Privacy policy

Effective 24 October 2026

Anaco ("we", "us") provides a source-to-pay service. The service handles purchase requests, approvals, sourcing, supplier management, invoices and payments for the companies that subscribe to it ("customers"). This policy explains what information the service handles, why, and the choices you have. Questions go to privacy@anaco.ai.

Our role

For the data a customer puts into the service (its employees, suppliers, orders and invoices), the customer decides how the data is used and we process it on the customer's behalf. If you are an employee or supplier of one of our customers, that customer is your first point of contact. We will help them answer your request.

What we handle

• People at our customers: name, work email, job title, department, approval role and language.
• Suppliers: company details, commercial registration and trade licence, contact person, phone, email and bank account (IBAN). We also keep the documents suppliers send, such as quotes, bids, invoices and bank letters.
• Business records: purchase requests, approvals and their comments, requests for quotes, purchase orders, goods receipts, invoices, payments, and an audit log of every step.
• Emails: messages in the purchasing mailbox a customer connects to the service, and their attachments.
• Sign-in: a session cookie that keeps you signed in, and a cookie that remembers your language. We do not use advertising or tracking cookies.

How we use it

Only to run the service for the customer: to read and sort incoming requests, quotes and invoices, check them against the customer's rules, route approvals, prepare purchase orders and payments, send the emails the workflow needs, keep the audit log, and keep the service secure. We do not sell personal information and we do not use it for advertising.

Google user data

When a customer connects a Gmail mailbox, the service uses Google's Gmail API to read new messages in that mailbox, label the messages it has handled, and send or save as drafts the messages its workflow produces, such as approval links, supplier invitations and replies to requesters. It does not access any other Google data.

Anaco's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use Gmail data only to provide the service's features to the customer who connected the mailbox. We do not use it for advertising, we do not sell it, and we do not use it to train general AI models. People do not read it unless the customer asks for help, it is needed for security or to comply with the law, or it has been anonymised and aggregated for running the service. A customer can disconnect the mailbox at any time from their Google account's security settings.

AI processing

The service uses AI models from Anthropic, through Anthropic's commercial API, to read documents and draft text. Content is sent to the model only to carry out that step. Neither we nor Anthropic use customer data to train AI models. Decisions to approve, award or pay are made by the customer's rules and people, not by the model alone.

Who else processes it

• Google Cloud: hosting and database, in the Doha (me-central1) region. Google Workspace and Gmail: email, when a customer connects a mailbox.
• Anthropic: AI processing, as described above.
• Tools a customer chooses to connect, such as Asana or its accounting system. These receive only what that connection needs.

We may disclose information if the law requires it. If Anaco is sold or merged, this policy continues to apply to the data.

Security and retention

Data is encrypted in transit and at rest. Each customer's records are kept apart from every other customer's at the database level. Sign-in uses personal, time-limited links. Payments go only to the bank account on file, and changes to bank details need a phone check and a second person's approval. We keep a customer's data while they use the service, then delete it within 90 days of the end of the subscription, unless the law requires us to keep it longer. Audit records may be kept as long as the customer's record-keeping obligations require.

Your choices and rights

Depending on where you live, you may have the right to see, correct, delete or receive a copy of your personal information, or to object to how it is used. Contact the customer you work with or supply, or write to us at privacy@anaco.ai. We will reply within 30 days.

Children

The service is for businesses and is not meant for anyone under 18.

Changes

If we change this policy, we will update the date above and, for significant changes, tell customers before the change takes effect.

Contact

Anaco · privacy@anaco.ai