Contact and support: support@marsprocure.com
Website: https://marsprocure.com · Application: https://marsprocure.com/app/
This Policy brings together, in a single document: (A) the privacy policy, with a specific notice for suppliers who receive e-mails from MARS; (B) the rules on the use of data on the Free plan and to improve the Service; (C) AI transparency; (D) data subject rights and data deletion; (E) the cookie policy; (F) the Data Processing Agreement (DPA), with its Annexes; and (G) final provisions. It forms part of the MARS Terms of Use and should be read with them. Capitalised terms have the meaning given in the Terms of Use.
Part A Privacy #
1. Who we are and our roles #
1.1 MARS is a business-to-business (B2B) software-as-a-service that automates purchasing quotations (RFQs), operated by Filippo Andrade Prins Rodrigues Ltda., enrolled with the Brazilian CNPJ under No. 43.160.839/0001-08, with its registered office at Rua Haddock Lobo, 419, sala 802, Rio de Janeiro/RJ, CEP 20260-141, Brazil (hereinafter "MARS"; "MARS" and "MARS Procure" are trade names of this product and service), under Brazilian Law No. 13,709/2018 (LGPD).
1.2 We act in two roles:
(a) CONTROLLER, for the data we process for our own purposes: registration of the Workspace and Users, sign-in and SMS verification, billing, security, fraud and abuse prevention (including the Free plan rules), support, usage metrics, records of acceptance, website visitors and the demo form, the e-mail suppression list and the MARS Supplier Pool.
(b) PROCESSOR, for the Customer Data we process on the Customer's behalf and according to its instructions to provide the Service: RFQs, attachments, Supplier contacts registered, imported or selected by the Customer (including from Discovery), messages exchanged with Suppliers, quotes, files, evaluations, negotiations, auctions, awards, approvals, contracts and the audit trail. In this case the Customer is the controller and the rules of Part F (DPA) apply.
1.3 The Customer alone is responsible for deciding whether, how and on what legal basis the data of its Users and of Supplier contacts are entered into MARS or used in its RFQs.
2. Who this Policy applies to #
2.1 This Policy applies to:
- Website visitors and people who fill in the demo or contact form.
- Representatives and administrators of customer companies.
- MARS Users (buyers, managers, approvers and other Workspace members).
- Contact persons of Suppliers invited to RFQs (for them, we act as the Customer's processor, except for the suppression list and the MARS Supplier Pool, for which we are the controller).
- People mentioned in RFQs, quotes, attachments and messages (for them, we act as the Customer's processor).
3. What data we process #
3.1 Registration and billing: legal name, CNPJ or equivalent business identification, billing e-mail, country, tax address, Plan, billing period, Credits, invoices, tax invoices and payment status. Card data is processed by the payment provider; we only see the card brand, the last 4 digits and the expiry date.
3.2 Users: name, e-mail, mobile number, Role, language, sign-in method (e-mail link or Microsoft account, with the account identifier), status (active or paused), recovery codes (stored hashed) and records of acceptance of these documents.
3.3 Sign-in and security: sign-in records, sending and checking of SMS codes, the result of the mobile number check (such as line type, carrier and country), sessions, IP address, device identifier (mars_did cookie), browser, unauthorised access attempts and other technical data needed for security, audit and abuse prevention.
3.4 Quotation content: requirements, RFQs, items, specifications, attachments, commercial conditions, criteria and weights, exchange rates entered, questions and answers, addenda, quotes, evaluations, negotiation rounds, BAFO, auction bids, awards, approvals, contracts, calculated savings and the audit trail.
3.5 Suppliers: company name and details (such as CNPJ or tax ID, address, website, sector), names, job titles, business e-mails and phone numbers of contact persons, participation history and, when the Customer uses performance ratings, the scores the Customer gives. Source: registration or import by the Customer, Discovery in public web sources at the Customer's request, or the MARS Supplier Pool.
3.6 Communications with Suppliers: e-mails sent and received, including technical headers, attachments and delivery and bounce information, and actions in the Supplier Portal, with date, time and IP address.
3.7 MARS Supplier Pool: public business data of supplier companies, collected from public sources (such as corporate websites and public registries), and the sales contact the company itself publishes.
3.8 Suppression list: e-mail addresses that have unsubscribed or are invalid, with the date and reason.
3.9 Usage metrics: Credits used, RFQs, invitations, searches, feature usage, errors and performance, per User and per Workspace.
3.10 Support: the content of the messages and information you send us through Help or by e-mail.
3.11 Website and demo form: the form fields (for example, name, e-mail, company and message) and browsing data (Part E).
3.12 Sensitive data and children's data: MARS is not designed to process them. Anyone who enters them in RFQs, attachments or messages takes responsibility for that processing, and we may delete them without notice.
4. Why we use data and on what legal basis (LGPD, art. 7) #
| Purpose | Legal basis |
|---|---|
| Creating and managing Workspaces, Users, Roles and subscriptions | performance of contract (V) |
| Sign-in with e-mail link or Microsoft account and SMS code; mobile number check; recovery codes | performance of contract (V) and legitimate interest (IX), for account security |
| Drafting RFQs, finding suppliers, sending invitations and reminders, receiving and reading quotes, comparing, negotiating, running auctions, awarding and registering contracts | performance of contract (V), as the Customer's processor |
| Billing, issuing invoices and tax invoices and meeting tax obligations | performance of contract (V) and legal or regulatory obligation (II) |
| Security, fraud and abuse prevention, enforcing the Free plan rules, activity logging, log retention (Law No. 12,965/2014, art. 15) | legitimate interest (IX) and legal obligation (II) |
| Keeping the suppression list and honouring unsubscribes | legitimate interest (IX) and regular exercise of rights (VI) |
| Maintaining the MARS Supplier Pool with public business data | legitimate interest (IX), subject to art. 7, §§ 3 and 4 |
| Measuring usage, controlling Credits and showing metrics | performance of contract (V) and legitimate interest (IX) |
| Support and operational communication | performance of contract (V) and legitimate interest (IX) |
| Operating, maintaining, debugging, monitoring and improving the product, using technical, error and performance data and aggregated or de-identified statistics | legitimate interest (IX) |
| Answering the demo form and sending news to customers and interested parties | legitimate interest (IX) or consent (I), with an unsubscribe option |
| Regular exercise of rights, defence in proceedings, fraud prevention and compliance with orders from authorities | art. 7, VI, II and IX |
| Corporate reorganisation, due diligence and transfer of the business | legitimate interest (IX), under a duty of confidentiality |
4.2 We do not sell personal data and do not use it for third-party advertising.
4.3 Where legitimate interest is the legal basis, it has been weighed against the rights of data subjects. You may request information and object, under art. 18 of the LGPD.
5. Sharing #
5.1 We share data to the extent necessary with:
- Suppliers invited by the Customer: they receive the RFQ content and the messages the Customer decides to send, including the name of the buying company and of the responsible User.
- Approvers designated by the Customer: they receive by e-mail the data needed to approve the Award.
- Providers of infrastructure, database, file storage and e-mail sending and receiving.
- Artificial intelligence providers: processing of text and documents, as described in Part C.
- SMS and number verification providers: sending sign-in codes.
- Payment and tax-invoice providers: billing, invoices, tax invoices and fraud prevention.
- The identity provider chosen by the User (Microsoft account), for sign-in.
- Professional advisers (accounting, legal, security), insurers and authorities, when necessary to comply with the law, obey an order or exercise rights.
- Acquirers, successors and their advisers, in a corporate reorganisation, asset sale or financing, under confidentiality.
5.2 The main providers involved in the processing are listed in Annex I. We may add, replace or remove providers at any time, subject to clause 21 (DPA).
5.3 Within the Workspace, who sees what depends on the Roles set by the Owner and the Admins. The Customer is responsible for that configuration. A Workspace's data is not shown to other Customers; MARS does not disclose to one Customer the prices or conditions obtained by another.
6. International transfer #
6.1 Some providers needed for operation, such as infrastructure, artificial intelligence, SMS and payment providers, store or process data outside Brazil, mainly in the United States. These international transfers are carried out in accordance with art. 33 of the LGPD, ANPD Resolution CD/ANPD No. 19/2024 (including standard contractual clauses, where applicable) and the other legally applicable mechanisms.
6.2 Further information on international transfers, including purposes, recipients and mechanisms used, may be requested through the privacy channel, subject to commercial and industrial secrecy.
7. How long we keep data #
| Data | Period |
|---|---|
| Registration, Workspace configuration and Customer Data (RFQs, suppliers, messages, quotes, files, contracts and the RFQ audit trail) | while the Workspace is active and up to 30 days after it is closed |
| Registrations started and not completed | up to 30 days |
| Sign-in links and SMS codes | up to 24 hours (usually minutes) |
| Sessions | until the session ends: 30 minutes without activity or 12 hours |
| Sign-in, access, security and administrative audit logs | 12 months |
| Free plan abuse-prevention data (domain, mobile, device and network) | while the Workspace exists and up to 12 months afterwards |
| Billing and tax records | 5 years or the legal period |
| Incident records | at least 5 years |
| Suppression list | as long as needed to honour the unsubscribe |
| MARS Supplier Pool | while the data is relevant, with periodic review, or until a removal request |
| Support | up to 24 months |
| Demo and contact form | up to 24 months without interaction or until unsubscribe |
| Backups | rotation of up to 30 days |
7.2 Periods are "up to": we may delete earlier. Deletion is automatic and periodic; after the period, data is deleted or anonymised. We may keep data beyond these periods to comply with a legal obligation, obey an order from an authority, preserve evidence, defend rights in proceedings, investigate abuse, fraud or a security incident, or when anonymised.
7.3 Application access logs are kept for at least 6 months (Law No. 12,965/2014, art. 15), and the periods above respect that minimum.
7.4 What the Customer has exported, downloaded or sent by e-mail, and what Suppliers and approvers have received, is governed by the rules of whoever keeps it. We do not control those copies.
7.5 We may change these periods, subject to the law, by updating this Policy.
8. Security #
8.1 We adopt reasonable technical and administrative measures, summarised in clause 10 of the Terms of Use and in Annex II (DPA). No system is completely secure, and we do not guarantee the absence of incidents.
8.2 If a security incident occurs that may create a relevant risk or harm, we will take the measures and make the notifications required by the LGPD and ANPD regulations, under Part F for Customer Data.
Part B Free plan and use of data to improve the Service #
9.1 Same protections. Workspaces on the Free plan have the same privacy and security protections as paid Plans. The Free plan is not paid for with data: we do not sell data, do not use it for advertising and do not use the content of Free Workspaces to train artificial intelligence models.
9.2 Abuse prevention on the Free plan. To apply the one-Free-Workspace-per-company rule (clause 11.3 of the Terms of Use), we process the e-mail domain, mobile number, device identifier (mars_did cookie) and network data (IP address), based on the legitimate interest of preventing fraud and protecting e-mail recipients, for the period in clause 7.
9.3 Improving the Service, on all Plans. We use technical, usage, performance and error data (such as response time, failures, screens used, Credit consumption and e-mail delivery rates), in aggregated or de-identified form, to operate, fix, size and improve the Service.
9.4 Content. We do not use the content of RFQs, quotes, attachments and messages with Suppliers to train artificial intelligence models, our own or third parties', on any Plan. Authorised personnel only access that content when necessary to handle a support request, investigate an error, incident or abuse, or comply with the law, and the access is logged.
9.5 Feedback. Feedback, ratings and survey answers may be used to improve the product, without publicly identifying who sent them.
9.6 Objection. You may object to processing based on legitimate interest through the channel in Part D. Objection does not cover processing needed for security, fraud prevention and compliance with the law.
Part C AI transparency #
10.1 Where we use AI. We use AI to: (1) draft the RFQ from a requirement and review it for gaps, ambiguities and risks; (2) search for suppliers on the web (Discovery); (3) classify e-mails received from Suppliers (for example, quote, question, decline, auto-reply); (4) extract prices, quantities, lead times and conditions from quotes in e-mails, PDFs and spreadsheets; (5) draft answers to Suppliers' questions and negotiation messages; and (6) support the evaluation and ranking of quotes by the criteria and weights set by the Customer. MARS is a task-specific procurement assistant, not a general-purpose chatbot.
10.2 Data access. The AI receives only the data needed for each task, within the Customer's Workspace.
10.3 AI provider. We use the OpenAI API to process text and documents. Under the terms that apply to the API, the provider does not use data sent through it to train its models. MARS also does not use Customer Data to train its own or third-party models.
10.4 Human control. Publishing the RFQ, the Supplier shortlist and the Award are always confirmed by a person. The Customer chooses whether answers to Suppliers are sent automatically, when grounded in the RFQ itself, or held for approval. Questions the RFQ does not answer go to a User.
10.5 Limits. MARS's AI does not decide about people, does not contract or award on its own and does not assess natural persons. Supplier evaluations concern companies' commercial proposals.
10.6 AI can make mistakes. It may misread a value, unit, currency or lead time, miss a condition, classify an e-mail incorrectly, suggest an unsuitable supplier or draft an answer that sounds confident and is wrong. The User must check RFQs, extracted quotes, comparisons and messages before confirming or making relevant decisions.
10.7 Automated decisions. MARS does not make solely automated decisions that produce legal effects on people. Data subjects may request a review and information about criteria, under art. 20 of the LGPD, where applicable.
10.8 Good practice for companies. Tell your Users and, where appropriate, Suppliers that MARS uses AI; review extracted quotes before deciding; set a level of autonomy that matches your risk; do not enter sensitive data, passwords or secrets; give Roles on a least-privilege basis.
10.9 Regulation. The use of artificial intelligence is subject to the laws and rules applicable to the Service and the processing carried out, including data protection law. We will adapt the Service and this Policy as the applicable regulation evolves.
Part D Data subject rights and data deletion #
11.1 Who can ask. Data subjects whose data we process as controller; Customers (through the Owner), to delete data or close the Workspace; Users; and Suppliers, regarding the suppression list and the MARS Supplier Pool. A Supplier contact in an RFQ should ask the buying company (the controller), and we may forward the request (clause 11.8).
11.2 What you can ask for (LGPD, art. 18): confirmation of processing; access; correction; anonymisation, blocking or deletion of unnecessary or excessive data or data processed unlawfully; portability; deletion of data processed based on consent; information about sharing; information about the possibility of not consenting; withdrawal of consent; objection; and review of automated decisions. Suppliers can also stop receiving e-mails through the unsubscribe link.
11.3 How to ask. Write to support@marsprocure.com with the subject "Data request", stating: full name and e-mail; Workspace or company, if any; and what you are asking for, with the relevant data, if applicable. Do not send passwords, SMS codes, recovery codes, tokens or card numbers: we will never ask for them.
11.4 Identity verification. We will only act after confirming who is asking, and may require a reply from the registered e-mail, confirmation of Workspace details or minimal identification. Requests affecting the whole Workspace are only handled if made by the Owner. We may refuse or suspend a request we cannot verify, that is manifestly unfounded, excessive or repetitive, or that puts security, third-party rights or trade secrets at risk.
11.5 Timing. We will reply within the applicable legal and regulatory deadlines. Where necessary to handle the request, the period starts after identity verification is completed and the essential information has been received.
11.6 What is deleted and when. Automatically, without a request: the periods in clause 7. On request: we delete or anonymise the personal data under our control that we must not or cannot keep, and confirm completion. Closing the Workspace: access ends, e-mails to Suppliers stop being sent and the data is deleted 30 days later (clause 12.13 of the Terms of Use), except what the law requires us to keep.
11.7 Limits. We do not control and cannot delete:
(a) data for which we are processor (the decision belongs to the Customer as controller);
(b) copies held by Suppliers, approvers or other e-mail recipients, or exported by the Customer;
(c) copies at MARS's providers, which follow their own policies; we will ask them to delete where applicable;
(d) data the law requires or allows us to keep: billing and tax records, access logs, incident records, regular exercise of rights in proceedings, fraud prevention, security and compliance with orders from authorities;
(e) the address on the suppression list, which we keep precisely in order to honour your unsubscribe;
(f) backups, which are overwritten in the normal rotation and are never restored for operational use without reapplying deletions;
(g) anonymised data, which is no longer personal data.
11.8 When we are processor. If your data is in an RFQ or in a customer company's supplier base, that company is the controller. If you write to us, we will forward the request to the Customer within a reasonable time, without answering it on the merits, and will cooperate with the Customer as far as reasonable. Regardless, you can stop receiving MARS e-mails through the unsubscribe link.
11.9 Response and complaints. We will confirm by e-mail what was deleted, what was kept and why. If you disagree, write to the same address. You may also complain to the ANPD (www.gov.br/anpd), without prejudice to contacting us first.
11.10 A data subject request does not suspend the Service, billing or the Customer's obligations, and requests that do not follow this procedure may be handled only when it is possible to verify who is making them.
Part E Cookies and similar technologies #
12.1 Cookies are small files stored in the browser so that the website and the application work and remember preferences. Similar technologies (such as the browser's local storage) are treated as cookies.
12.2 Cookies we use. We use only strictly necessary, first-party cookies. We do not use advertising or cross-site tracking cookies.
| Cookie | Purpose | Duration |
|---|---|---|
| mars_session | keeps the User signed in to the application | until the session ends (30 minutes without activity or 12 hours) |
| mars_flow | carries the sign-in steps (link, Microsoft account and SMS code) | 30 minutes |
| mars_lang | remembers the chosen language (Portuguese or English) | 1 year |
| mars_did | identifies the device for security and abuse prevention, including the Free plan rules | 2 years |
12.3 Local storage. The application uses the browser's local storage to remember the language, sync the inactivity timer between open tabs and resume an interrupted payment. This data stays in your browser.
12.4 Third parties. Payment takes place on Stripe's page, and sign-in with a Microsoft account on Microsoft's page; those providers may set their own cookies, governed by their policies.
12.5 How to manage. You can block or delete cookies in your browser settings. Blocking necessary cookies may prevent sign-in and the application from working. If we start using non-essential cookies, we will tell you beforehand and ask for consent where required.
Part F Data Processing Agreement (DPA) #
This Agreement forms part of the Terms of Use and is entered into, by electronic acceptance, between the Customer identified in the Workspace ("Controller") and MARS, identified in clause 1.1 ("Processor"). It applies to the personal data MARS processes as processor, on the Customer's behalf, when providing the Service ("Controller Data").
13. Definitions #
The terms "personal data", "sensitive personal data", "data subject", "processing", "controller", "processor", "data protection officer", "ANPD" and "security incident" have the meaning given in the LGPD. "Sub-processor" means a third party engaged by the Processor to take part in processing Controller Data.
14. Scope #
This Agreement does not apply to data MARS processes as controller (registration, sign-in, billing, security, abuse prevention, support, metrics, website visitors, the suppression list and the MARS Supplier Pool), which are governed by Parts A to E. Annex I details the processing.
15. Instructions #
The Processor will process Controller Data to provide the Service according to the Controller's instructions, which are: the Terms of Use, this Agreement, the settings made in the application (including the level of autonomy in conversations with Suppliers) and Users' actions in the Service, such as publishing RFQs and inviting Suppliers. If an instruction, in the Processor's reasonable judgement, breaches the law, the Processor may suspend compliance with it.
16. Use by the Processor #
The Processor will not sell Controller Data or use it to train artificial intelligence models. In addition to providing the Service, the Processor may process it: (a) for security, fraud and abuse prevention, support and diagnostics; (b) to comply with the law or an order from an authority or to defend rights; and (c) in anonymised or aggregated form, to operate and improve the Service. The Processor will require its providers to process data on terms compatible with the purposes and obligations of this Agreement.
17. Confidentiality #
The Processor will subject the people authorised to process Controller Data to a duty of confidentiality.
18. Security #
The Processor will adopt reasonable technical and administrative measures, summarised in Annex II, which may be updated for equal or greater protection.
19. Data subject rights #
The Processor will cooperate, as far as reasonable and by appropriate technical means, so that the Controller can respond to data subjects, and may charge for requests requiring disproportionate work. Requests received directly by the Processor will be forwarded to the Controller, which decides and replies, unless the law requires a reply from the Processor. Suppliers' e-mail unsubscribes are applied by the Processor directly (clause 2.4).
20. Incidents #
The Processor will notify the Workspace Owner without undue delay after confirming a security incident affecting Controller Data, with the information then available (nature, data and data subjects affected, measures taken and risks), updating it as the investigation progresses. Assessing the risk and the duty to notify the ANPD and data subjects (Resolution CD/ANPD No. 15/2024) are the Controller's. The notification is not an admission of fault or liability.
21. Sub-processors #
The Controller gives general authorisation for the Processor to use the Sub-processors needed to provide the Service, including those listed in Annex I and others in the categories of infrastructure, e-mail, artificial intelligence, SMS, payments, tax invoicing and identity. The Processor will seek to impose data protection obligations compatible with this Agreement and will announce relevant changes by e-mail, in the application or in this Policy. A Controller that objects, on reasonable grounds and in writing, within 15 days of the announcement, and whose objection the Processor cannot accommodate on reasonable terms, may cancel the contract with no other consequence. The Processor is responsible for Sub-processors within the limits of the Terms of Use, without assuming responsibility for services chosen or controlled directly by the Controller.
22. International transfer #
The Controller authorises the international transfers needed for the Service (clause 6). The Processor will carry them out under art. 33 of the LGPD and Resolution CD/ANPD No. 19/2024.
23. Audit and information #
The Processor will provide, through documentation or a questionnaire, the information reasonably needed to demonstrate compliance with this Agreement, at most once a year. On-site or technical audits are only allowed if required by the ANPD or by law, or after a proven incident affecting the Controller, with 30 days' notice, reasonable scope and duration, at the Controller's expense, under confidentiality and without access to other customers' data, the Processor's trade secrets or infrastructure security.
24. Records and cooperation #
The Processor will keep a record of the processing operations it carries out (art. 37 of the LGPD) and will cooperate, as applicable, with the Controller and the ANPD.
25. Return and deletion #
At the end of the contract or when the Workspace is closed, Controller Data follows the periods in clause 7 and is deleted at the end of them, except what the law requires to be kept and as provided in clause 16. The Controller must export what it needs before termination. The Processor has no obligation to return data in another format or to retain data beyond these periods.
26. Controller obligations #
The Controller represents and warrants that: (a) it has a legal basis (arts. 7 and 11 of the LGPD) to process Controller Data and to instruct the Processor, including to send invitations to the Supplier contacts it registers, imports or selects; (b) it has informed data subjects, including its Users, about the processing, the use of AI and the involvement of processors and sub-processors, to the extent required by law; (c) its instructions and its RFQs are lawful and correspond to real purchasing needs; (d) it diligently manages Roles and access and promptly removes anyone who should no longer have access; (e) it is responsible for the accuracy and lawfulness of the data it enters and for decisions made based on the Service's outputs; and (f) it will not send sensitive personal data, data of children and adolescents, credentials or secrets, unless essential and lawful for the purpose of the purchase, in which case it takes full responsibility for the processing.
27. Liability #
Liability between the parties follows the LGPD (arts. 42 to 45), including the right of recourse in proportion to each party's involvement, and, as far as the law allows, is subject to the limitations and exclusions of the Terms of Use, which also apply to this Agreement. The Processor is not liable for damage caused by the Controller's instructions, by data it entered or kept unlawfully or by Users it did not remove.
28. Term, precedence and jurisdiction #
This Agreement remains in force for as long as the Processor processes Controller Data, and clauses that by their nature should survive remain in force. On personal data for which MARS is processor, this Agreement prevails over the other documents, except for limitation of liability and jurisdiction, which follow the Terms of Use. Changes follow the changes clause of the Terms of Use.
Annex I — Processing details #
Subject matter: provision of MARS, a purchasing quotation (RFQ) automation service, with human confirmation at the decisive steps.
Nature: collection at the Customer's request (including from public web sources), receipt, extraction, classification, structuring, comparison, transmission by e-mail, storage, logging and deletion.
Purpose: enabling the Controller's Users to prepare RFQs, find and invite Suppliers, receive and compare quotes, negotiate, run auctions, award, obtain approvals and register contracts, according to the Controller's instructions.
Data subjects: (i) the Controller's Users and approvers (employees, staff, contractors); (ii) Suppliers' contact persons; (iii) people who may be mentioned in RFQs, quotes, attachments and messages.
Data: (i) of Users and approvers: name, e-mail, Role and action records; (ii) of Supplier contacts: name, job title, business e-mail and phone, company, messages, quotes, files, bids and, in the Supplier Portal, IP address and date and time of actions.
Sensitive data: not anticipated (clause 26(f)).
Duration: that of the contract, plus the periods in clause 7.
Frequency: continuous, while the Service is used.
Location: Brazil and the countries where Sub-processors are located, mainly the United States (clause 6).
Main sub-processors:
| Provider | Category and function | Main location |
|---|---|---|
| Cloudflare, Inc. | hosting, database, file storage, e-mail sending and receiving | United States and global network |
| OpenAI, L.L.C. | artificial intelligence (text and document processing, web search) | United States |
| Twilio Inc. | SMS code delivery and mobile number checks | United States |
| Stripe, Inc. and affiliates | payments and invoices | United States and Brazil |
| NFE.io | issuance of Brazilian service tax invoices (NFS-e) | Brazil |
| Microsoft Corporation | sign-in with a Microsoft account (optional, chosen by the User) | United States and global network |
Annex II — Security measures #
The measures below are a summary, not a guarantee of result, and may be changed for equal or greater protection. They complement clause 10 of the Terms of Use.
Access and isolation
- Sign-in with an e-mail link or Microsoft account plus an SMS code at every sign-in; one mobile number per account; single-use recovery codes.
- Sessions that expire after inactivity (30 minutes) and after a maximum time (12 hours).
- Roles (Owner, Admin, Buyer, Viewer) and immediate pausing or removal of members.
- Logical separation between Workspaces and internal access restricted to what is necessary.
- Supplier Portal through a private link specific to each Supplier and RFQ.
Control over actions
- Human confirmation for publishing, the Supplier shortlist and the Award; Approval tiers available.
- Configurable autonomy for automatic answers to Suppliers.
- E-mail sending safeguards: unsubscribe, suppression list, sending limits and blocking of invalid recipients.
- RFQ audit trail and sign-in and security logs.
Data protection
- Encryption in transit (HTTPS/TLS) and access controls appropriate to the risk.
- Retention and deletion according to the periods in this Policy.
- Continuity and recovery procedures appropriate to the operation.
Management
- Selection and monitoring of relevant providers.
- Incident response and logging procedures.
- Periodic review of security measures and permissions.
Part G Final provisions #
29. Children and adolescents #
MARS is a service for businesses and is not directed at persons under 18. If a minor has sent us data, let us know so we can delete it.
30. Communications #
Sign-in, security, billing and operational e-mails are necessary for the Service. Sign-in codes are sent by SMS to the registered mobile number. News e-mails can be cancelled through the unsubscribe link. E-mails sent to Suppliers follow clause 8 of the Terms of Use and the notice in clause 2.2 of this Policy.
31. Changes #
We may update this Policy at any time. Material changes will be notified by e-mail to the Owner or in the application 15 days in advance, except those required by law, by an authority or by a Third-Party Provider and those needed for security, which may take effect immediately. Continued use after the effective date constitutes acceptance. The date of the current version is at the top.
32. Law and jurisdiction #
This Policy is governed by the laws of Brazil, and the jurisdiction clause of the Terms of Use applies. Where there are versions in other languages, the Brazilian Portuguese version prevails.
33. Contact #
Privacy and data subject channel: support@marsprocure.com
Application: https://marsprocure.com/app/ (Help, under the ? icon)