Privacy Notice

This notice explains what personal data Tenderbot collects, why we hold it, who we share it with and what rights you have. It covers the tenderbot.ai website, the Tenderbot application and our emails.

It sits alongside our Terms of Service. If you are a customer, both apply to you.

1. Who we are

Tenderbot Limited is the data controller for the personal data described in this notice, except where section 8 says otherwise.

• Registered in England and Wales, company number 16808351
• Registered office: 24 Avenue Road, Isleworth, England TW7 4JN
• Registered with the Information Commissioner’s Office, reference ZC115530
• Contact for anything in this notice: support@tenderbot.ai

2. What we collect

When you visit the website. We do not run analytics or tracking on the website, so browsing it does not build a profile of you. Our hosting provider keeps standard server logs, including IP addresses, for security and fault finding. If you arrive from a campaign link and then fill in a form, the campaign details in that link are saved with your enquiry so we know which campaign brought you.

When you create an account. Your name, work email address, phone number where you give it, your company name and a description of what your business does.

When you subscribe. Billing name and address, VAT number where relevant, and a record of payments, invoices and refunds. Card details go straight to Stripe. We never see or store your full card number.

When you use the Service. The sectors and keywords you set, which alerts you open, which notices you save, dismiss or act on, and your settings. Where your plan includes them, the tender documents, evidence, answers and buyer records you upload or create, and the users you invite.

When you contact us. Emails, support messages, feedback and anything you send us about a wrong match or a fault.

Technical logs. Sign-in times, IP addresses, error and performance logs, kept so we can keep the Service secure and working.

We do not ask for or want special category data, such as health or ethnicity. Please do not upload documents containing it. If your evidence or bid documents happen to include personal data about your staff or contacts, section 8 explains how that is handled.

3. Why we hold it, and our lawful basis

Where we rely on legitimate interests, we have considered whether it is fair to you. You can object at any time using the details in section 11.

6. Who we share it with

We do not sell your personal data and we do not share it for other companies' marketing.

We use service providers who process data on our behalf, in these categories:

• Hosting and infrastructure, to run the application and store data
• Payments, to take card payments, run subscriptions and issue invoices
• Email delivery, for alerts, service emails and marketing campaigns
• AI model providers and model hosting platforms, to read notices, match them, extract information from documents and draft answers. This includes commercial model providers and platforms that route requests to a range of models, including open source models. The models and providers we use change as the technology moves.
• Business tools, such as our own email, storage and support systems

We publish categories rather than a fixed list because our providers change. If you are a customer and need the current named list, including for your own supplier due diligence, email support@tenderbot.ai and we will send it.

We also share data where the law requires it, to establish or defend legal claims, and with a buyer or successor if the business is sold, in which case we will tell you.

7. AI processing

Reading notices, matching them and drafting answers all involve sending content to third-party AI providers. What we send is limited to what the feature needs, for example the text of a notice, your business description, or the tender document and internal content you have asked us to draft from.

We choose providers and settings that, according to their published terms, do not use API inputs to train their models. We do not control those providers, so we cannot guarantee how they handle data. We ourselves do not use your uploaded documents, evidence or answers to train models that serve other customers.

Some of these providers operate outside the UK. Section 9 covers transfers.

AI output is a draft. No decision about you is made by automated means alone that produces a legal or similarly significant effect.

8. When we act for you rather than for ourselves

Where you upload documents, evidence or buyer records that contain personal data about other people, such as your staff or a procurement contact, you are the controller of that data and we process it on your behalf as your processor. We only use it to provide the Service to you and to follow your instructions.

If you need a written data processing agreement, or the named sub-processor list, email support@tenderbot.ai.

11. How long we keep it

• Account and content: while your account is open, then 30 days after it closes so you can ask for it back, then deleted
• Backups: overwritten on their normal cycle, within 90 days
• Billing and tax records: six years after the end of the relevant accounting period, because HMRC requires it
• Waitlist and marketing contacts: until you unsubscribe, or after two years of no engagement
• Support emails: two years
• Technical and security logs: twelve months

12. Your rights

Under UK data protection law you can ask us to give you a copy of your personal data, correct it, delete it, restrict or stop our use of it, send it to another provider in a portable format, and object to processing we base on legitimate interests, including profiling. Where we rely on consent, you can withdraw it at any time.

Email support@tenderbot.ai and we will respond within one month.

If you are unhappy with how we have handled your data, tell us first and we will try to put it right. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.