Privacy Policy

We collect only the data needed to provide the service:

• Account data: email address and, optionally, your name — collected at signup and login.
• Assessment data: company name, company website URL, business description, sector selections, and operating countries — entered during the free assessment wizard.
• Assessment results: AI-generated company profile, readiness scores, matched tenders, and capability extractions — stored against your account.
• Tender feedback: your saved, not-relevant, in-progress, or applied status on individual tenders.
• Tender and vault documents: solicitation files, corrigenda, Q&A, proposal evidence, PDFs, Word documents, spreadsheets, and images you choose to upload (up to 50 MB per file on supported upload surfaces).
• Service-order content: tender requirements, intake answers, drafts, reviews, generated deliverables, revision notes, and submission progress associated with a service you request.
• Billing data: subscription and payment records. Payments are processed by card through Stripe; card details are handled entirely by Stripe and are never stored on TenderPath servers.
• Authentication tokens: short-lived magic-link tokens (expire after 30 minutes) and a session token stored in an httpOnly cookie (tp_session).
• Server logs: standard web server logs including IP addresses and request metadata, retained for operational and security purposes.

We do not collect payment card numbers. TenderPath does not ask for government ID or special-category personal data during signup; do not upload such material unless it is genuinely required for the procurement workflow and you are authorized to provide it.

• Delivering the assessment, matched tender feed, and readiness analysis.
• Sending transactional emails (magic-link sign-in, assessment reports, weekly tender digests).
• Processing payments and managing subscriptions.
• Storing your vault documents for retrieval during your active account period.
• Extracting and analysing documents, generating requested tender deliverables, and checking them against solicitation requirements.
• Operating and quality-controlling tender matching using business-profile and opportunity metadata, including staff curation where needed.
• Providing human fulfillment or troubleshooting for uploaded files, drafts, and other service-order content only when you grant temporary access to the relevant order.
• Improving crawler coverage and matching quality in aggregate (non-identifiable).
• Responding to your support requests.

We do not sell your personal data or use it for advertising.

We use the following sub-processors. Each operates under its own privacy policy:

We retain your data for the following periods:

• Account data (email, name): retained while your account is active and deleted within 90 days of account closure.
• Assessment data (company profile, readiness scores, matched tenders): retained for 12 months from your last login or last meaningful platform activity, or earlier on request.
• Vault documents: available for 30 days after account closure for export or recovery, then permanently deleted.
• Billing records: retained for 7 years as required by applicable financial regulations.
• Server and access logs: retained for 90 days in searchable form; security-relevant logs may be retained for up to 12 months for incident investigation purposes.
• Magic-link tokens: expire 30 minutes after issue.

You may request earlier deletion of your data at any time by emailing info@tenderpath.me, subject to any legal retention obligations.

TenderPath is operated in Egypt and processes data in accordance with the Egyptian Personal Data Protection Law (Law No. 151 of 2020). Under that law and other applicable regulations, you may have the right to:

• Access a copy of the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of your data (subject to legal retention obligations).
• Object to certain types of processing.
• Request a copy of your data in a portable format.

To exercise any of these rights, email info@tenderpath.me. We will respond within 30 days.

We use a single strictly-necessary authentication cookie (tp_session) to keep you signed in. No marketing or analytics cookies are set. See our Cookie Policy for details.

Authentication tokens are short-lived. The session cookie is httpOnly and scoped to TenderPath's domain. New customer documents and generated artifacts are stored in private object storage and delivered through owner-authenticated TenderPath routes. Staff-facing queues expose operational metadata by default; content access for human fulfillment or support requires a customer-controlled, time-limited grant for the relevant work order and is recorded in an access log. We do not store payment card data. This is an access-control model, not zero-knowledge encryption: TenderPath systems and the processors named above must handle content when you request analysis or generation.

TenderPath is intended for business use by adults. We do not knowingly collect data from anyone under 18.

We may update this policy as the product evolves. If changes are material, we will notify registered users by email before they take effect. Continued use of the service after that date constitutes acceptance of the updated policy.

For privacy-related questions or data requests: info@tenderpath.me
Tenderpath Limited, 49 Street 105 Hadayek El Maadi, Maadi, Cairo, Egypt 10543