Privacy Policy

Version 2026-10-21 · Effective 21 October 2026 · TENDERSEAL LTD

This policy explains what personal data TenderSeal collects, why, who it is shared with, how long it is kept, and the rights you have. It applies to the TenderSeal web application at web.tenderseal.com (the "Service"), to emails we send about it, and to the beta application form on our website, tenderseal.com.

1. Who we are

TenderSeal is operated by TENDERSEAL LTD, a company registered in England and Wales (company number 16060702), whose registered office is at Ashbourne House, Bessler Hendrie, Old Portsmouth Road, Guildford, England, GU3 1LR ("TenderSeal", "we", "us", "our").

For the personal data described in this policy, we are the controller under the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.

Contact: support@in.tenderseal.com, or write to us at the address above. Please use the email address of your TenderSeal account, so that we can confirm the request is yours.

2. The personal data we collect

Information you give us

• Account details: your name and email address, and the password you choose. Passwords are stored by our sign-in provider only as a one-way hash; we never see or store them in readable form.
• Profile details you choose to add: your company name, your company's website and a profile picture.
• Your agreement: the version of our Terms of Service and of this policy you accepted, your confirmation that you are 18 or over, when you did so and how (at sign-up or in the app).
• Your email choices: whether you want our news and tips by email, and each time you turned them on or off: when, how (for example at sign-up, in your Profile, or from a link in one of our emails) and the wording you were shown.
• Your content: the tender documents, company documents, images and other files you upload; the text you write; the questions you ask; and the answers, analyses and drafts the Service produces for you ("Your Content"). Your Content may include personal data about other people, such as the names, roles and CVs of your staff; see section 4.
• Support requests: what you tell us when you contact us, report a problem or give feedback, in the app or by email, and any files you attach. When you email us, we also receive your email address, the message as it was sent, and the checks our email provider runs on it (whether it looks like spam or carries a virus, and whether it really came from the domain it says).
• Beta applications: if you apply to join the beta on our website (tenderseal.com), your name, email address, company, country, how many tenders you submitted in the last 12 months, the kind of projects you bid for, and what you hope TenderSeal will do for you.
• Voice input: if you choose to speak to the in-app guide, your voice is turned into text as you speak. We do not keep the recording or a copy of the audio.

Information from Google, if you sign in with Google

If you choose "Continue with Google", Google shares with us your name, email address, profile picture and Google account identifier, and whether Google has verified your email address. We ask for nothing else from your Google account: no access to your Gmail, Drive, Calendar, contacts or any other Google data. Section 6 explains how we use this information.

Information collected automatically

• Security and sign-in records: when you sign in, our sign-in provider records the time, the method you used, your IP address and your browser's user agent. If you turn on two-step verification, it stores the secret shared with your authenticator app.
• Usage and billing records: the work you run in the Service, how much of your allowance it used and what it cost us; your plan, subscription and payment status. We do not receive or store your card details; they go directly to our payment provider.
• Technical logs: our servers record each request: your IP address, the page or address requested, the time, the response and any error. When something fails, the app reports the error to us with the page you were on: its path only, never the rest of its address (which can hold one-time codes or references).
• Email records: which emails we sent you, when, and whether they were delivered, bounced or marked as spam. We do not keep the content of these emails, and we do not track whether you open them or click their links.

Cookies and similar technologies

We do not use cookies for advertising or analytics, and we do not use any third-party tracking. The Service stores a few items in your browser's local and session storage that it needs to work: your sign-in session, your language, and interface preferences such as which tabs you had open. They are strictly necessary for the Service you have asked for, so they do not need your consent. Signing out removes your session. Our Cookie policy lists every item, what it is for and when it goes, and Cookie settings (in the notice, at the foot of our public pages and in Profile) shows what is stored.

The Service's typefaces are served from our own site, so loading a page shares nothing with a font service. A video embedded in a document loads nothing from its site (such as YouTube) until you press it.

Notifications in your browser

Notifications are off until you turn them on in a browser (in Profile, Notifications, or with Tell me when it's done). When you do, your browser gives us an address at its push service (Google's for Chrome and Edge, Mozilla's for Firefox, Apple's for Safari, Microsoft's for some versions of Edge) and keys to encrypt notifications for it. We keep these, encrypted, with the browser's name (such as "Chrome · macOS"), until you turn notifications off there, sign out of that browser, remove it in your Profile, or the browser stops accepting them, and we delete them after 180 days without a notification.

A notification says what kind of thing happened ("Your Go/No-Go is ready") and where it leads in the Service. It never names a tender, a document or a question, because it may appear on a locked or shared screen. It is encrypted so that only your browser can read it: the push service carries it without seeing what it says, though it sees that a notification was sent and when. The list under the bell in the Service names the tender, because only you see it, signed in.

3. How we use your data, and our lawful bases

Where we rely on legitimate interests, we have weighed them against your interests and rights; you can object at any time (section 9).

Stopping our news and tips. Every news email has an Unsubscribe link, and works with your mail app's own unsubscribe button; you can also turn them off in Profile → Emails. We stop at once. Emails about your account and its security, and our replies when you ask for help, are part of the Service and are sent for as long as you have an account.

We do not use Your Content or your personal data to train AI models. Our AI provider, Anthropic, does not use data sent through its commercial service to train its models. We do not sell personal data, and we do not use it for advertising.

AI processing. The Service uses AI models to read your documents and write answers and drafts for you. It does not make decisions about you that have legal or similarly significant effects. AI output can be wrong; our Terms of Service explain that you should check it before relying on it.

Web searches. When the AI needs information that is not in your documents, it may search the web on your behalf. The search terms it writes, which can reflect what you asked, are sent to web search services through our AI provider.

4. Personal data inside Your Content

The documents you upload may contain personal data about other people, such as the people named in a tender or the CVs of the staff you propose for a bid. We process that data only to provide the Service to you, on your instructions, and protect it as described in section 8. You are responsible for making sure you are allowed to share it with us for that purpose, and for telling those people where the law requires it.

5. Who we share your data with

We share personal data only with the service providers we use to run the Service, each of which may use it only on our instructions and under a written contract that requires them to protect it. Each receives only what its job needs.

Browser push services. If you turn on notifications in a browser, each notification passes through that browser's own push service (Google, Mozilla, Apple or Microsoft, depending on the browser), which delivers it to your device. It receives the address your browser gave us for it and the notification, encrypted so it cannot read it (section 2), and handles them under its own terms as your browser's provider.

We may also disclose personal data:

• if the law requires it, or to respond to a valid request from a court, regulator or law enforcement;
• to protect the rights, safety or property of our users, the public or us, including to prevent fraud;
• to a buyer or successor if our business, or part of it, is sold or reorganised, under the same protections as in this policy. We would tell you before your data became subject to a different privacy policy.

6. Google user data

If you sign in with Google, we receive your name, email address, profile picture, Google account identifier and email verification status, as described in section 2.

• How we use it: only to create and sign in to your TenderSeal account, to show your name and picture in the Service, and to contact you about your account.
• How we share it: it is held by our sign-in and database provider (Supabase) and processed by the providers in section 5 only as needed to run your account. We do not sell it, use it for advertising, or transfer it to anyone else, except as section 5 describes for legal reasons.
• AI: we do not use Google user data to develop, improve or train AI models.
• Storage and protection: it is stored in our database in the United Kingdom, encrypted in transit and at rest, as section 8 describes.
• Retention and deletion: we keep it while your account exists. Deleting your account deletes it (section 7). You can also remove TenderSeal's access at any time in your Google Account, under Security, "Your connections to third-party apps and services"; that stops further sign-ins with Google but does not delete your TenderSeal account.

TenderSeal's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

7. How long we keep your data

When you delete your account from your Profile, we delete your account, profile and Your Content from our systems, and we destroy the encryption key that protects Your Content. Copies may remain in our database provider's encrypted backups until those backups expire on its rolling schedule; we do not restore deleted accounts from backups. Records of what you agreed to, and of your email choices, are kept as shown above. We email the address the account had to confirm the deletion.

8. How we protect your data

• All data is encrypted in transit (HTTPS) and at rest.
• Your documents, conversations and other content are additionally encrypted with a key that belongs to your account alone, which is itself protected by a key held in Amazon Web Services' key management service. Deleting your account destroys your key.
• Access by our team is limited to what their work needs, and the actions our administrators take on accounts are logged.
• You can protect your own account with two-step verification, from your Profile.

No system is completely secure. If a breach affects your personal data in a way that puts your rights at risk, we will tell you and, where the law requires, the Information Commissioner's Office.

9. Your rights

Under data protection law you have the right to:

• access the personal data we hold about you and receive a copy of it;
• correct data that is inaccurate or incomplete;
• delete your data. You can delete your account yourself, at any time, from your Profile;
• restrict how we use your data in certain circumstances;
• object to our use of your data where we rely on legitimate interests;
• data portability: receive the data you gave us in a structured, commonly used, machine-readable format, or have it sent to another organisation;
• withdraw consent, where we rely on it, at any time.

A copy of your data is in your Profile, under Your data: it makes a file of everything we hold about your account (your profile, what you agreed to, your tenders and what TenderSeal produced from them, your documents, conversations, Knowledge Hub, support requests, usage, and the files you uploaded), in a machine-readable format (JSON), with your bid documents as Word files too. We email you when it is ready, and you download it there, signed in. If your files are too large to include in full, the copy lists the rest and you can ask us for them.

To delete your account, use your Profile, under Password & security.

To use any of these rights another way, or if you can't sign in, email support@in.tenderseal.com from your account's email address: so that we only act for the account holder, we act on a request about an account only when it comes from that account's address (and our mail checks confirm it was sent from there) or from the account itself, signed in. We will answer within one month of receiving your request, or tell you within that month if we need longer (up to two further months for complex requests) and why. Using your rights is free, unless a request is clearly unfounded or excessive.

If you are unhappy with how we use your data, please tell us first so that we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: ico.org.uk/make-a-complaint, or 0303 123 1113.

10. International transfers

Some of our providers process personal data outside the United Kingdom, as section 5 shows. Where the destination is not covered by UK adequacy regulations (as the European Economic Area is), we protect the transfer with the UK International Data Transfer Agreement or the UK Addendum to the European Commission's Standard Contractual Clauses, or rely on the provider's certification under the UK Extension to the EU-US Data Privacy Framework. You can ask us for details of these safeguards at support@in.tenderseal.com.

11. Children

The Service is only for people aged 18 and over, and everyone who signs up confirms that they are. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

12. Changes to this policy

We may update this policy, for example when we add a feature or change a provider. The version and the date it took effect are shown at the top of this page. If we make a material change, we will tell you in the app or by email, and ask you to read and accept the new version before you continue using the Service.