Privacy notice

1. Controller

[Company name, address, email] — see Imprint.

2. Data we process

• Account data: email address, password hash, sign-in method (email or Google), login timestamps.
• Company profile data you enter (services, certifications, revenue, references).
• Tenders you save or import, uploaded tender PDFs, analyses, saved items.
• Technical logs needed to run and secure the service.

3. Purposes and legal bases

Providing the service you signed up for (Art. 6(1)(b) GDPR); security and abuse prevention (Art. 6(1)(f)); legal obligations such as tax records once paid plans start (Art. 6(1)(c)).

4. Processors and recipients

• Lovable (hosting, database, authentication, file storage) — [confirm hosting region and DPA].
• AI analysis of uploaded PDFs via Lovable AI; the selected model endpoint is configured without data retention for training — [confirm sub-processors and transfer safeguards].
• Google, only if you choose "Continue with Google".
• Public tender data is fetched from TED (European Union); no personal data is sent to TED.
• [Payment provider, once paid plans start.]

5. International transfers

[Describe any transfers outside the EU/EEA and safeguards (e.g. EU Standard Contractual Clauses).]

6. Retention

Data is kept while your account exists. You can delete documents and tenders at any time, and delete your whole account in your company profile; this permanently removes your data [within X days from backups].

7. Your rights

Access, rectification, erasure, restriction, portability, objection, and complaint to a supervisory authority (e.g. your state data protection authority). Contact: [privacy email].

8. Cookies and local storage

We only use storage strictly necessary to keep you signed in. No tracking or advertising cookies.