Privacy Policy

AUTOTENDER LTD, registered in England and Wales, number 17519532, registered office: 128 City Road, London, EC1V 2NX, United Kingdom ("AutoTender", "we", "us", "our") operates AutoTender.ai, a platform that finds government tenders, helps you write bids and fills portal forms for you to submit. This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use our Service, visit our website, or interact with our Chrome browser extension. We act as the data controller for the personal data described in this policy. For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, our contact for data protection enquiries is privacy@autotender.ai.

Account data: email address, name, company name, and persona selection (SME owner or bid writer) provided during registration. If you sign in via a third-party single sign-on provider, we receive your email address and display name from that provider. Company profile data: company description, sector, country, registration number, founding year, employee count, website, address, team member names and qualifications, certifications and expiry dates, past project descriptions and values, and pricing information (day rates, margin targets, currency preferences) provided during onboarding and through the profile editor. Client profile data: if you are a bid writer or consultancy, you may create client profiles containing client company details, contact details, registrations, sectors, the opportunities they target, pricing information, declarations, team members, certifications, and project history. Portal logins: we do not collect or store your procurement portal logins. You sign in to each portal yourself. Bid data: generated proposals, agent pipeline outputs, quality scores, the submission confirmations you record through the Chrome extension, win/loss outcomes, reviewer feedback, and audit trails. Usage data: pages visited, features used, interaction patterns, browser type, device type, and approximate location derived from IP address. This data is collected automatically through our hosting provider's privacy-friendly analytics (only when you consent to cookies) and server-side logging. Payment data: card payments are processed by our payment processor. We never see, store, or process your full card number. From the processor we receive your subscription status, plan, billing period and currency, the brand and last four digits of the card on file (so that we can show you which card will be charged), and the customer ID it gives your account, which we keep with your account. We also keep a record of each payment and refund: the amount, any tax and the currency. Payment records are kept for 7 years (section 9). If you cancel and choose to give a reason or a note, it is stored with your subscription at our payment processor (not in AutoTender), where we read it to improve the Service; it is optional. Communication data: emails we send you (transactional and digest) and any messages you send to our support email addresses. Referral data: if you open AutoTender through a referral link, the referral code is kept in a first-party cookie called at_ref for up to 30 days and is carried through sign-up, so that it reaches your account even if you sign up with Google or Microsoft or confirm your email on another device. Once you sign up, it is stored in your account record on our servers so that the referral discount and the referrer's credit can be applied, and the cookie is deleted when you finish onboarding. To prevent abuse, we compare the email domains of the referrer and the referred user; when they match, the referrer's credit is held for 7 days. The referrer sees only counts of sign-ups and conversions, never who you are. Email link data: if you open AutoTender through a link in one of our business emails (section 17), the link's campaign tags, our reference for your company's record, the tender the email was about and, for a US company, its SAM.gov Unique Entity ID are kept in a first-party cookie called at_acq for up to 30 days. When you sign up, they are stored with your account so that we know which email brought you and can open that tender for you, and the cookie is deleted when you finish onboarding.

We process your personal data for the following purposes: providing the Service (discovering tenders, generating bid proposals, verifying content, and filling portal forms through the Chrome extension for you to submit); personalising tender matches based on your company profile, sector, certifications, and geographic preferences; improving bid quality through aggregate win/loss analysis (your individual bid content is never shared with other users); sending transactional emails including bid status updates, review requests, deadline reminders and payment confirmations; sending, only if you have agreed to them, the weekly digest, tender discovery alerts, product updates (which include invitations to share your referral link) and one email, if you stop using AutoTender for a while, about the new matches found meanwhile; preventing fraud, abuse, and Terms of Service violations; comparing the wording of AutoTender bids for the same tender, so that repeated wording can be rewritten and each bid stays the customer's own (no customer is shown another customer's bid or told who else is bidding); maintaining and improving the Service through anonymised usage analytics; and complying with legal obligations including tax, accounting, and regulatory requirements.

For users in the European Economic Area (EEA) and United Kingdom, we process your personal data under the following legal bases: Contract performance (Article 6(1)(b) GDPR) for providing the Service, processing payments, and sending transactional emails. Legitimate interest (Article 6(1)(f) GDPR) for product improvement through anonymised analytics, fraud prevention, and service security. We have conducted a legitimate interest assessment and determined that these interests do not override your rights. Consent (Article 6(1)(a) GDPR) for optional analytics cookies (our hosting provider's privacy-friendly analytics) and the emails you choose to receive as a user: the weekly digest and tender discovery alerts, and product updates (news, tips and offers, including invitations to share your referral link, an occasional short survey and the one email about new matches if you stop using AutoTender for a while). You agree to each of the two with its own box at sign-up (both start unticked), or with a switch on your email preferences page. You may withdraw consent at any time: switch them off there (the Manage email preferences link at the bottom of every email we send), or use your email app's Unsubscribe button. The business emails we send to companies that are not users rely on legitimate interests and are described in section 17. Legal obligation (Article 6(1)(c) GDPR) for tax reporting, regulatory compliance, and responding to lawful data access requests.

Your company data and tender documents are processed by AI models, through the paid APIs of commercial AI model providers, to generate bid proposals. Specifically: your company profile, building blocks, and tender requirements are sent over encrypted connections from our servers to the provider. Under the paid terms we use, the providers do not use prompts (including cached content) or responses to train or improve their models; they may keep them for a limited period solely to detect misuse and for any legally required disclosures, and that data may be stored transiently or cached in any country where the provider operates. While a bid is being written, the tender's documents may also be held briefly in the provider's cache so that they are not sent again for each step. If our main provider is unavailable, the same request is sent to a second provider on the same kind of terms (both are in the AI model providers category in section 7); and the generated content (proposals, verification outputs, quality scores) is stored in our managed database, protected by Row Level Security (RLS) policies. We do not use your data to train any AI models, whether our own or third-party. Generated proposals are your intellectual property.

If you choose to import evidence from Google Drive or OneDrive, we ask the provider for the narrowest access it offers. Google Drive: the drive.file scope, which lets AutoTender read only the files you pick in Google's file picker, never the rest of your Drive. OneDrive: the Files.Read scope (with sign-in and offline access), which lets AutoTender read files and list folders in your OneDrive; we open only the folder you choose and the files in it. We read the files you selected and nothing else, and we do not change or delete anything in your account. Each file you import is read once, turned into text where needed, and the whole document is sent to our AI model provider so that it can be sorted into your evidence library (for example a case study, a certificate, a policy or a CV); the same terms as in section 5 apply. The result, a title and the reusable content the model extracted, is stored as a block in your library; we keep a fingerprint of the file so an unchanged file is not processed again, but we do not keep a copy of the original file. A CV or similar document can contain personal data about the people named in it; import only documents you are entitled to use for bids. The connection tokens are stored encrypted (AES-256-GCM) and are used only when you import. To stop access: choose Disconnect in Settings, Connections, which deletes the tokens we hold; to remove AutoTender from your provider's list of connected apps as well, remove it in your Google Account permissions or your Microsoft account's app permissions. Blocks already created stay in your library until you delete them. Our legal basis is contract performance (Article 6(1)(b)): you start each import yourself.

We do not sell, rent, or trade your personal data to third parties. We share data only with the following categories of sub-processors, each bound by data processing agreements: cloud hosting, database, and infrastructure providers (database hosting, authentication, file storage, frontend hosting, edge functions, workflow-engine hosting, DNS, DDoS protection, CAPTCHA, and distributed rate-limiting; with providers that hold SOC 2 Type II reports); AI processing providers (proposal generation and verification); payment processors (subscription billing; PCI DSS Level 1 certified); email delivery providers (transactional and outreach email); error-monitoring providers (error reports, which carry your user ID but not your email address or IP address; see section 11); and a cloud browser provider (checking that procurement portals are reachable and reading public tender listings; it never signs in with your login). Portals receive your bid only when you submit it yourself. Section 7 lists each category, where it operates and how each transfer is protected. Customers can download the named list, with what each sub-processor receives, from Settings in the application (Download Your Data); questions to legal@autotender.ai. You may also request the specific recipients of your personal data under your data-subject access rights. We may also disclose data if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of AutoTender, our users, or the public.

Your data may be transferred to and processed outside the United Kingdom, mainly in the United States, where our sub-processors operate. Each transfer from the UK relies on the mechanism shown below for its category: the UK-US data bridge for a recipient listed under the UK Extension to the EU-U.S. Data Privacy Framework, and otherwise the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for a copy of the safeguards at the address in section 6. We last checked each recipient's Data Privacy Framework status on 15 October 2026.

• Database, authentication and file storage provider (United States): Stores your account, company and bid data, and handles sign-in. Data: Account, company and bid data you store in AutoTender. Transfer mechanism: UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.
• Application hosting provider (United States): Runs the website and the application and delivers them to your browser. Data: Request and session data. Transfer mechanism: UK-US data bridge (listed under the UK Extension to the EU-U.S. Data Privacy Framework).
• Network, security and rate-limiting providers (Global network, United States): Network protection, encryption in transit, bot protection, rate limiting, short-lived caching and fetching public tender pages. Data: IP addresses, request identifiers and browser signals; public tender pages. Transfer mechanism: UK-US data bridge (listed under the UK Extension to the EU-U.S. Data Privacy Framework).
• AI model providers (United States): The models that draft and check bid content, answer the in-app help assistant, and suggest which profile field a portal form field the Chrome extension could not place takes. Data: Tender text, the company information used in a proposal, messages you send the help assistant, and the labels of portal form fields (never the values you enter). Transfer mechanism: UK-US data bridge for a provider listed under the UK Extension to the EU-U.S. Data Privacy Framework, otherwise the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.
• Payment processor (Stripe) (United States): Takes payments; AutoTender never sees or stores full card numbers. Data: Billing details. Transfer mechanism: UK-US data bridge (listed under the UK Extension to the EU-U.S. Data Privacy Framework).
• Workflow automation hosting provider (United States): Runs the background jobs behind bid generation, digests, alerts and tender discovery. Data: Tender text and company information passed through a job; user IDs and email content; run history kept for 7 days. Transfer mechanism: UK-US data bridge (listed under the UK Extension to the EU-U.S. Data Privacy Framework).
• Email delivery providers (United States): Sends account and notification emails, and outreach emails to prospective customers. Data: Email addresses and message content; prospect business contact details. Transfer mechanism: UK-US data bridge for a provider listed under the UK Extension to the EU-U.S. Data Privacy Framework, otherwise the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.
• Error monitoring provider (United States): Tells us when something breaks. Data: Error and performance data with your user ID (no IP addresses or email addresses); session replays with all text masked, only if you accept analytics cookies. Transfer mechanism: UK-US data bridge (listed under the UK Extension to the EU-U.S. Data Privacy Framework).
• Cloud browser provider (United States): Checks procurement portals are reachable and reads public tender listings; it never signs in to a portal with your login. Data: Public procurement portal pages; no customer personal data. Transfer mechanism: UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.

All data is encrypted in transit (TLS) and at rest (AES-256). Row Level Security (RLS) policies on all database tables ensure users can only access their own data. Rate limiting is enforced on all API endpoints. HMAC-SHA256 signature verification is used for webhook authentication. Content Security Policy, HSTS, and additional security headers are set on all responses. Passwords are hashed using bcrypt via our authentication provider. Sessions use SameSite=Lax cookies that the page's own scripts can read (they are not httpOnly, because the sign-in library needs that), and the site is served only over HTTPS (HSTS). See our Security page for full technical details.

Account data, and the bids, proposals, outcomes and documents in your account, are kept for as long as your account exists, so that you can return to earlier bids and AutoTender can learn from your outcomes. Records of each AI agent run on a bid are deleted about 12 months after the run. Usage analytics data is retained for 12 months and then automatically deleted or anonymised. Payment records are retained for 7 years as required by tax and accounting regulations. Email delivery records (which message we sent to which address) are retained for 12 months, and satisfaction survey (NPS) responses for 24 months, then deleted automatically; both are also deleted when you delete your account. Chrome extension diagnostic records (which form fields the extension could and could not match on a portal page, with the extension version) are retained for 90 days, then deleted automatically, and are deleted when you delete your account. Server logs containing IP addresses and request metadata are retained for 30 days. The bid record (each extension fill record, when and by whom an opportunity was chosen or skipped, and which opportunities Auto-bid compared) is kept with its bid and deleted with it. Answers you gave AutoTender for drafted answers are kept until you delete them in your profile or delete your account. Enterprise enquiries (section 17) are kept for 24 months from the day they were sent, then deleted automatically, and an enquiry sent while signed in is deleted when you delete your account. Enterprise requests (section 17) are not stored in AutoTender; the emails are kept as section 17 says. When you delete your account in Settings, your profile, bids, proposals, outcomes, stored files and login are deleted at once and cannot be recovered, so download your data first (Settings, Download Your Data). Copies in our database provider's backups are purged within 90 days, and anonymised aggregate data (for example win rates by sector, not attributable to any individual) may be retained indefinitely.

Depending on your jurisdiction, you have the following rights regarding your personal data: Access (request a copy of all personal data we hold about you); Rectification (correct inaccurate or incomplete data via your profile or by contacting us); Erasure (request deletion of your account and associated data, subject to legal retention requirements); Data portability (export your data in machine-readable JSON format via the Download Your Data feature in Settings; the file contains your records and proposal text, lists what it leaves out, and your uploaded and generated files can be downloaded from Documents); Restriction (request that we limit processing of your data in certain circumstances); Objection (object to processing based on legitimate interest); Withdraw consent (withdraw consent for optional processing such as analytics cookies, without affecting the lawfulness of prior processing); and Automated decision-making (request human review of any decision made solely by automated means that significantly affects you). To exercise any of these rights, contact privacy@autotender.ai. We will respond within one month of receiving your request. Where a request is complex or you have sent several, the law lets us extend this by up to two further months; if we need to, we will tell you why within the first month. You also have the right to lodge a complaint with your local data protection supervisory authority. You can also complain to us about how we handle your personal data: see data protection complaints. We acknowledge every complaint within 30 days of receiving it (Data Protection Act 2018, section 164A). You also have the right to complain to the Information Commission (known as the ICO), the UK's data protection regulator, at ico.org.uk.

We use a small number of first-party cookies and browser storage items, listed with their purpose and lifetime in our Cookie Policy. Cookies we set without asking: our authentication provider's session cookie (named sb-, then our project reference, then -auth-token, and split into numbered parts when it is large), which keeps you signed in until you sign out; your browser keeps it for up to 400 days; it is SameSite=Lax and not httpOnly, because the sign-in library reads it from the page. A companion cookie ending in -code-verifier is set while a sign-up, a Google or Microsoft sign-in or a password reset is in progress and is removed when that step completes. at_tour_dismissed and at_nav_collapsed remember that you closed the dashboard tour and which menu groups you collapsed; each is kept for a year, can be read by the page's scripts and holds no personal data. at_ref and at_acq are set only when you open AutoTender through a referral link or a link in one of our business emails and hold the referral or email link data described in section 2; they are kept for up to 30 days, are httpOnly (the page's scripts cannot read them), are not replaced by a later link, and are deleted when you finish onboarding. Browser storage we use without asking (not cookies; local storage stays until you clear it, session storage ends when you close the tab): in local storage, autotender_cookie_consent (your cookie choice), at_push_prompt_shown_at (when we last offered notifications, so that we offer them again only after 30 days), autotender_extension_prompt_dismissed (that you hid the extension download prompt), at_referral_prompt (when we last suggested the referral programme and whether you closed it or asked not to see it again, so that we suggest it at most once every 14 days), at_onboarding_step and at_onboarding_draft, each followed by your user ID (the onboarding step you reached and a draft of what you typed during onboarding, both deleted when you finish onboarding) and at_teaming_invite (the teaming invitation you signed up through, removed once onboarding has used it); in session storage, at_user_persona (whether you signed up as an SME owner or a bid writer), at_email_confirm (that we sent your confirmation email), at_subscribe_sent followed by a plan and billing period (that we already opened secure checkout for that plan in this tab, so that pressing Back does not open it again) and at_bids_list_query (the filters of your proposals list). If you turn on push notifications, our service worker also keeps copies of the homepage, the offline page and files such as images and fonts in your browser's cache storage so that pages load faster; it never keeps signed-in pages or your data, and signing out deletes them. Optional analytics: our hosting provider's privacy-friendly analytics and performance insights, our error monitoring provider's performance tracing (the timings of a sample of page loads and page changes), and its session replay (a recording of the pages you view, with all text masked, kept to diagnose errors; it keeps an identifier called sentryReplaySession in session storage) run only after you accept analytics in our consent banner. Rejecting analytics, or withdrawing consent later, stops the replay and removes its session identifier from your browser. Error reports are sent whether or not you consent, contain your user ID but not your email address or IP address, and have any email address removed before sending. No third-party advertising, remarketing, or social media tracking cookies are used. We do not use Google Analytics, Facebook Pixel, or any equivalent tracking service. If you clear browser data, the consent banner will reappear. You can change your consent at any time with Cookie preferences in the site footer or on our Cookie Policy page, or by clearing your browser data for autotender.ai.

The AutoTender Chrome Extension operates under a strict privacy model: it communicates only with AutoTender's API endpoints (no third-party requests); it does not track browsing history or activity on non-portal pages; authentication tokens are stored in chrome.storage.session (cleared when the browser closes); refresh tokens are stored in chrome.storage.local on your device, where Chrome does not encrypt them, and where only the extension's own pages and background worker can read them (web page scripts cannot); signing out removes them; fonts are bundled locally (no Google Fonts CDN calls); and the extension only activates on recognised government procurement portal domains. When you confirm a submission on a portal, the extension shares the structure of that portal's form with AutoTender, the CSS selectors and field types it filled, and which control accepted your document, so that AutoTender can complete future submissions on that portal more reliably for all users. It never shares the values you entered, the documents you uploaded, your prices, or your credentials. Fields you fill in by hand on a confirmed submission are learned the same way, as structure only. Four more things are sent, none of them a value you typed into a portal form: when the extension cannot place a field, it sends that field's label, section, kind, name attribute, placeholder, option texts and whether it is required to AutoTender, which asks an AI model provider (see section 7) which of your profile fields it takes, and keeps the answer for anyone who opens the same form; when you change a field the extension filled, it sends the field's label and section and which of your profile fields were involved, counted once per account and used for other customers only after several accounts agree (and, for an amount or an identifier, after a person at AutoTender approves it); when you click Capture this form, it sends the form's labels, field kinds, options and headings, with email addresses and long numbers removed, so that AutoTender can test the extension on that form; and when a written question on a portal form has no answer of its own in your bid or your answer bank, it sends the question's text (with your own earlier answer to a similar question, where you have one), which AutoTender gives to an AI model provider with your proposal for that bid, your company profile and bid form details, and the answers you gave AutoTender, to draft an answer. The extension fills the draft into the form and lists it as drafted by AutoTender for you to read before you submit; AutoTender does not keep the draft, except that an answer you submit enters your answer bank so the next form asking the same question gets it. When a draft needs a fact AutoTender does not have, the extension asks you once and saves your answer to your profile (Profile, Answers you gave AutoTender), where you can change or delete it. When you click Capture eBuy RFQ on a GSA eBuy page, the extension sends the requests for quote that page lists (request number, title, buyer, SIN, closing date as shown, description and the request's eBuy link) to AutoTender, which adds them as tenders that only your account can see. After each fill, the extension sends AutoTender a record of what it did, kept on the bid's record page: the label of each field, its kind, where its answer came from and whether it was filled, held for you or left for you, and why the fill stopped. That record never contains a value typed into the form. The extension also reports, for a recognised portal page where most expected fields are missing and for a sample of other portal pages, the portal, its host name and which of the fields it expected it found (no values), with your account, so that AutoTender notices when a portal changes; you see your own reports on the Extension health page. On a portal site it does not cover by default, the extension first asks for your permission for that site through Chrome; you can withdraw it at any time in Chrome's extension settings. The extension can fill a portal's form and step through its pages for you; you always click the final Submit button yourself, and the extension never clicks it. If a page turn the extension made is ever followed by a submission confirmation, it tells AutoTender which portal and the label of the control it clicked (not a value), with your account, so that page turns stop on that portal for every user until we have checked it. The declarations you answer in your profile are about your organisation only (for example whether the organisation has been convicted of an offence or is insolvent); AutoTender keeps no answers about individual people, and the extension uses them only to answer the matching questions on portal forms you fill.

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a person under 18, we will delete that data promptly. If you believe a minor has provided us with personal data, please contact privacy@autotender.ai.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will: notify the relevant supervisory authority within 72 hours of becoming aware of the breach (as required by GDPR Article 33); notify affected users without undue delay if the breach is likely to result in a high risk to their rights and freedoms (as required by GDPR Article 34); and provide details of the breach, its likely consequences, and the measures taken or proposed to address it.

We will notify you of material changes to this Privacy Policy via email and/or in-app notification at least 14 days before they take effect. Non-material changes (e.g., clarifications, formatting) may be made without notice. The "last updated" date at the top of this page reflects the most recent revision. Your continued use of the Service after the effective date of any changes constitutes your acceptance of the revised policy.

Enterprise and regulated buyers can request our Data Processing Agreement (DPA) for review during procurement evaluation. The DPA covers data processing scope, sub-processor disclosures, GDPR obligations, breach notification procedures, audit rights, and data retention terms. Download our DPA template or contact legal@autotender.ai for a signed copy.

We also process limited personal data about people who are not AutoTender users. Prospective customers: we use business contact details that are publicly available: the US government's SAM.gov entity registrations (company name, registered details, point of contact and, where the register shows it, the point of contact's business email address); for companies in the United Kingdom, public contract award notices (Find a Tender and Contracts Finder) and the Companies House register; and contact details a business publishes on its own website, where we read the home page and its contact page (or, when the home page links to none, the usual contact page addresses) and respect its robots.txt file. We use these details to judge which open tenders fit the company, with our AI model providers (section 7), and to send a few business emails about them through our outreach email provider (in the email delivery providers category in section 7), which may first check that the address can receive email. Each email names us, says where we found the address and offers an easy way to opt out: a reply, or the unsubscribe link. We email companies in the United States and the United Kingdom only. In the United Kingdom we email only organisations that the law treats as corporate subscribers, which may be emailed without prior consent: organisations that are legal persons in their own right, as recorded at Companies House, such as limited companies, companies limited by guarantee, limited liability partnerships, Scottish partnerships, charitable incorporated organisations and registered societies; never sole traders or ordinary partnerships, and never at a free or internet-provider mailbox, which may be a person's own. The links in these emails use a short web address of ours that forwards to autotender.ai; when you open one, we may record that you did, and when, with that email, and a company that opened one may later receive one more email listing other open tenders in its field or telling it about a contract awarded in its field. If you reply, we read your reply, and a reply saying no or asking us to stop ends our emails to you. We rely on legitimate interests (Article 6(1)(f)): telling a company about public contracts it can bid for. You can object at any time, and the rights in section 10 apply. We delete a prospect's details, and the record of the emails we sent, 12 months after we first collected them, unless the company has become a customer; you can ask us to erase them sooner at the privacy contact address in section 18. If you opt out, we stop and keep your email address on a suppression list for as long as we send business email, so that we never write to you again. For the same period, and after the rest of a prospect's record is deleted, we keep each address we have emailed with a count of the emails sent to it, and nothing else, whether or not the address opted out, so that we do not write to anyone too often. Teaming contacts: when you look for a teaming partner, AutoTender may show you the public point of contact for a potential partner from the same registers; we hold it only to support that introduction. If a user then chooses to approach that company, or adds a company they already know and types in its contact address, we send an invitation email to that address on the user's behalf. It names the user's company, the tender, the capability sought and a link to accept or decline without an account. We keep the address, the invitation and the answer with the partnership record they create, and use the address for that partnership only: the NDA, agreement or request for documents that follows an acceptance. Where the user supplied the address, the user is the source. Every such email carries an unsubscribe link; using it adds the address to a suppression list that we check before every email we send, so no further invitations go to it. We rely on legitimate interests (Article 6(1)(f)): a business telling another business about a specific opportunity. Under Article 14 of the UK GDPR, this section is our notice to these people: the sources are the public registers and websites named above, the categories of data are as listed, and the rights in section 10 apply to them too, including the right to object at any time. Enterprise enquiries: if you ask about the Enterprise plan with the form on our website or in the app, we receive your name, work email, mobile number, company and your answers to the form's questions (team size, bids per month, timeline, market and any message), and, if you are signed in, which account and plan sent it. An enquiry you send from inside the app also includes your account's usage: your plan and billing period, how long you have been a customer, the bids used in each of the last 3 months, the extra bids bought, the client profiles in use, the team members, and your company's country and sectors. We email the enquiry to our sales mailbox through our email delivery provider (section 7) and use it to reply and arrange a call; your answers also decide the order in which we follow enquiries up. We rely on legitimate interests (Article 6(1)(f)): answering an enquiry you sent us. We keep it for 24 months from the day you sent it, then delete it; it is included in Download Your Data when you are signed in with the same email address or sent it from your account. Enterprise requests: if you are on the Enterprise plan and use Request extra bids or Request a plan change in the app, we email your request (what you chose and any note) to our sales mailbox through our email delivery provider (section 7), with your account email, name, company and plan, the bids left now and used in each of the last 3 months, the client profiles in use and the day your account was created, and we email you a copy. AutoTender itself does not store the request. We rely on contract (Article 6(1)(b)) where the Enterprise agreement is with you, and otherwise on legitimate interests (Article 6(1)(f)): managing your company's Enterprise plan with it. The emails are kept in our sales mailbox while the Enterprise agreement lasts and afterwards for as long as a claim about it could be made (in the UK, usually 6 years). A complimentary plan before sign-up: when we give a free plan to an email address that has no AutoTender account yet, we keep that address, the plan, how long it lasts and a private note until an account is set up with that address and the plan starts, or until we withdraw the offer. We use it only to apply the plan; we email you about it once it has started. We rely on legitimate interests (Article 6(1)(f)): giving the plan we offered.

Data protection enquiries: privacy@autotender.ai. General legal enquiries: legal@autotender.ai.