Privacy

1. Who is responsible for your data

TenderAnalyser is a trading name of Icebreaker Agency LLC, a Wyoming (USA) limited liability company, whose registered address is 30 North Gould Street, Ste R, Sheridan, WY 82801, United States. Icebreaker Agency LLC is the controller for the personal data described here. For anything in this policy, including a request to exercise your rights, write to hello@tenderanalyser.com.

We work with companies in the United Kingdom, and handle the personal data described here in line with the UK General Data Protection Regulation and the Data Protection Act 2018. Where we process data about people in the European Union, the EU General Data Protection Regulation also applies.

2. This website sets no cookies and runs no analytics

The public site you are reading now does not set cookies, does not embed analytics or advertising scripts, and does not build a profile of visitors. There is no cookie banner because there is nothing to consent to. Our hosting provider processes the usual server request data, including your IP address, to deliver pages and absorb attacks.

3. The call request form

If you ask for a call, we collect what you type into the form: your name, work email, company name and primary trade or services, and optionally anything else you choose to add. The form also carries a hidden field that only automated bots fill in, which we use to discard spam.

We use these details for one purpose: to contact you, prepare for the call and follow up about it. We do not add you to a newsletter, we do not sell or rent your details, and we do not use them for advertising. The lawful basis is your request, being steps taken at your request before entering into a contract, and our legitimate interest in responding to business enquiries.

The submission is recorded in our database and also reaches us as an email notification that lands in our own mailbox. We send you a single confirmation email so you know it arrived. That is a one-off reply, not a subscription.

4. The dashboard

When we work with a company, we use a separate application to find and assess opportunities and prepare bids, and clients with an account can review that work in it. It processes the following, most of which is company information rather than personal data, though names and contact details of individuals appear inside it:

• Account and sign-in data: your email address, a hashed password, and a session cookie. We log failed sign-in attempts to rate-limit password guessing.
• Your company profile: experience, accreditations, certifications, project history, capacity and similar material you give us so that opportunities can be judged against your actual position.
• Public tender records and documents, retrieved from public procurement portals. These are public records; any personal data in them originates from the contracting authority, not from us.
• Bid material: the tender responses and supporting documents we prepare with you, and the approvals you give before anything is submitted.
• Your activity in the app, such as the decisions and feedback you record against a tender, and technical logs needed to operate and debug the service.

The only cookie the dashboard sets is the session cookie that keeps you signed in. It is strictly necessary for the service to function and is not used for tracking.

5. People we contact for outreach

When we carry out business development for a client, we contact people at main contractors, framework holders and commercial buyers. We process their business contact details, such as name, job title, work email address and company, and a record of our contact with them, so that we can start a conversation and introduce our client where they agree to it. We rely on our legitimate interest in business-to-business communication. Anyone we contact can ask us to stop, and we will not contact them again.

6. Automated analysis and what it does not decide

Our software reads tender documentation with large language models and produces suitability scores, flags for requirements that could rule a bid out, and a suggested bid, watch or pass position with links back to the source document. These outputs support our work and yours. They do not produce a legal or similarly significant decision about any individual, and a person at your company always makes the actual bid decision. You can ask us how a given conclusion was reached, and the interface links each conclusion to the passage it came from.

7. Who else processes it

We keep the list of processors short and use each one only for the purpose named. They act on our instructions and are not permitted to use your data for their own purposes.

Vercel

Hosts this public website and delivers its pages.

Railway

Runs the application we use to find, assess and prepare opportunities.

Supabase

Hosts the PostgreSQL database, in the EU (Ireland), that stores client data and call requests.

Anthropic, and OpenRouter where it is used as the routing layer

Runs the language-model analysis of tender documentation. Content sent for analysis is not used to train their models.

Brevo

Delivers the notification and confirmation emails generated by the call request form.

Notion

Where a client enables it, holds a shared workspace that the application synchronises with.

Public procurement portals

The government and public-sector sources we read tender records and documents from. We do not submit bids for you; submissions are made by you or under your authority.

We disclose data beyond this list only where the law requires it, or to professional advisers under a duty of confidence.

8. Where your data goes

We are established in the United States and the providers above are mainly in the European Union and the United States, so operating the service involves international transfers of personal data. We rely on the transfer safeguards the law provides, including standard contractual clauses with providers in countries that have not been recognised as offering an adequate level of protection. You can ask us for details of the safeguards that apply to a specific provider.

9. How long we keep it

• Call requests and the surrounding correspondence: up to 24 months from our last exchange, so that we can pick the conversation back up. Ask us and we will delete them sooner.
• Client account and tender data: for as long as the engagement runs. After it ends we delete or irreversibly anonymise it within 60 days, except where we must keep records to meet an accounting or other legal obligation.
• Technical and security logs: around 30 days, other than records we must retain longer to investigate an incident.

10. Your rights

Under data protection law you can ask us to give you a copy of the personal data we hold about you, correct it if it is wrong, delete it, restrict or object to how we use it, and hand it over in a portable format. Where we rely on your consent, you can withdraw it at any time without affecting what we did before you withdrew it.

Write to hello@tenderanalyser.com and we will respond within one month. There is no charge. If you are unhappy with how we handle it, you can complain to the Information Commissioner’s Office, the UK supervisory authority, at ico.org.uk, or to the supervisory authority where you live or work.

11. Keeping it safe

Traffic to the site and the dashboard is encrypted in transit. Passwords are stored hashed, never in readable form. Access to customer data is limited to the people who need it to run the service. If a breach occurs that is likely to put your rights at risk, we will notify the relevant supervisory authority and, where the law requires it, you.

12. Children

This is a service sold to businesses. It is not directed at children and we do not knowingly collect their data.

13. Changes

If we change this policy we will update the date at the top of this page. Where a change materially affects how we use data you have already given us, we will tell customers directly rather than relying on you noticing.