TenderCure — Privacy Policy

1. Who We Are

TenderCure is an AI-powered tender response platform operated by TenderCure Ltd. If you have any questions about this privacy policy or how we handle your data, contact us at notifications@tendercure.co.uk.

2. What Data We Collect

Data Type	Details	Collected When
Account information	Full name, email address, password (hashed)	Registration
Company information	Company name, description, certifications, staff details, fleet data, KPIs, contract history, key personnel names and roles	Company profile setup and document upload
Uploaded documents	PDF files you upload for data extraction (policies, fleet registers, certificates, previous tender responses)	Document upload
Generated content	Tender responses generated by the AI, verification results, user edits	Tender generation
Session cookies	A session identifier to keep you logged in	Login
Usage data	Pages visited, features used, error logs (via Microsoft Clarity and server logs)	All visits

3. Why We Collect It

We collect your data solely to provide and improve the TenderCure tender generation service:

Account data — to authenticate you and manage your account
Company data & documents — to generate accurate, evidence-based tender responses grounded in your real company information
Generated content — to allow you to review, edit, and export tender responses
Session cookies — to keep you securely logged in between page loads
Usage data — to identify bugs, improve performance, and understand which features are most useful

We do not use your data for advertising, profiling, or any purpose unrelated to providing the service.

4. How Long We Keep It

Account data — retained while your account is active. Deleted within 30 days of account deletion request.
Company profile & generated tenders — retained while your account is active.
Uploaded documents — stored in Cloudflare R2 (encrypted at rest). Deleted when you remove them or when your account is deleted.
Session data — sessions expire after 7 days. Expired sessions are automatically purged.
Server logs — retained for up to 30 days for debugging purposes.

5. Who We Share It With

We use the following third-party data processors to deliver the service. Your data is never sold.

Processor	Purpose	Data Shared
Anthropic	AI processing (tender generation, document extraction)	Company profile data, uploaded document content, tender requirement text
Cloudflare (R2)	File storage	Uploaded PDF documents
Railway	Application hosting	All application data (encrypted in transit)
Resend	Transactional email (password resets, notifications)	Email address, notification content
Microsoft Clarity	Usage analytics	Anonymised interaction data (page views, clicks)

6. Your Rights

Under UK data protection law (UK GDPR), you have the right to:

Access — request a copy of all personal data we hold about you
Rectification — correct any inaccurate data (you can also edit your profile directly in the app)
Erasure — request deletion of your account and all associated data
Portability — receive your data in a structured, machine-readable format
Object — object to processing of your data where we rely on legitimate interests

To exercise any of these rights, email notifications@tendercure.co.uk. We will respond within 30 days.

7. Cookies

TenderCure uses strictly necessary cookies only:

Cookie	Purpose	Duration
session_id	Keeps you logged in	7 days

We do not use tracking cookies, advertising cookies, or any third-party cookies for marketing purposes. Microsoft Clarity uses its own cookie for analytics, which is covered under their privacy policy.

8. Data Security

We protect your data through:

HTTPS encryption for all data in transit
Encrypted-at-rest storage for uploaded documents (Cloudflare R2)
Hashed passwords (bcrypt) — we never store plaintext passwords
Rate limiting on authentication endpoints
Content Security Policy headers to prevent XSS attacks

9. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email to registered users. The "last updated" date at the top of this page always reflects the current version.

10. Governing Law

This privacy policy is governed by the laws of England and Wales. Any disputes will be subject to the exclusive jurisdiction of the courts of England and Wales.

11. Contact

For any privacy-related queries, contact us at:
notifications@tendercure.co.uk