Version History:

v1.0 (September 12, 2026) - Initial release