Privacy Policy

This Privacy Policy explains what information TenderCopilot AI (“we”, “us”) collects, why we collect it, how we use and store it, and the choices you have. It is written for our users in India and reflects the principles of the Digital Personal Data Protection Act, 2023 (DPDP Act).

1. Who we are

TenderCopilot AI is an AI-assisted procurement and bid-management platform. We act as the data fiduciary for account and profile data you provide, and as a data processor for the tender and proposal content you generate within the product.

2. Information we collect

• Account data: your name and email address. If you sign in with Google or Microsoft, we receive your name, email, and profile image from that provider. If you register with email and password, we store your email and a one-way hash of your password (never the password itself — see our Data & Security Policy).
• Company profile data: business details you enter — legal name, GSTIN, PAN, MSME/Udyam number, turnover, capability description — and documents you upload (GST, PAN, certifications, financials, case studies).
• Product data: tenders you analyze, match and eligibility scores, generated proposals, CRM pipeline entries, and win/loss outcomes you record.
• Billing data: subscription status and payment events. Card/UPI details are handled by our payment processor (Razorpay) and are never stored on our systems.
• Lead data (free checker): our public tender-eligibility checker does not store what you type unless you enter your email. If you do, we store your email and that check’s details to send you matching tenders. You can ask us to delete this at any time; it is also removed if you create and then delete an account with the same email.
• Technical data: session information, IP address in audit logs, and error/usage telemetry used to keep the service secure and reliable.

3. How we use your information

• To provide the core service: matching tenders, scoring eligibility, and generating proposals against your company profile.
• To authenticate you and keep your account secure.
• To process subscriptions and issue receipts.
• To maintain an audit trail of significant actions for security and compliance.
• To improve reliability and troubleshoot problems.

4. AI processing

To score tenders and draft proposals, relevant text is sent to AI providers (Anthropic Claude, and OpenAI for embeddings/fallback) over encrypted connections and processed on your behalf. We minimise what is sent — documents are chunked and only the relevant sections are used. Each AI generation is logged for explainability (model, prompt version, token counts), without exposing your data to other customers.

5. Where your data is stored

Your data is stored only in managed cloud services — a PostgreSQL database (Neon) and private object storage (Cloudflare R2), both encrypted at rest, with compute on Vercel. We operate on a cloud-only model; nothing of value is stored on local or self-managed machines. See the Data & Security Policy for detail.

6. Retention

We keep your data for as long as your account is active. When you delete your account, we permanently remove your account and your organization’s data (see Section 8). Statutory records such as GST tax invoices may be retained for the period required by law. Documents that lapse (e.g. expired certifications) are flagged and can be purged.

7. Sharing

We share data only with the sub-processors that run the service — cloud hosting (Vercel), database (Neon), storage (Cloudflare R2), AI providers (Anthropic, OpenAI), email (Resend), and payments (Razorpay) — each under contractual confidentiality and security obligations, and only to the extent needed to operate TenderCopilot AI. We may disclose data where required by law.

8. Your rights and choices

• Access & correction: view and edit your profile at any time in the app.
• Deactivation: temporarily disable your account from Settings → Danger zone; it reactivates when you sign in again.
• Deletion (Right to be Forgotten): permanently delete your account and organization data from Settings → Danger zone.
• Grievances: contact us at the address below and we will respond within the timelines required by the DPDP Act.

9. Children

The service is intended for businesses and is not directed at individuals under 18.

10. Changes & contact

We may update this policy; material changes will be notified in-product. Questions or grievances: support@tendercopilot.in.