Privacy notice

Information you give us

• Account details: your name, email address and sign-in details when you create an account, and the name of your workspace (usually your company).
• Company profile: what your business does, where it works, its size, the kinds of contract it wants and similar details you enter in settings.
• Your work in OpenTend: saved tenders and searches, your pipeline and no-bid decisions, notes, questions you ask the AI assistant, your answer library and documents you upload or link.
• Contacts you record: names, job titles, email addresses and phone numbers of people at buyers or partners that you choose to store, and the outreach log you keep against them.
• Cohorts and partner finder: messages, claimed work areas, confirmations and documents you add to a cohort, and any partner listing you publish on a tender.
• Billing details: the billing name, address, email and VAT number you give at checkout. Card details are entered directly with Stripe and never reach our servers.
• Messages to us: anything you send when you email us for support or sales.

Information we collect automatically

• Technical and security data: IP address, browser type, device information, sign-in times and server logs, used to keep the service secure and working.
• Usage records: for example how much of its monthly AI allowance your workspace has used, so we can apply plan limits.

We do not use analytics, advertising or tracking cookies. Our cookie notice lists the few cookies we do use.

Public tender data

The tenders in OpenTend come from Find a Tender, Contracts Finder, Public Contracts Scotland and Sell2Wales, published under the Open Government Licence. Notices can include the name, email address or phone number of a contact at the buying organisation. That information is published by the buyer for the purpose of the procurement, and we show it as it appears in the notice.

We only use personal data where the law allows it. The lawful bases we rely on are:

Contract

To create and run your account and workspace, provide the features of your plan, process payments and give you support.

Legitimate interests

To keep the service secure and prevent abuse, fix problems, improve the product, store the business contacts you choose to record, show public tender data, and run cohorts and the partner finder. We balance these interests against your rights and do not use your data in ways you would not reasonably expect.

Legal obligation

To keep tax and accounting records and to respond to lawful requests from authorities.

Consent

Only where we ask for it. We do not currently rely on consent for anything, and we will ask before we do.

OpenTend is a business service. Your workspace is the customer, and much of the data in it is about the people who work there or the businesses you deal with. We do not sell personal data, and we do not send marketing email to the contacts you store.

On paid plans, OpenTend uses large language models from Anthropic (Claude) to summarise tenders, assess how well a tender fits your business, answer your questions about a tender, draft emails and suggest matches for your alerts.

To do this we send Anthropic the relevant tender text together with the information the feature needs, which can include your workspace’s company profile, the question you asked and, for email drafts, the names of the contacts involved. We send only what the task needs.

Anthropic processes this data on our behalf. Under Anthropic’s commercial terms, data sent through its API is not used to train its models by default. AI output is generated automatically and can be wrong. It does not make decisions about you that have legal or similarly significant effects.

Your workspace

Everyone who is a member of your workspace can see the data in it, including saved tenders, pipeline, contacts, the answer library and documents. Workspace admins can invite and remove members.

Cohorts

A cohort lets several firms prepare a bid together. When you start a cohort and invite a partner, or accept an invitation to one, the other firms in that cohort can see your name, your company name, the work areas you claim, your confirmations, your messages and the documents you add to the cohort. They cannot see anything else in your workspace.

Partner finder

On a tender, your workspace can choose to show that it is open to partnering. Other workspaces on the Team plan looking at that tender can then see your listing: your company name (or an anonymous description, if you choose), the contact name you set, your location, size band, the work you cover, a short description and the checks you have confirmed. Your contact email is not shown to them. You can hide your listing at any time.

Service providers and others

We share data with the service providers listed in the next section, who act on our instructions. We may also disclose data if the law requires it, to protect our rights or the safety of others, or as part of a sale or reorganisation of our business, in which case this notice would continue to apply.

We use the following companies to run OpenTend. Each processes personal data only on our instructions and under a written agreement.

Clerk

Sign-in and user accounts. Clerk stores your name, email address and sign-in details, and sends sign-in, verification and workspace invitation emails. Based in the United States.

Stripe

Payments, subscriptions and invoices. Stripe collects your card details directly. Based in the United States and Ireland.

Anthropic

AI analysis, as described in the AI features section. Based in the United States.

Cloudflare

Storage of the files you upload (Cloudflare R2).

Railway

Application hosting and our PostgreSQL database, in an EU region.

Some of our service providers store or access personal data outside the UK, including in the United States and the European Economic Area. Where data leaves the UK, we make sure it is protected by an adequacy decision (such as the UK Extension to the EU-US Data Privacy Framework, where the provider is certified) or by appropriate safeguards such as the UK International Data Transfer Addendum to the EU standard contractual clauses.

You can ask us for more information about the safeguards for a particular provider by emailing [email protected].

• Account and workspace data: for as long as your account or workspace exists.
• Deleted data: when you delete content, or a workspace is closed, we remove it from our live systems within a reasonable period. Copies in backups are overwritten as the backups expire.
• Cohort content: messages and documents you add to a cohort stay with that cohort, so the other firms keep access to what was shared for as long as the cohort exists.
• Billing records: invoices, payments and card details are held by Stripe, our payment provider, which keeps them for as long as its own legal and tax obligations require.
• Security logs: for a limited period, usually no longer than needed to investigate problems.

We use appropriate technical and organisational measures to protect personal data. Data is encrypted in transit, each workspace’s data is kept separate from every other workspace’s, uploaded files are stored privately and are only reachable through short-lived signed links, and access to production systems is limited.

No system is perfectly secure. If we become aware of a breach that affects your personal data, we will tell you and the ICO where the law requires it.

Under UK data protection law you have the right to:

• be told how your data is used (this notice);
• get a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted in some circumstances;
• restrict or object to our use of your data in some circumstances, including where we rely on legitimate interests;
• receive data you gave us in a portable format, where we rely on contract;
• withdraw consent at any time, where we rely on consent.

To use any of these rights, email [email protected]. We will reply within one month. If your data is held in a workspace that belongs to someone else, we may need to work with that workspace’s owner to respond.

If you are unhappy with how we have handled your data, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

OpenTend is a service for businesses and is not intended for anyone under 18. We do not knowingly collect personal data from children.

We may update this notice from time to time. The date at the top shows when it last changed. If we make a significant change, we will tell you in the app or by email before it takes effect.

For any question about this notice or your personal data, email [email protected].