Privacy policy

Who we are

Hultora Ltd is a company registered in England and Wales, company number 15630115. Registered office: 167-169 Great Portland Street, 5th Floor, London W1W 5PF, United Kingdom. Hultora Ltd is responsible for the personal data described in this policy.

What Hultora does

Hultora is an AI sourcing assistant that helps people who buy for a business find suppliers and send requests for quotes. When you submit a sourcing request, Hultora searches supplier databases and the public web, selects candidate suppliers using AI, and, with your permission, sends RFQ emails from your connected email account on your behalf, and reads the replies suppliers send.

Information we collect

• Account information: your email address and a hashed password.
• Company details: when you ask for access, your company name, country, CR number, VAT number, business address, website, contact name, email and phone, and your CR and VAT certificates.
• Email content: supplier replies to your requests and their attachments, your email signature, and a short description of how you write.
• Product files you import: if you import a price list as a PDF or a photo, or a sheet we cannot read in your browser, we send the file (or its first rows) to our AI service to read it. We keep a copy of every file you import, and a record of how it was read (which columns we used, and what the AI assumed), so that Hultora staff can check imports and make them better. Only Hultora staff can open them. We keep the files for 6 months and the record of how they were read for 24 months, then delete them, or earlier if you ask us to. The AI provider keeps its own copy for up to 30 days and then deletes it (longer only if the law requires it or it finds misuse). We do not use your files to train AI models.
• Sourcing data: the products, quantities, notes and supplier information you enter or that the AI discovers on your behalf.
• Email OAuth tokens: if you connect Gmail or Outlook, we store the access and refresh tokens issued by Google or Microsoft. We never see your password for those services.
• Usage and activity: request history, supplier interactions and pipeline status, stored so you can review what the system did on your behalf.

Email access, and the scopes we request

When you connect an email account, Hultora asks Microsoft or Google for permission to send from it and to read it. We need to read it to see the replies suppliers send to your requests. Today you can connect Outlook. Gmail comes after Google's security review.

Outlook (Microsoft Graph)

• Mail.Send: send your requests and follow-ups from your Outlook address.
• Mail.Read: read your mail. We read supplier replies to your requests and their attachments, notices that an email was not delivered, and, only if you press Learn my style in the app, up to 25 emails you sent, to learn how you write.
• MailboxSettings.Read: read your email signature, so our emails carry it.
• User.Read: read your basic profile, to show your address in the app.
• offline_access: keep the connection when you are not signed in, so we find replies while you are away.

Gmail, if you connected it before

• gmail.send: send your requests and follow-ups from your Gmail address.
• gmail.readonly: read your mail, for the same three things.
• gmail.settings.basic: read your email signature.
• userinfo.email: read the address on your Google account.

What we keep. Supplier replies and their attachments, saved with the request they answer. A short description of how you write, made from your sent emails. We do not keep the sent emails themselves, and we do not use any other email.

Hultora's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How we use your data

• To carry out the sourcing work you request: find suppliers, draft RFQs, send emails and read the replies.
• To display your sourcing activity back to you in the dashboard.
• To maintain and debug the service. Error logs may contain minimal metadata about failed operations; we do not use email content for this.

We do not use your email content or supplier data to train AI models, sell it to third parties, or use it for advertising.

Data sharing

We work with a small number of service providers to run Hultora. We do not name them here. If you want to know which providers hold your data, write to hello@hultora.com and we will tell you.

• Hosting (Germany): runs our website and the server that handles your requests.
• Database (France, European Union): stores your account, your sourcing data and the keys that connect your mailbox.
• AI model (United States): drafts requests, chooses suppliers, reads supplier replies, checks the company papers you upload, and reads the price lists you import. It does not train its models on this data.
• Web search (Estonia, European Union): searches the public web for suppliers. It receives only the product and company names we search for.
• Marketplace search (Czech Republic, European Union): searches public online marketplaces for supplier listings. It receives only product names.
• Email check (United States): checks that a supplier's email address works before we write to it. It receives only that address.
• Your own email account (Gmail or Outlook), if you connect it: we send your requests and read the replies through it.
• Your own product system, if you connect it: we import your product list from it.

When a provider is outside the UK and the European Union, we protect the transfer with the safeguards the law requires, such as standard contractual clauses.

We do not sell your data. We do not share it with advertisers.

When you visit this website

Our web server records each page visit: the page, the time, the browser type and a shortened IP address. We use this only to count visitors, and we delete it after about 30 days. The site sets no cookies and uses no trackers. It remembers your light or dark choice in your own browser. Our pages load their fonts from a font service in the United States, so your browser also connects to it.

Storage and retention

Your data is stored with our database provider in the European Union. OAuth tokens are stored encrypted at rest by the database provider and transmitted only over HTTPS. Requests and sourcing activity are retained for as long as your account is active. If you delete your account, we remove your account, sourcing data, imported files and revoke stored OAuth tokens within 30 days.

Your rights

• Disconnect email at any time from the Email Settings page. This deletes the stored OAuth tokens, so we can no longer send from or read your mailbox.
• Export your data: write to us and we will send a copy of everything we hold about you.
• Delete your account: write to us and we will remove your account, sourcing data, imported files and tokens within 30 days.
• Revoke Google access at any time from your Google Account permissions page.
• Revoke Microsoft access at any time from your Microsoft account.

Contact

Questions, data requests or security reports: hello@hultora.com. We aim to respond within 7 working days.