Privacy Policy

The data controller responsible for your personal data is:

TenderRadar
Email: hello@tenderradar.io

For data protection inquiries, contact our data protection officer at privacy@tenderradar.io.

• To create and manage your account, authenticate your sessions, and enforce multi-tenant data isolation
• To build AI-powered company capability profiles from the website URL you provide, using third-party large language models
• To match and score public tender opportunities against your company profile using AI classification
• To process subscription payments and manage billing through Stripe
• To send you tender alerts, weekly digests, and account notifications via email
• To analyze platform usage with PostHog to improve features and user experience
• To measure marketing effectiveness through Google Analytics and LinkedIn Insight Tag (only with your consent)
• To respond to your support requests and communications
• To detect and prevent fraud, abuse, and security incidents

We use artificial intelligence (including OpenAI's models) to:

• Classify and categorize public tender notices by industry, type, and requirements
• Analyze your company website to generate a capability profile
• Score and rank tenders against your profile to surface relevant opportunities
• Generate summaries and key information extractions from tender documents

This processing is part of the core service you subscribe to. AI outputs are advisory — no legally significant decisions about you as an individual are made solely by automated means. You may contact us to request human review of any AI output that affects you.

When your company profile data is processed by OpenAI, it is sent via API and is not used by OpenAI to train their models, in accordance with their data processing terms.

We do not sell your personal data. We share data with the following categories of third-party processors who act on our behalf under appropriate data processing agreements:

We may also disclose personal data when required by law, to protect our rights, or in connection with a merger or acquisition (with prior notice to affected users).

Your primary data is stored within the European Union (Supabase EU region). Some sub-processors are based in the United States. For all transfers outside the EU/EEA, we rely on:

• EU Standard Contractual Clauses (SCCs) as approved by the European Commission
• The EU-U.S. Data Privacy Framework, where the processor is certified
• Supplementary technical measures including encryption in transit and at rest

You may request a copy of the applicable safeguards by contacting privacy@tenderradar.io.

We use the following categories of cookies:

For more details, see our Cookie Policy.

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15) — obtain a copy of the personal data we hold about you
• Right to rectification (Art. 16) — request correction of inaccurate or incomplete data
• Right to erasure(Art. 17) — request deletion of your personal data (“right to be forgotten”)
• Right to restrict processing (Art. 18) — request that we limit how we use your data
• Right to data portability (Art. 20) — receive your data in a structured, machine-readable format
• Right to object (Art. 21) — object to processing based on legitimate interest, including profiling
• Right to withdraw consent (Art. 7(3)) — withdraw consent at any time for consent-based processing (e.g., marketing cookies), without affecting the lawfulness of prior processing
• Right not to be subject to automated decision-making (Art. 22) — request human intervention for decisions made solely by automated means that significantly affect you

To exercise any of these rights, contact us at privacy@tenderradar.io. We will respond within 30 days. We may request identity verification before fulfilling your request.

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Row-level security (RLS) ensuring strict multi-tenant data isolation — each organization can only access its own data
• Passwords are hashed using bcrypt; we never store plaintext credentials
• Regular security reviews and access controls for production systems
• Principle of least privilege for internal access to personal data

For questions about this Privacy Policy or to exercise your data rights:

TenderRadar
General inquiries: hello@tenderradar.io
Data protection: privacy@tenderradar.io