Privacy Policy & GDPR Statement

1. Who we are, and in what capacity

Tenderloop is operated by Alto Perfis Pultrudidos Lda, registered under NIF 503609013, at Zona Industrial da Maia I, Sector I, R. de Raimundo Durães Magalhães lote 20, 4475-189 Maia (Portugal). For anything in this document you can reach us at hello@tender-loop.com.

We act in two different capacities, and the distinction decides who you should talk to:

As controller — for the account data of our customers: the business's name, tax number, contact details, the details of the people who log in, and billing records. We decide why and how that data is processed, so we answer to you directly about it.

As processor — for everything that arrives in a connected mailbox. If you emailed a business asking for a quote and that business uses Tenderloop, your email reached us because that business pointed their mailbox at us. They decide what happens to it; we act on their instructions. They are the controller. You can still send a request to us at hello@tender-loop.com and we will act on it and pass it to them, but the primary route is the business you wrote to.

2. What we hold

About our customers (controller): business name, tax number (NIF/VAT), company name and address, phone, contact email, the CRM or ERP they told us about, the email address and password hash of each user account, subscription and payment status, and usage counters.

About people who email our customers (processor): the sender's email address, their name and company name where the email states them, the subject line, the full text of the email body, and the products and quantities extracted from it. Also the quote we generated in reply — its line items, prices and totals — and the PDF we produced.

When you report a problem from inside the portal: what you wrote, and — unless you untick it — a screenshot of the page you were on, together with your email address, the address of the page, your browser's user-agent string and your account identifier. A portal screenshot can contain your own customers' names, requests and prices, which is why it is shown to you before anything is sent and can be removed. Reports are emailed to our support address; they are not stored in the product.

When you ask for a demo on our website: the email address you enter, and nothing else about you — plus the language of the page and the campaign or promo code of the link you came from, if any. It is sent as a single email to our sales mailbox and is not stored in the product. To avoid sending the same request twice, the address is also kept in the server's memory for one day; it is not written to our database.

When you follow a campaign or promo link, or sign up with one: we count the code in the link. We add one to a running total for that code when the link is opened, and one to another total when a sign-up is completed with it. These are plain totals: they are not linked to you, to your account or to your device, and no one can be identified from them. To count each visitor once a day and to limit abuse, our server uses your IP address for about a day, in its working memory only; we do not write it to our database, and it is gone when the day passes or the server restarts. Technical server logs are a separate matter, described in section 7.

We do not hold: the OAuth refresh token for a connected mailbox in our database — it lives in Azure Key Vault and the database stores only its name. We never receive or store payment card details; those go directly to Stripe.

Attachments, on some plans. During the free trial and on the Pro and Enterprise plans, the system also reads the text of PDF, Word (.docx) and Excel (.xlsx) attachments, because a price request sometimes exists only in an attached document. Other file types, including images and scanned documents, are not read; the names of the files it could not read are noted with the request. The text it extracts is kept with the request, as the email body is, and is deleted with it (section 7); the files themselves are not stored. On the Starter plan attachments are not read, and only the email body is processed.

3. Why we process it, and on what legal basis

To provide the service (Art. 6(1)(b), contract) — creating an account, connecting a mailbox, reading incoming requests, matching them against the customer's own price list, generating and sending quotes.

To bill for it (Art. 6(1)(b) and (c)) — subscription management, invoicing, and the statutory retention of accounting records.

To keep the service secure and working (Art. 6(1)(f), legitimate interests) — authentication, abuse prevention, error diagnosis (including any problem report you send us from the portal, and the technical server logs described in section 7), and usage metering against plan limits. We have balanced this against the rights of the people involved and limited it to what the service cannot run without.

To answer a demo request (Art. 6(1)(f), legitimate interests) — we use the email address you entered on our website only to contact you about the demo you asked for. We have balanced this against your rights: you started the contact, we ask for nothing else, and we do not add you to any list.

To count campaign visits and sign-ups in aggregate, and to prevent abuse (Art. 6(1)(f), legitimate interests) — we want to know which links bring people to the site and how many of them sign up, and to stop one visitor or script inflating those totals or flooding the forms. The totals identify no one, and your IP address is used only briefly, in memory. We have balanced this against your rights: we use the minimum, store nothing about you, and put nothing in your browser.

For RFQ senders' data, the legal basis is our customer's to establish, not ours — they are the controller. Ordinarily it is their legitimate interest in responding to a commercial enquiry that the sender initiated.

4. Artificial intelligence, and what is not done with your data

Producing a quote requires a language model to read the request. The subject line and body of the incoming email, together with the customer's product catalogue, are sent to Azure OpenAI Service — Microsoft's hosted deployment, running inside our own Azure resource.

Your content is not used to train any model. Under the Azure OpenAI Service terms, prompts and completions are not available to other customers, are not available to OpenAI, and are not used to train, retrain or improve any Microsoft or OpenAI model. We do not use the OpenAI public API, and we do not send this data to any other model provider.

Prices are never taken from the model. The model extracts and matches products; the price of every line is recomputed on our servers from the customer's validated price list, as quantity × their own unit price. Anything the model cannot confidently match is flagged for a human to review rather than priced automatically. A model's arithmetic never reaches a quote.

Inference runs in the European Union, in the same region as the rest of the platform.

5. Who else processes it (subprocessors)

We use the following subprocessors. We remain responsible for their processing, and we will give notice before adding a new one.

6. Where data is stored, and transfers outside the EU

The database, file storage and application servers are in the European Union. Rendering and inference happen there too.

Stripe, Google and Microsoft may process data outside the EEA as part of their own operations. Those transfers rely on the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

7. How long we keep it

The text of incoming request emails — subject, body, sender address and the sender's name and company — is deleted 24 months after the quote was created. This is automatic: a scheduled job redacts those fields and records the date it did so.

What survives that deletion is the commercial record: the quote's reference number, its line items, its totals and its status. Those are our customer's own business records and our billing evidence. The quote row also stops the same email being quoted and answered a second time, which is why it is redacted rather than deleted outright.

Account data is kept for as long as the account is open. When an account is closed, its data — database records and stored files alike — is deleted. Accounting records are retained for as long as tax law requires.

Problem reports sent from the portal are not stored in the product at all. They exist only as an email in our support mailbox, and are deleted once they are no longer needed to deal with the problem reported.

Backups are retained for 7 days and then expire.

Server logs. Our hosting provider keeps technical logs of how our servers are used and of errors. They can include IP addresses. We use them for security and troubleshooting, and they are deleted automatically after 30 days.

8. Your rights

Under the GDPR you may request access to your data, correction of it, its deletion, restriction of processing, a portable copy of it, and you may object to processing based on legitimate interests.

If you have a Tenderloop account, two of these are built into the product and you do not need to ask us: the portal will produce a complete machine-readable export of everything we hold on your business, and it will close your account and delete its data, files included.

If you emailed a business that uses Tenderloop, write to that business — they are the controller and they can erase what you wrote from within their own account. You may also write to us at hello@tender-loop.com; we will act on it and notify them.

We answer requests within one month. There is no charge.

You have the right to complain to a supervisory authority — for us, Comissão Nacional de Proteção de Dados (CNPD), Portugal — or to the authority where you live or work.

9. How it is protected

Each customer's data is isolated at the database level by PostgreSQL row-level security, enforced by a database role that cannot bypass it — not merely by application code remembering to filter.

Mailbox credentials are held in Azure Key Vault, never in the application database or in source code. Passwords are stored only as hashes. All traffic is over TLS, and storage is encrypted at rest.

Access to production data is limited to the people who need it to run the service.

10. Cookies and tracking

There are none. The site sets no advertising or analytics cookies, embeds no third-party trackers, and loads no external fonts or scripts.

Campaign and promo links carry their code in the page address only, from the link to the sign-up or demo form. We do not store it in your browser — no cookies and no local storage. The only thing we count is how many times each code was used, without identifying anyone (see section 2).

The site and the portal store up to two things in your browser's local storage: your chosen language (saved whenever you open a page in a language or switch it, so the site opens in your language next time) and, only if you sign in to the portal, your session token, so you stay signed in. Both are strictly necessary to provide a service you asked for. Neither is shared with any third party; the session token is sent only to our own API, to keep you signed in. This is why you are not shown a cookie banner — we have nothing to ask consent for.

11. Data processing agreement

Business customers who need a Data Processing Agreement under Art. 28 — which is most procurement functions — do not need to ask for one: it is published in full, takes effect automatically when you open an account, and lists our subprocessors and retention periods as binding annexes. We will countersign a copy on request at hello@tender-loop.com.

12. Changes

If we change this document in a way that materially affects how personal data is handled, we will tell account holders by email before the change takes effect. The date at the top always reflects the last substantive change.