Privacy policy

Last updated 23 July 2026

This explains what personal data Tenderoo collects and how we use it. Sharp.works Ltd (company no. 09679033, registered in England and Wales, registered office 75 Vicarage Avenue, Cheadle Hulme, Cheadle SK8 7JP, England) is the data controller. We follow UK GDPR. To exercise any of your rights, email support@tenderoo.co.

What we collect

• Account: your name and email address, and a password we store only as a hash. If you sign in with Google, we receive your name, email address and profile picture from Google instead of a password. We also keep sign-in activity, such as when your account was last used.
• Company profile: the business you add and the profile you build on it. We seed it from public sources (the Companies House register and, if you give us one, your website), and you can then edit it: services, coverage, capacity, experience, accreditations, and any evidence you upload.
• Companies you look up: when anyone runs a company lookup we fetch and store public information about that business so we can score it against live tenders. See "Companies you look up" below.
• Payment: handled by Stripe when you buy a paid plan. We store your subscription status and a Stripe customer reference; we never see or store your card details.
• Usage and security: how you use the service, plus your IP address, which we use for rate limiting and abuse protection. We keep short-lived operational logs so we can run the service securely and diagnose faults.

Cookies

We set a small number of essential cookies and nothing else:

• Sign-in cookies: two cookies that keep you signed in (a short-lived session cookie and a longer-lived one that renews it). Without them you cannot stay logged in.
• Google sign-in cookie: a short-lived cookie set only while you sign in with Google, so we can return you to the page you started from. It expires within minutes.

We use Plausible for analytics. It is cookieless: it sets no cookies and collects aggregate counts only, with no cross-site identifiers. Our sign-up, log-in and lookup forms run Cloudflare's Turnstile bot check to keep automated abuse out. We set no advertising or tracking cookies.

Why we use it

To provide the service: match tenders to your company, score fit, prepare bids, take payment, and keep your account secure. The legal bases are performing our contract with you, and our legitimate interests in running the service securely and improving it. Match alert and digest emails follow your notification preferences; every alert email carries an unsubscribe link, and you can change preferences in your account settings at any time.

AI processing

We use AI to read tender notices, score how well a tender fits a company, and draft content you ask for. To do that we send the relevant tender text and company profile to our AI provider, currently OpenAI, through its business API, under terms that do not permit your data to be used to train their models. If we switch or add providers, it will be on equivalent terms.

Who we share it with

We use a small set of processors, each only for what it is named for:

• Cloudflare: hosting, storage and abuse protection.
• OpenAI: the AI analysis described above.
• Postmark: sending our emails, and telling us when one bounces.
• Stripe: payments and billing.
• Plausible: cookieless, aggregate analytics.
• Google: only if you choose to sign in with Google.

We also read public data sources: the Companies House register and the Find a Tender and Contracts Finder feeds. We do not sell your data, and we do not share it with anyone for advertising.

International transfers

Some of our processors (OpenAI and Postmark) process data in the United States, and Cloudflare operates globally. Where personal data leaves the UK, the transfer is covered by UK-approved safeguards: the UK Addendum to the EU Standard Contractual Clauses or an adequacy decision, as applicable to each provider.

Companies you look up

Anyone can look up a company on Tenderoo. When that happens we fetch and store publicly available information about the business: its Companies House record and, where a website is given, the services described on it. For most companies this is business data; for sole traders and partnerships it can include personal data. We process it under our legitimate interest in matching public contracts to the businesses that could win them. If a profile about your business is wrong, or you want it removed, email us and we will correct or delete it.

How long we keep it

For as long as your account is active. Deleting your account removes your profile, your company workspace and its contents. We keep what the law requires us to keep (for example billing records for accounting), and short-lived security and operations logs, which are not linked back to a deleted account.

Your rights

You can access, correct, export or delete your data, and object to or restrict some processing. Export and deletion are self-serve: both are in your account settings, and the export downloads everything we hold on your account as a file. For anything else, email us and we will help. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk.

Changes to this policy

If we change this policy we will post the new version here with a new date. If a change is material we will tell you in the app before it takes effect.

Contact

Privacy questions or requests: support@tenderoo.co.