Privacy
What we collect, who receives it, how long we keep it, and how to have it deleted. Written for India's Digital Personal Data Protection Act, 2023.
Tenderlytix reads government tender documents for bidders. Tenderlytix decides why and how the personal data described here is processed, which makes it the “data fiduciary” under the Digital Personal Data Protection Act, 2023 (“the Act”).
Tenders are mostly business documents. They can still contain personal data, such as the name or phone number of a tender officer, and so can your account and company profile. This notice covers all of it.
What we hold depends on how you use Tenderlytix.
Free check, no account. You upload one PDF. We read it in memory and send its text, or page images for scanned pages, to our AI provider to extract the fields you see. The PDF is not saved to storage or to our database. We keep a log row for each AI call (model, token counts, cost, time) with no document text. We also count the step of the funnel you reached (for example “check completed”) without your document or your email address. If you leave an email for an early-access or waitlist form, we store the email, an optional name, your note and the page it came from, to write to you about it.
Account and workspace. Sign-in is handled by Clerk, which gives us your email address, name and workspace membership. In a workspace we store what you add and what we produce from it: tender PDFs and the text read from them, extracted values and scores, your company profile (for example turnover, registrations, past projects and signatories), annexure drafts and emails, corrections you make, notifications, your credit balance and purchases, and a log of AI use. We use this to run the service for you.
Feedback and email. If you send feedback we keep the message, your optional email, the category and the page it came from. We send “analysis ready” and bid-deadline reminder emails through Resend; you can switch the reminders off in your settings, and each email carries an unsubscribe link.
Security and abuse prevention. To stop automated misuse we apply request limits per visitor and a bot check (Cloudflare Turnstile) on public forms. The limits use your IP address as a key. That key is stored as the IP address itself, not hashed (an IPv6 address is reduced to its network prefix), in a counter table, and is deleted about a day after its window ends. Our hosts keep ordinary request logs, which include IP addresses, for their own retention periods.
Usage counts. We count events such as home-page views, button clicks and sign-ups to see which parts of the product help. Events hold fixed words and, when you are signed in, your workspace and user id. They never hold document text or email addresses. Page views are also counted by Vercel Web Analytics, which does not use cookies.
We process this data to provide Tenderlytix, to keep it secure, to reply to you, and to meet legal duties. We do not sell personal data and we do not use it for advertising.
We process personal data with your consent, which you give when you upload a document, create an account or submit a form, and for the legitimate uses the Act allows, such as answering a request you made and keeping the service secure. You can withdraw consent at any time (see “Your rights”); withdrawing means we can no longer provide the part of the service that needs the data.
We share data only with the providers below, to the extent each one needs it. They process it for us under their service terms.
| Provider | What it receives | Why |
|---|---|---|
| OpenAI | Tender text and, for scanned pages, page images; your questions about a tender; company-profile text used in matching | Reading tenders, answering questions, drafting annexures and emails, embeddings for search within a tender |
| TypeSafe | Tender text, only when an optional decision feature is switched on (all off in production at the time of writing) | Classification of feedback and of some tender decisions |
| Clerk | Email, name, workspace membership, sign-in sessions | Accounts and sign-in |
| Neon | The database: tenders, extracted values, company profile, logs, waitlist emails, feedback | Database hosting |
| Cloudflare R2 | Original PDFs, extracted text and generated annexure files (workspace only) | File storage |
| Cloudflare Turnstile | Browser signals used for the bot check, on public forms | Stopping automated misuse |
| Render | All API traffic, including uploads | API hosting (Singapore region) |
| Vercel | Page requests; page-view counts without cookies | Website hosting and Web Analytics |
| Resend | Your email address and the text of the email | Sending analysis-ready and reminder emails |
| Sentry, Axiom | Error and server logs, which can include request details; only if switched on | Finding and fixing faults |
Our API runs in Singapore. Several of the providers above, including OpenAI, Clerk and Vercel, run infrastructure outside India, so your data can be processed outside India. We transfer it only to the providers listed here and only for the purposes in this notice.
| Data | How long |
|---|---|
| Free-check PDF | Not stored. It exists in memory while the check runs. |
| Request-limit keys (IP address) | Deleted about a day after their window ends. |
| Tenders, files and results in a workspace | Until you delete the tender in the workspace, which removes its records and stored files, or ask us to delete your data. |
| Company profile, credits, drafts and emails | Until you ask us to delete them. |
| Notifications | Only your 25 newest are kept. |
| Feedback, waitlist emails, AI-use logs, usage counts | Until you ask us to delete them. AI-use logs and usage counts carry no document text. |
| Your Clerk account | Until you delete it. Deleting the account does not yet remove your workspace data; write to us and we will. |
We keep what the law requires us to, for example invoices. When a tender or account is deleted, copies in provider backups can remain for a short time until those backups expire.
Under the Act you have the right to:
Email privacy@tenderlytix.com from the address you signed up with, say what you want (access, correction, deletion or withdrawing consent) and, if it is about a workspace, give its name. We will check that the request comes from you, reply within two working days, and tell you how long the work will take.
You can also delete individual tenders yourself in the workspace. Deleting a tender removes it and its stored files.
For a complaint about how we handle your data, write to our grievance officer at privacy@tenderlytix.com. We reply within two working days. If we do not resolve it, you may complain to the Data Protection Board of India under the Act.
Tenderlytix is for businesses and is not meant for anyone under 18. We do not knowingly collect data from children.
We will update this page when what we do changes, and change the date at the top. For a change that matters, we will tell you by email or in the product. The terms of service cover the rest of how you may use Tenderlytix.