Cookie & browser storage policy

Last updated: October 27, 2026

Operational activity history

First-party activity reports use the existing authenticated session and a per-document identifier held only in memory. They do not set an analytics cookie or persist an activity queue in browser storage. Signed-in page visits and interface actions, server access information including IP addresses, and operation outcomes are available to authorized platform administrators for 120 days. Typed values, credentials and session recordings are excluded. This is separate from the optional provider choices below. See the Privacy Policy for collection and retention details.

This policy covers the website, Chrome extension and Outlook add-in. Cookies and browser storage serve different purposes. See our Privacy Policy for the wider handling of information.

Sign-in and preferences

The website uses Supabase authentication cookies and browser storage to maintain your session. Theme and interface preferences can also be stored locally. Blocking essential storage can prevent sign-in or cause preferences to reset. Session lifetime depends on the authentication configuration and refresh activity; persistent local storage remains until removed by the application or browser.

Installed clients

The Chrome extension keeps its ProcureMind access token in extension session storage and its refresh token in extension local storage, restricted to trusted extension contexts. It also stores local review state. The Outlook add-in stores its ProcureMind session in its local storage where the host permits it, with an in-memory fallback. Signing out clears the client session; browser and Office controls can also remove stored data.

File recovery

Updated file-recovery flows hold the selected file and retry key in memory while that client remains open. Chrome can keep a session marker to prompt history review after a worker restart. That marker does not contain the file bytes or server retry key. Closing or reloading a client can lose its recovery details; check saved extractions before starting again.

Your optional choices

The privacy panel offers equally accessible Accept optional and Reject optional controls, plus separate analytics and browser diagnostics choices. Neither option is selected by default. Use Privacy choices at the bottom of the website to change or withdraw your choice. Saving reloads the page. Rejecting optional tracking does not block the service or sign-in, and agreeing to Terms is not tracking or marketing consent.

The necessary pm_privacy cookie stores the choice, policy version and choice time for up to 180 days on this website. It is not an advertising identifier. When the choice expires, optional collection stops until you choose again. Choices apply to this browser and site address, not automatically to other devices or installed clients.

Analytics and diagnostics

With analytics consent and provider configuration, PostHog measures page visits and selected feature-use events. Analytics identifiers are held in memory, without persistent analytics cookies or local storage. When you withdraw consent, PostHog can store a necessary opt-out preference under a name beginning __ph_opt_in_out_ in local storage or a cookie. It contains a stop flag, not an account identifier, and is cleared when you explicitly allow analytics again. Local storage remains until cleared; a fallback cookie lasts up to 180 days. Automatic interaction capture, surveys and session recording are disabled. Server product events require a valid analytics choice on the initiating website request; background jobs and installed clients do not imply that choice.

With diagnostics consent and provider configuration, Sentry and our browser error reporter collect technical errors. Browser session replay and browser performance tracing are disabled. Essential server security and operational logs remain active, as explained in our Privacy Policy. Authentication, administration and unsubscribe pages exclude optional browser telemetry.

These services are not used for advertising. We do not sell your personal information. Withdrawing consent stops future optional collection; clearing storage does not erase records already held by us or a provider. Contact support for access or deletion requests. An earlier version could create provider storage; browser site-data controls can remove it without implying a server-side deletion request.

Connected services

Google, Microsoft and Stripe use their own cookies and storage when you visit their sign-in, picker or checkout pages. Their policies apply to those interactions. Disconnecting an integration does not delete documents or rows already sent to it.

Your controls

You can sign out, clear site or extension data and use your browser privacy controls. Some actions may stop sign-in, recovery or an integration from working. For questions, email support@procuremind.io.