Privacy policy

Two roles

For our customers' data, we act for the customer. When a company uses FollowUp, the POs, vendor contacts and messages it puts in belong to that company. We process them only to provide FollowUp to it, under our Terms. If you are a vendor contact and want to know what a company holds about you, or want it changed or removed, ask that company; we'll help it answer.

For our own business, we decide. That covers the people who use FollowUp (their sign-in and account details), visitors to this website, and people who write to us.

What we collect

• People who use FollowUp: name, work email, job title if given, the company and its Microsoft organisation ID, role, and when they sign in.
• What a company puts in: purchase orders and their lines, vendor names and contacts (names, email addresses, phone numbers), the messages sent to vendors and their replies, POs picked up from the connected mailbox's Sent Items or from copies your Exchange admin sends to your FollowUp address (anything that isn't a PO is skipped and not kept), dates, notes and settings.
• Requests for IT: when someone asks their IT admin to approve or connect FollowUp, the names and email addresses of both.
• Support and sales: what you send us when you ask for help or a demo.
• Technical records: the records needed to run and secure the service, such as sign-in times and errors.

We don't buy personal information, and we don't collect it from other sources beyond what Microsoft tells us when you sign in with it.

How we use it

• To provide FollowUp: read POs, send check-ins, read replies, record dates and show status.
• To sign people in and keep accounts secure.
• To send service emails: welcome and setup emails, reminders to your team, and notices about your account.
• To answer support requests and to improve FollowUp, using de-identified, aggregated usage figures that don't identify you or your vendors.
• To meet legal obligations.

We don't sell personal information, share it for advertising, or use it to train AI models.

AI

FollowUp uses an AI model to read POs and vendor replies and, if a company chooses, to word its messages. We send the model only what one task needs. Our AI provider's terms don't allow it to train on that data. FollowUp's software, not the AI, decides whether, when and to whom anything is sent, and a vendor who asks whether a message is automated gets a truthful answer.

Who else processes it

These companies process data for us, only to run FollowUp:

• Railway Corporation: hosting: runs FollowUp and its database.
• Microsoft: sign-in, and email: check-ins go out from, and replies arrive in, the customer's own Microsoft 365 mailbox; FollowUp's own notices go out from ours.
• Anthropic: aI: reads uploaded POs and vendor replies, and words messages when a company chooses AI assisted.

We tell customers before adding a new one. We also disclose information when the law requires it, and to a buyer of our business, who would be bound by this policy.

Cookies

FollowUp uses one cookie to keep you signed in, and short-lived ones while you sign in with Microsoft. We use no advertising or tracking cookies, on this site or in the app.

How long we keep it

• A company's data is kept while its account is open, and for 30 days after it cancels (read-only, so nothing is lost by mistake). Then it is deleted, after a person on our team confirms it.
• A company can export its data at any time and ask us to delete it sooner.
• Requests to IT that never led to an account are deleted 90 days after they were last touched.
• We keep what the law requires us to, such as billing records, for as long as it requires.

Security

See Security for how we protect data and what FollowUp can reach in your Microsoft 365. If we learn of a breach affecting your information, we tell the affected company without undue delay, and others as the law requires.

Your choices and rights

You can see and correct your own details in FollowUp, and your company's Admins can export or delete its data. Depending on where you live (for example California), you may have the right to know what we hold about you, to correct or delete it, and not to be treated differently for asking. Write to privacy@vendorfollowup.com. If your information is in a customer's account, we'll pass the request to that customer.

Where it is processed

FollowUp is run from the United States, for businesses there. We and the companies listed above process data in the United States, and those companies may also process it where they operate, under their own security commitments.

Children

FollowUp is for businesses and isn't meant for anyone under 18.

Changes

If we change this policy in a way that matters, we tell customers by email or in the app before it takes effect. The date at the top shows the latest version.

Contact

privacy@vendorfollowup.com
[legal entity name], [postal address]