Privacy notice

Who is responsible

Elliptic Labs Ltd is the controller for the personal information described in this notice. We are registered in England and Wales under company number 13701095, with registered office at 2 Mendip Villas, Crabtree Lane, Dundry, Bristol, England, BS41 8LN.

For privacy questions or rights requests, email hello@tenderwise.uk.

Information we collect

• Account and contact data: name where provided, work email, sign-in information and account identifiers.
• Company data: company name, trade, address, registration and VAT numbers, logo and business contact details.
• Project content: tender documents, file names, folder paths, extracted text, findings, clarifications, scope decisions, quotes and exported packs.
• Usage and technical data: IP address, browser and device information, page and route activity, timestamps, security events, model usage and diagnostic logs.
• Transaction data: payment status, amount, currency, job reference and receipt details. Stripe handles card details; we do not receive or store full card numbers.
• Communications: messages and information you send when requesting help, exercising a right or giving feedback.

How and why we use it

Where we rely on legitimate interests, we consider the impact on your rights and use information only where those interests are not overridden by your rights and interests.

Tender documents and your role

Tender documents may contain personal or confidential information about clients, consultants, subcontractors, residents or other people. The customer decides what to upload and why. For personal data contained in customer project content, the customer will usually be the controller and Elliptic Labs Ltdacts as its processor, handling that content to provide the service and on the customer's instructions.

Customers must ensure they have authority and a lawful basis to upload that information and should avoid including unnecessary personal data. Contact us if your organisation requires a data processing agreement.

AI and product improvement

TenderWise sends relevant document content and instructions to specialist AI service providers to produce the analysis and outputs you request. These results are assistive: users review, edit and approve them. We do not use TenderWise to make decisions about people that produce legal or similarly significant effects.

We do not use original uploaded files to train or refine TenderWise. We may use de-identified extracted findings, questions, scope classifications and quality feedback to test, evaluate and improve our own workflows. We do not include original tender files in that improvement dataset or use it to train a third party's general-purpose model.

We take reasonable steps to remove direct identifiers and reduce re-identification risk. De-identified information may still be personal data where a person could reasonably be identified, so we continue to protect it accordingly. Where this processing relies on our legitimate interests, you may object by contacting us. We will consider your request in light of your circumstances and our legal obligations.

Who receives information

We use suppliers including:

• Supabase for authentication, databases and document storage;
• Anthropic and other configured AI API providers for requested document and quote processing;
• Stripe for payments, receipts and fraud prevention;
• Vercel for hosting, delivery, operational logs and cookieless Web Analytics; and
• professional advisers, regulators, law enforcement or a buyer of our business where disclosure is lawfully required.

Suppliers may process information outside the UK. Where required, we use recognised safeguards such as adequacy regulations or approved contractual protections for international transfers.

How long we keep information

We keep account, company and project information while the account is active and for as long as reasonably needed to provide the service, resolve disputes and meet legal obligations. Deleted material may remain temporarily in backups and security logs before being overwritten under normal retention cycles.

Payment and accounting records are retained for the periods required by tax and company law. Security, signup and diagnostic logs are kept only for as long as reasonably necessary for fraud prevention, security and troubleshooting. You may ask us to close your account or delete eligible personal data by contacting us.

Cookies and analytics

TenderWise uses strictly necessary authentication and security storage to keep users signed in and protect the service. Vercel Web Analytics provides aggregated website-use information without using cookies. We do not use advertising cookies or sell personal information.

Security

We use access controls, private document storage, encryption in transit, account-level separation and usage monitoring designed to protect information. No online service is completely secure, so users should also protect their accounts and avoid uploading information that is not needed for the tender workflow.

Your rights

Depending on the circumstances, UK data protection law may give you rights to access, correct, erase or restrict personal data, object to processing, receive portable data, or withdraw consent where processing relies on consent. These rights are not absolute.

Email hello@tenderwise.uk to exercise a right. We may need to verify your identity. If your request concerns information uploaded by one of our customers, we may direct you to that customer as the relevant controller.

Complaints

Please contact us first so we can try to resolve your concern. You may also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint.

Changes and contact

We may update this notice when our service, suppliers or legal obligations change. We will post the current version here and provide additional notice where a change is material.