Privacy Policy
Last updated: October 2026
1. Who We Are
TenderCure is an AI-powered tender response platform operated by TenderCure Ltd. If you have any questions about this privacy policy or how we handle your data, contact us at notifications@tendercure.co.uk.
2. What Data We Collect
| Data Type | Details | Collected When |
|---|---|---|
| Account information | Full name, email address, password (hashed) | Registration |
| Company information | Company name, description, certifications, staff details, equipment and asset records, KPIs, contract history, key personnel names and roles | Company profile setup and document upload |
| Uploaded documents | PDF files you upload for data extraction (policies, asset and equipment registers, certificates, previous tender responses) | Document upload |
| Generated content | Tender responses generated by the AI, verification results, user edits | Tender generation |
| Session cookie | A session identifier to keep you signed in | Sign-in |
| Product usage data | Pages viewed, time on page and features used inside the app. No document, company profile or tender response content is captured. | While you use the app, signed in |
| Server logs | Requested page or endpoint, IP address, and error details | Every request to our servers |
| Public website analytics (optional) | How visitors use our public website pages (page views, clicks, scrolling, and recordings of page interactions), collected by Microsoft Clarity | Only on our public website, and only if you accept analytics. Never inside the app. |
3. Why We Collect It and Our Lawful Basis
We collect your data solely to provide and improve the TenderCure tender generation service. Under UK GDPR we rely on the following lawful bases:
- Contract — to provide the service you have signed up for:
- Account data — to authenticate you and manage your account
- Company data & documents — to generate accurate, evidence-based tender responses grounded in your real company information
- Generated content — to allow you to review, edit, and export tender responses
- Session cookie — to keep you securely signed in between page loads
- Legitimate interests — our interest in running a reliable, secure product and improving it:
- Product usage data — first-party analytics inside the app (page views, time on page and feature use; no content captured), to understand which features are useful and where the product needs work
- Server logs — to identify bugs, investigate errors and protect the service from misuse
- Consent — for Microsoft Clarity analytics on our public website. Clarity only runs if you choose “Accept analytics”, and you can withdraw consent at any time using “Cookie settings” in the website footer.
We do not use your data for advertising, profiling, or any purpose unrelated to providing the service.
4. How Long We Keep It
- Account data — retained while your account is active. Deleted within 30 days of account deletion request.
- Company profile & generated tenders — retained while your account is active.
- Uploaded documents — stored in Cloudflare R2 (encrypted at rest). Deleted when you remove them or when your account is deleted.
- Session data — sessions expire after 7 days. Expired sessions are automatically purged.
- Product usage data — retained for 13 months, then deleted.
- Server logs — retained for up to 30 days for debugging purposes.
- Public website analytics (Microsoft Clarity) — held by Microsoft under its retention periods: recordings for 30 days, and click and heatmap data for 9 months (Microsoft’s Clarity data retention).
5. Who We Share It With
We use the following third-party data processors to deliver the service. Your data is never sold.
| Processor | Purpose | Data Shared |
|---|---|---|
| Anthropic | AI processing (tender generation, document extraction) | Company profile data, uploaded document content, tender requirement text |
| OpenAI | Document embeddings (so your company documents can be searched by meaning when answering tender questions) | Text from your uploaded documents and tender question text |
| Cloudflare (R2) | File storage | Uploaded PDF documents |
| Railway | Application hosting | All application data (encrypted in transit) |
| Resend | Transactional email (password resets, notifications) | Email address, notification content |
| Microsoft Clarity | Analytics on our public website only, with your consent. Never used inside the app. | Interaction data from public website pages (page views, clicks, scrolling, recordings of page interactions) and a pseudonymous ID stored in cookies |
6. Your Rights
Under UK data protection law (UK GDPR), you have the right to:
- Access — request a copy of all personal data we hold about you
- Rectification — correct any inaccurate data (you can also edit your profile directly in the app)
- Erasure — request deletion of your account and all associated data
- Portability — receive your data in a structured, machine-readable format
- Object — object to processing of your data where we rely on legitimate interests
- Withdraw consent — where we rely on your consent (website analytics), withdraw it at any time using “Cookie settings” in the website footer
To exercise any of these rights, email notifications@tendercure.co.uk. We will respond within 30 days.
7. Cookies
Inside the app, TenderCure uses one strictly necessary cookie and nothing else. On our public website, Microsoft Clarity analytics cookies are set only if you choose “Accept analytics”.
| Cookie | Set by | Purpose | Type | Duration |
|---|---|---|---|---|
| tendercure_session | TenderCure | Keeps you signed in | Strictly necessary | 7 days |
| _clck | Microsoft Clarity (public website only) | Stores a pseudonymous Clarity user ID so visits to our website can be grouped together | Optional — only with your consent | Set by Microsoft — see Microsoft’s Clarity cookie list |
| _clsk | Microsoft Clarity (public website only) | Connects page views into a single Clarity session recording | Optional — only with your consent | Set by Microsoft — see Microsoft’s Clarity cookie list |
When Clarity runs, Microsoft may also set its own third-party cookies on Microsoft domains (CLID, ANONCHK, MR, MUID and SM). These are listed in Microsoft’s Clarity cookie list and covered by Microsoft’s privacy statement.
We also store your cookie choice in your browser’s local storage (tc_consent) so we do not ask again on every page. This is strictly necessary to respect your choice.
You can change your choice at any time using “Cookie settings” in the website footer. If you reject analytics after accepting, we stop loading Clarity and delete its cookies on our website. See our Cookie Policy for details.
8. Data Security
We protect your data through:
- HTTPS encryption for all data in transit
- Encrypted-at-rest storage for uploaded documents (Cloudflare R2)
- Hashed passwords (bcrypt) — we never store plaintext passwords
- Rate limiting on authentication endpoints
- Content Security Policy headers to prevent XSS attacks
9. Changes to This Policy
We may update this policy from time to time. Material changes will be communicated via email to registered users. The "last updated" date at the top of this page always reflects the current version.
10. Governing Law
This privacy policy is governed by the laws of England and Wales. Any disputes will be subject to the exclusive jurisdiction of the courts of England and Wales.
11. Contact
For any privacy-related queries, contact us at:
notifications@tendercure.co.uk