Privacy policy

Tender Radar is operated by Professor AI Holdings Ltd. We are the data controller for the information you provide when using this service. Questions about this policy go to admin@theprofessor.info.

• Account information: your name and email address, used to create and manage your account and to send your digest emails.
• Links clicked in your digest: links in digest emails pass through our own server, so we record which ones are clicked and when. We use this to see which notices are useful to your organisation and to improve your matches. Sign-in and unsubscribe links are never tracked.
• Whether your digest was opened, only if you agree: if you tick “Let us see when you open your digest” on your dashboard, your copy of the digest carries a small invisible image that tells us when it was opened. Nobody else's copy is affected, and unticking it stops it from the next digest. Without your agreement, we do not record opens.
• Delivery reports: our email provider tells us whether each digest was delivered, bounced or marked as spam, so we can tell when one is not reaching you.
• Organisational profile: the keywords, CPV codes, locations and business details you provide so we can configure your radar, along with any additional recipient addresses you add.
• Billing information: payment is processed by Stripe and we never see or store card numbers. We retain billing history, meaning plan type and payment dates, to administer your subscription.
• Free weekly email: if you ask for a weekly email about a buyer, supplier or CPV code without creating an account, we hold your email address, what you asked to follow, the page you asked from, and when you last opened or clicked the email. We only send after you confirm, it stops when you unsubscribe or create an account, and we stop and remove the request if you do not engage with it for several weeks.
• Website lookups: if you paste your website address into our homepage to see your market, we keep the address, what our reading of the page suggested your procurement categories are, and the figures we showed you. That much is about an organisation rather than a person. If you then give us an email address to see which suppliers hold those contracts, we keep the address alongside the exact wording you agreed to. It is used only to contact you about that snapshot: it does not start a digest, you are not added to any mailing list, and we do not share it. Ask us and we will delete it.
• Usage data: we log when digests are sent and when links in them are clicked, to operate the service and report on your match activity.
• Buyer accounts: your work email address, your name if you give it, the organisation your account is linked to and how we confirmed that link (your email domain matched the organisation’s published notices, or we checked it ourselves). We use this to run your account. If your request needs a person to check it, we keep the request until it is approved or refused, and we delete requests that are never completed after 90 days. We also keep the searches you make in the supplier finder, with your account, to see what buyers look for and improve it. We never tell a supplier who searched or what for.
• Contacts suppliers give for buyers: the name or team and the email address a supplier gives for buyers’ market engagement. We send one confirmation email to that address, and show it only to people signed in with a buyer account. It stops being shown when the supplier removes it or its subscription ends.
• Who certified supplier details: when an admin certifies their organisation’s size or type, we record who did it and when, so the information can be attributed.

Notices are scored against your organisational profile using Anthropic's Claude models. Your profile text and the text of the public notice are sent to Anthropic for that purpose. No scoring decision has a legal or similarly significant effect on any individual: it decides the order of items in a digest, and you see every match rather than only the ones the model ranked highly.

We process your data under Article 6(1)(b) of UK GDPR, performance of a contract, for account management and service delivery, and Article 6(1)(f), legitimate interests, for service improvement and security logging. The free weekly email is sent on the basis of your consent, Article 6(1)(a), which you can withdraw at any time with the unsubscribe link in every email.

We show a supplier’s contact address to buyers at the supplier’s request, on the basis of our legitimate interest, and that of suppliers and buyers, in public sector market engagement. A supplier can remove it at any time.

We do not sell your data, and we do not share it with third parties except where needed to run the service or to comply with a legal obligation. The processors we use are:

• Stripe, payment processing and subscription billing.
• Resend, delivery of digest and account emails.
• Anthropic, the model provider used to score notices against your profile.
• Microsoft Clarity, on the public pages only: how pages are used (clicks, scrolling and recordings of single page views), without cookies. See Cookies below.
• DigitalOcean, infrastructure hosting. Your data is held on servers in the United Kingdom.

Stripe, Resend, Anthropic and Microsoft are based in the United States, so using them involves an international transfer of the data described above. Those transfers rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK extension to the EU-US Data Privacy Framework where the provider is certified under it.

We keep your account and organisational profile for as long as your account is active. After closure we retain it for up to 12 months for audit and legal compliance, then delete it. Billing records are kept for 7 years, as required for UK tax purposes.

If you use “Spotted something wrong on this page? Tell us”, we keep your page report for twelve months. If you gave an email address for a reply, we delete the address 90 days after we close the report.

We set a single cookie, tr_session, which keeps you signed in. We use no tracking, advertising or analytics cookies, and no cookies at all are set on the public pages of this site, which is why you are not asked to consent to any.

On the public pages we use Microsoft Clarity to see how they are used: where people click and scroll, and recordings of single page views. We run it without cookies, so it cannot connect one page you visit to another or recognise you on a later visit, and it hides anything typed into a form. It never runs once you are signed in to your account.

We also count, in our own records, how many people use the public pages each day. A page tells us once, the first time you scroll, tap or move the mouse, so that automated scrapers are not counted. Nothing is stored on your device, and you are filed under a code that changes every day, so we cannot follow you from one day to the next or recover your address from it.

The contract and tender information in this service, including the buyer and supplier pages, is published by the issuing bodies themselves. We collect it from Find a Tender, Contracts Finder, Public Contracts Scotland, Sell2Wales, Companies House, UK Research and Innovation, Tenders Electronic Daily (the EU journal) and SAM.gov (the United States federal system).

The UK sources are used under the Open Government Licence v3.0, and this service contains public sector information licensed under that licence. Tenders Electronic Daily and SAM.gov are published under their own terms rather than the OGL.

This material is public record about organisations. Where it happens to name an individual, for example a named contact on a notice or a company officer in the Companies House register, we publish only what the source body has already published. If you are named in that data and want it addressed, contact us and we will deal with it, though corrections to the underlying record have to be made at the source.

Public bodies put a contact on their notices for questions about their procurements: usually a team mailbox, sometimes a named officer's work address and telephone number. We keep the most recent contact each buyer has published, with the notice it came from, and show it to signed-in customers in buyer briefings and on the buyer pages inside their account, never on our public pages. We show a team mailbox in preference to a named officer wherever the buyer has published one. Our lawful basis is legitimate interests: the buyer published the contact so that suppliers could reach it about its procurements, which is the use we support. We delete a contact that has not appeared on any notice for three years. If you are named and want your details removed from Tender Radar, write to us and we will remove them within a month.

Under UK GDPR you may access the data we hold about you, ask us to correct or delete it, object to processing, and request portability. To exercise any of these, email admin@theprofessor.info. You may also complain to the Information Commissioner's Office at ico.org.uk.

Professor AI Holdings Ltd is Cyber Essentials certified. The service is served over HTTPS, passwords are stored hashed rather than in any recoverable form, and access to the production systems is restricted.

We will email you if we make a material change to this policy. The date at the top of this page shows when it was last updated.