Privacy & Data Use

What we process

• Account data: corporate email and name from Microsoft Entra ID, stored for authentication and role-based access.
• Activity logs: natural-language search queries and AI summary generation are logged with your email for audit and debugging.
• Business data: SAP-derived customer and vendor names, invoice and payment records — used for finance analytics visible per your access scope.

Purpose & lawful basis

Data is processed for internal procure-to-pay and order-to-cash reporting under employment and legitimate business-use grounds. Access is restricted to allowlisted corporate domains and assigned roles.

Retention

• NL search history: up to 12 months, then deleted.
• AI summaries (Falcon): up to 90 days, then deleted.
• Platform security logs: 180 days (Cert-In requirement).
• SAP business data: refreshed from source systems; not individually erased in-app.

AI features

Falcon Summary and Natural Language Search send aggregated business context (including customer names where relevant) to Azure OpenAI in South India. Outputs may be stored in the database linked to your account.

Subprocessors

• Microsoft Azure (hosting, Entra ID, PostgreSQL, Key Vault) — Central India
• Microsoft Azure OpenAI — South India
• FalconIris database — used by Planning reports module; contact IT Security for region and data details

Your rights

You may request access, correction, or erasure of your personal data held in FalconTrace by contacting the grievance officer below. Offboarding triggers deletion of your account and associated query history.

Grievance officer

Email: itsupport@sasmos.com