Privacy policy

1. Who is responsible for your data

The service and your personal data are operated by the Tenderwatch team. For any question about your data, write to [email protected].

2. What we collect

We only collect what the service needs:

• Access requests: email, name, company, use case and its description, markets of interest, team size, preferred contact and interface language.
• Account: email, username, language and time zone, plus profile details if you fill them in. Passwords are stored only as hashes.
• Sessions and security: IP address, browser type (user agent), sign-in and last-activity times — so you can see your devices and end a session you don't recognise; one-time two-factor codes.
• Organization work data: workspaces, search profiles, service catalog, recipients, tender decisions, members and their roles.
• Notifications: notification history; your Telegram chat id if you connect the bot; a device token if you turn on push notifications.
• Visit statistics: anonymous statistics of the public pages (home, documents, sign-in and access request) in our own Umami instance — no cookies, no cross-site tracking and no stored IP addresses. The app behind sign-in is not tracked.

3. Why we use it

We use the data to:

• provide the service: find tenders, assess them and deliver them to your team;
• sign you in and protect your account;
• review access requests and contact you about them;
• send the notifications you turned on;
• understand which public pages are useful and fix errors.

4. What we don't do

We don't sell your data, use it for advertising or share it with ad networks.

5. Who receives data

To run the service we rely on these companies:

• Contabo GmbH — hosting; the server is located in France (EU).
• Cloudflare — protection and delivery of the website traffic.
• Google (Gmail) — sending emails: sign-in codes, invitations, notifications.
• Telegram — only if you connect the notification bot.
• An AI model provider — receives the text of public tenders and your organization's service descriptions to assess tenders. No personal data of users is sent to it.

6. How long we keep it

Account and organization data are kept while the account exists. Access requests are kept as long as they are needed to review them and contact you. Deleted data may remain in database backups for up to 14 days.

7. Your rights

You can ask for a copy of your data, correct or delete it, and delete your account. Some data can be changed in your profile, and active sessions can be ended on the devices page. Anything else — write to [email protected]; we answer within 30 days.

8. Cookies

We only use strictly necessary cookies:

• session cookies — keep you signed in and are not readable by JavaScript;
• NEXT_LOCALE — remembers the language you chose.

9. Security

Connections use HTTPS, passwords are stored as hashes, sign-in tokens live in protected cookies, organizations are isolated from each other and two-factor authentication is available. No system is perfectly secure — if you notice a vulnerability, please report it to [email protected].

10. Age

The service is meant for organizations and is not intended for anyone under 16.

11. Changes

A new version is published on this page with a new date. We will email you about significant changes.