This policy explains what personal data TenderWorthy collects and why, in line with Article 13 of the UK GDPR. It is written to match what the service actually does. If something here does not match your experience, tell us.
Summary
| What | Why | Lawful basis | How long | Who it goes to |
|---|---|---|---|---|
| Sign-up: email address, sector or CPV codes, postcode, travel radius, marketing preference, sign-up source | Run your account and send your alerts | Contract | While you are subscribed and for 12 months after you cancel, then deleted (free accounts that never paid: 12 months after sign-up or last sign-in, whichever is later) | Supabase, Resend |
| Business profile, given when you start Pro or added in your dashboard: website, capability statement, insurance levels, certifications, turnover, company name | Compare public tenders with your business | Contract | While you are subscribed and for 12 months after you cancel, then deleted | Supabase, Anthropic (AI checking) |
| Billing: handled by Stripe | Take payment and keep records | Contract; legal obligation for accounting records | 6 years from the end of the accounting period they relate to, as HMRC’s corporation tax record-keeping rule requires (Finance Act 1998, Schedule 18, paragraph 21) | Stripe |
| Email delivery | Send alerts and service emails | Contract; legitimate interests | While you are subscribed and for 12 months after you cancel, then deleted (free accounts that never paid: 12 months after sign-up or last sign-in, whichever is later) | Resend |
| Site visits and button clicks | Understand which pages are used | Legitimate interests | Aggregate only | Plausible |
| Where you came from: the page you landed on, the referring website, campaign tags and the date, saved with your profile if you sign up | Count where sign-ups come from | Legitimate interests | While you are subscribed and for 12 months after you cancel, then deleted | Supabase |
Who we are
The controller is Marble Cage Limited, a company registered in England and Wales (company number 17529115), registered office 82, Suite A James Carter Road, Mildenhall, United Kingdom, IP28 7DE. We have not appointed a data protection officer, as we are not required to. Contact hello@tenderworthy.co.uk with any privacy question.
What we collect
- Sign-up. When you sign up, we collect your email address, your sector or the CPV codes (categories of work) you want, your postcode, how far you will travel, your marketing preference, and where you signed up from (the sign-up source).
- Business profile. The details you give when you start Pro or add later in your dashboard, so that we can compare tenders with your business: your company name and a statement of what you do (both required for Pro) and, optionally, your insurance levels, certifications, turnover and website.
- Billing. Payments are handled by Stripe. We do not store your card number. We hold your Stripe customer and subscription reference.
- Email delivery. Whether an email was sent and whether it bounced. We do not use open or click tracking in our emails.
- Site analytics. We use Plausible Analytics to count visits. Plausible states that it sets no cookies and stores nothing on your device. Its servers process your IP address and browser details to produce anonymous statistics. Our lawful basis is legitimate interests. See the cookie policy. Plausible is hosted in Germany.
- Where you came from. When you first visit, your browser stores the page you landed on (without any query string other than campaign tags), the referring website, campaign tags and the date. We use this only to count where sign-ups come from. Our lawful basis is legitimate interests. You can turn this off with the opt-out on our cookie policy page, which stops us storing it and deletes the copy in your browser. To delete the copy saved with your profile, email hello@tenderworthy.co.uk.
We collect this from you when you sign up or edit your profile, except for where you came from, which your browser saves automatically on your first visit. We do not buy personal data.
Your email address and, on Pro, your business profile are a contractual requirement: we need them to provide the service, and without them we cannot provide it. They are not a statutory requirement. Your marketing preference is optional.
Why we use it and our lawful basis
- Contract: to set up your account, compare tenders with your profile and email you the results, and take payment (UK GDPR Article 6(1)(b)).
- Legitimate interests: service emails about your account, keeping the service secure and preventing fraud, and aggregate analytics (Article 6(1)(f)).
- Marketing emails: we only send marketing emails if you tick the optional box at sign-up or later in your dashboard. Every marketing email has an unsubscribe link. These come from hello@news.tenderworthy.co.uk; your tender alerts and account emails come from alerts@tenderworthy.co.uk.
- Free weekly list: If you sign up for the free weekly list, we send it because you asked for it. It is part of the free service, not marketing. You can unsubscribe from any list email.
- Legal obligation: keeping accounting records (Article 6(1)(c)).
How matching uses your profile
We use your business profile to choose which public tender notices appear in your digest. Fixed rules apply your insurance, certification, distance and minimum turnover criteria. An AI model provided by Anthropic then scores how closely each notice’s work matches your business. The result decides which notices appear in your digest. This does not have a legal or similarly significant effect on you: you can still search Find a Tender and Contracts Finder directly. Results can be wrong, so always check the source notice. To query a match, email hello@tenderworthy.co.uk. We use Anthropic’s commercial API, and its commercial terms (section B, effective 17 June 2025) state that “Anthropic may not train models on Customer Content from Services”. We send Anthropic the profile fields used for matching: company name, capability statement, base postcode, travel radius, insurance levels, certifications and turnover. We do not send your email address.
Who we share it with
We share personal data with the providers below. The table shows what each does, its role and where data is held or transferred to.
| Provider | Purpose | Role | Location / transfer mechanism |
|---|---|---|---|
| Supabase | Database | Processor | London, UK |
| Anthropic | Match scoring | Processor | US: UK Addendum to the EU SCCs in Anthropic’s DPA |
| Resend | Email delivery | Processor | US: UK Extension to the EU-US Data Privacy Framework (DPF UK Extension) |
| Netlify | Website hosting and sign-up/dashboard functions | Processor | US: SCCs with UK Addendum in Netlify’s DPA |
| Stripe | Payments | Processor for payments; independent controller for fraud prevention and legal compliance | US: DPF UK Extension, UK Addendum in Stripe’s DPA as backup |
| Cloudflare (Turnstile) | Bot protection on sign-up. When the sign-up form is submitted, our server sends Cloudflare the check token and the visitor’s IP address | Processor; independent controller when Cloudflare uses the signals to improve Turnstile | US: DPF UK Extension, UK Addendum in Cloudflare’s DPA as backup |
| Plausible | Visit statistics | Processor | EU (Germany): UK adequacy regulations |
| GitHub | Runs the scheduled jobs that collect tenders, check them and send digests (handles subscriber data while they run) | Processor | US: DPF UK Extension / GitHub DPA |
| postcodes.io | Postcode lookup (postcode only) | Independent service; receives the postcode only, from our server | UK company |
Stripe processes payments for us. For card payments it acts on our behalf. It also uses your details for its own purposes, such as preventing fraud and meeting its legal duties, and for those it is responsible as a controller under its own privacy policy: https://stripe.com/gb/privacy. Stripe receives your email address, plan and subscriber reference from us, and your card details directly from you.
We do not sell your data. We may disclose it where the law requires.
How long we keep it
- We keep your account data while you are subscribed and for 12 months after you cancel, then delete it. We keep accounting records for 6 years to meet HMRC requirements.
- Tender notices are public data published by buyers. We remove buyer contact details from the notices we store, but a notice’s free-text description can still name a person. We hold this only as part of the notice, to show subscribers the opportunity, on the basis of our legitimate interests (Article 6(1)(f)). We delete stored notices 12 months after their closing date.
- If you have a free account and have not paid, we delete it 12 months after you signed up or last signed in, whichever is later. We will email you 30 days before we do.
You can ask us to delete your account sooner. We then remove your profile, except records we must keep by law. If you have paid us, after deletion we keep a minimal record (your Stripe customer reference, plan and dates). This is personal data, and we keep it so that Stripe invoices can still be tied to the account. We keep it for 6 years from the end of the accounting period it relates to, because we must keep tax and accounting records by law (UK GDPR Article 6(1)(c)). If you never paid, we delete everything with your account. We also delete your dashboard sign-in account. Stripe keeps its own payment records. Our database backups (a nightly encrypted backup) are kept for 30 days, so deleted data can remain in them until they expire. If we ever restore a backup, we delete again any data that was deleted after that backup was taken, in the same way as the original deletion. To do this, we keep the internal ID of each deleted account and the date it was deleted, and nothing else. We delete that record 31 days after the deletion, once every backup that could contain the account has expired. Our lawful basis is our legitimate interests in making sure deletions, including erasure requests, stay in effect (UK GDPR Article 6(1)(f)). Resend keeps its own delivery logs under its own retention.
Your rights
You have the right to ask for a copy of your data, to have it corrected or erased, to restrict or object to how we use it, to receive it in a portable form, and to withdraw consent where we rely on it. See Articles 15 to 21 of the UK GDPR. Email hello@tenderworthy.co.uk and we will reply within one month.
Complaints
If you have a complaint about how we use your data, email hello@tenderworthy.co.uk. We will acknowledge it within 30 days and respond without undue delay. If you are not satisfied, you can complain to the Information Commissioner’s Office (ico.org.uk).
Unsubscribing
Every alert, list and marketing email has an unsubscribe link. Opening the link shows a confirmation page; confirming stops that kind of email. You can turn alerts off or cancel Pro from the dashboard. To close your account, email us.
Changes to this policy
We will change the date at the top when this policy changes, and tell account holders about material changes by email. See also the terms of service, the cookie policy and contact us. More about us: about TenderWorthy.