Legal
Privacy Policy
This notice explains what personal data Tendex processes, why we process it, the lawful bases we rely on, who we share it with, how long we keep it, and how you can exercise your privacy rights.
Who we are
Tendex is provided by Tendex Ltd, a company registered in England and Wales. For account, billing, website, analytics, security, support and marketing data, Tendex is the data controller.
When customers put personal data into their workspace, such as colleagues’ details in comments or contact names in bid documents, we process it on the customer’s behalf as a processor under our Data Processing Addendum.
Privacy contact: privacy@tendex.ai.
Personal data we process
- Account data: name, work email, sign-in and authentication identifiers (including Google or Apple sign-in if you choose it), organisation membership, roles, team and security settings.
- Workspace data: company profile and preferences, saved searches, alerts, bookmarks, pipeline records, comments and mentions, uploaded bid documents and draft answers, and prompts you send to AI features.
- Billing data: billing contact, customer and subscription identifiers, invoices and payment status. Card details are collected and held by Stripe, not by us.
- Usage and device data: product events, pages viewed, approximate location from IP address, browser and device details, and error reports.
- Security and service logs: IP addresses, request logs, audit logs of workspace changes, rate-limit records, and email and notification delivery records.
- Communications: messages you send to support and your email preferences.
- Supplier and prospect data: see “Supplier and prospect data” below.
Purposes and lawful bases
| Purpose | Lawful basis |
|---|---|
| Create and run your account and workspace: sign-in, teams, saved searches, alerts, comments, pipeline and bid workflows, AI features you request. | Contract: necessary to provide the service to you or your organisation. |
| Take payment, issue invoices and keep accounting and tax records. | Contract and legal obligation. |
| Send service emails: sign-in codes, invitations, welcome and account notices, billing messages, and the alerts you set up. | Contract, or legitimate interests in operating the service. You can turn alerts off in Settings or with the unsubscribe link. |
| Keep Tendex secure: prevent abuse and fraud (including bot checks at sign-up), rate-limit requests, keep audit logs and investigate incidents. | Legitimate interests in security and fraud prevention. |
| Server-side product and error analytics: pseudonymous events keyed to your account ID (for example sign-up, checkout, feature use, AI usage and cost) and error reports without your name or email. | Legitimate interests in running, measuring and fixing the service. You can object at privacy@tendex.ai. |
| Browser analytics and session replay through optional analytics cookies, including linking events to your name and email. | Consent, given in the cookie banner. You can withdraw it at any time. |
| Contact businesses that may benefit from Tendex (see below). | Legitimate interests in marketing to businesses. |
| Respond to legal requests, enforce our terms and defend claims. | Legal obligation and legitimate interests. |
AI features
When you use AI features (summaries, search criteria generation, company analysis, the assistant, draft answers and bid reviews), we send the context the feature needs — for example tender text, your company profile, your prompt and relevant workspace content, including bid documents you choose to use — to our AI model provider to generate the result. Search queries and tender and company profile text are also converted into embeddings (numeric representations) by embedding providers so that search and matching work. We do not use your content to train AI models, and our providers process it to return results to us. AI output is labelled in the product and should be reviewed before use.
Supplier and prospect data
Tendex builds its market intelligence from public procurement notices and the Companies House register. This includes information about suppliers and buyers, and sometimes the names, job titles and business contact details of people named in notices or listed as company officers.
We also use this public information to identify businesses that may be interested in Tendex and to contact them by business email. We rely on legitimate interests for this, keep the data to business details, and include an opt-out in every message. If you ask us to stop, we keep a minimal suppression record (company number and your choice) so that we do not contact you again. To object or opt out, reply to our message or email privacy@tendex.ai.
Who we share data with
We use the service providers below to run Tendex. They process personal data on our instructions under written contracts. We do not sell personal data. We also share data where the law requires it, and with a buyer of our business if Tendex is sold, subject to this policy.
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online | Server hosting and encrypted backup storage for the application, databases and uploaded documents. | Germany / Finland (EU) |
| Stripe | Payment processing, subscriptions, invoices and tax calculation. | EU, United States |
| Resend | Sending transactional email: sign-in and verification codes, invitations, alerts and account notices. | United States |
| PostHog | Product analytics, session replay (with consent) and error tracking, hosted in PostHog's EU cloud. | EU (Germany) |
| AI model provider | Generating AI output: summaries, search criteria, company analysis, assistant replies, draft answers and bid reviews. Receives the prompt and context for each request. | To be confirmed |
| Voyage AI | Creating embeddings of tender text and search queries for search and matching. | United States |
| OpenAI | Creating embeddings of company profile text for matching. Not used to generate text. | United States |
| Cloudflare | Bot protection (Turnstile) on sign-up. | Global network |
| Sign in with Google (if you choose it), our business email (Google Workspace), and browser push delivery on Chrome. | United States, EU | |
| Apple | Sign in with Apple (if you choose it) and browser push delivery on Safari. | United States |
| Mozilla | Browser push delivery on Firefox, if you enable push notifications. | United States |
Our database, authentication, search and AI assistant services (Supabase, ZITADEL, Milvus and Tambo) are open-source software that we run ourselves on our Hetzner servers, so those projects do not receive your data.
International transfers
Our servers are in the European Economic Area, which the UK recognises as providing adequate protection. Some providers above process data in the United States or elsewhere. Where that happens we rely on the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK-US data bridge where the provider is certified, together with the provider’s security measures.
How long we keep data
| Data | Retention |
|---|---|
| Account and workspace data | For the life of the account or workspace, then deleted within 30 days of closure (unless you ask us to delete it sooner). |
| Server, security and request logs | Up to 30 days; security audit logs up to 90 days. |
| Backups | Encrypted backups roll off on a fixed schedule; deleted data is removed from all backups within 12 months. |
| Product analytics and session replays | Analytics events up to 24 months; session replays up to 30 days. |
| Invoices and accounting records | 6 years from the end of the financial year they relate to, as required by UK law. |
| Prospect data | Until you opt out or the business no longer appears in public records; suppression records for as long as needed to honour your opt-out. |
Your rights
You can ask to access, correct, delete or restrict your personal data, to receive a copy in a portable format, and to object to processing based on legitimate interests (including direct marketing, which we will always stop). Where we rely on consent you can withdraw it at any time.
Signed-in users can download an account data export and submit requests from Privacy settings. You can also email privacy@tendex.ai. We respond within one month. If your data is held in a customer workspace, we may refer your request to that customer as controller.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to help first.
Security
We protect data with encryption in transit, access controls and least-privilege service accounts, multi-factor authentication for administrative access, audit logging and encrypted backups. More detail is on our security page.
Cookies
Essential cookies are needed for Tendex to work. Analytics and preference cookies are optional and are only set after you agree in the cookie banner. See the Cookie Policy.
Changes to this policy
We will update this policy when our processing changes and show the date of the latest version at the top. We will tell account holders about material changes by email or in the product.