Privacy policy

Who we are

TenderLab One is run by TenderLab Ltd, a company registered in England and Wales (company number 17184263), 128 City Road, London, EC1V 2NX. Contact: info@tenderlab.co.uk.

For your account, billing, security and our own communications with you, TenderLab Ltd is the controller. For the documents and information your organisation puts into its workspace about other people, such as staff names in evidence files, your organisation is the controller and we process that information on its behalf. The data protection page explains this in more detail.

What we collect

• Account details: your name, work email, a securely hashed password (we never store the password itself), optional phone number, your role and the team members you invite. If you sign in with Google, we receive your name and email from Google.
• Company profile: your organisation name, Companies House number, CQC provider ID, registered address and details we read from the public Companies House and CQC registers, plus your quick start and profile answers such as the services you deliver, where you work, your turnover and tender preferences.
• Evidence and documents: files, policies, case studies and records you upload, and the bid plans, tasks, notes and decisions you create.
• Messages: team inbox messages, comments and conversations with TenderLab staff inside the portal, and emails you send to us.
• Support requests: what you ask us for help with and our replies.
• Billing: your plan, billing cycle, renewal date, Stripe customer reference and a card fingerprint we use to allow one free trial per card. Card numbers are held by Stripe, not by us.
• Usage and security: sign-in times, IP address, browser details, actions such as sign-ups, plan changes and permission changes, and error logs. We use these to keep accounts secure and to fix problems.

We do not need, and ask you not to upload, health or care records about the people you support. Remove personal details that are not needed from evidence before uploading it.

How we use it and our lawful bases

• To provide the service you signed up for: running your account, scoring tenders against your profile, storing your evidence and enabling your team to work together. Lawful basis: contract.
• To check that every account belongs to a real organisation, using Companies House and the CQC register, and to prevent fraud and abuse such as repeated free trials. Lawful basis: legitimate interests in keeping the service secure and fair.
• To take payment and keep financial records. Lawful bases: contract and legal obligation.
• To answer support requests and send service emails such as confirmations, invitations, deadline reminders you switch on and important notices. Lawful basis: contract, or legitimate interests for service notices.
• To understand how the service is used and improve it. Lawful basis: legitimate interests.
• To send marketing emails about tenders and TenderLab services. Lawful basis: consent, or legitimate interests for similar services to existing customers, and you can unsubscribe at any time. New sign-ups are not opted in to marketing.

Who we share it with

We use these providers to run TenderLab One. They act on our instructions under contract:

• Hosting and infrastructure: our virtual private server provider (Africloud), Vercel (web hosting), Neon (database hosting) and Cloudflare (network security and delivery). They store and serve the service and its data.
• Stripe: card payments, subscriptions, invoices and the billing portal. Stripe holds your card details; we never see them.
• Brevo: tender alert and update emails, where you have signed up for them.
• Resend: account emails such as email confirmation, invitations and password resets.
• Microsoft 365: our shared mailbox, used when we email you or you email us.
• Google: Google Drive, where client files for TenderLab bid writing work are kept and shared, our Google Workspace email, and Google sign-in if you choose to use it.
• Anthropic: the AI model behind ScoreKit and the AI assistant, when those features are switched on for your account.
• Calendly: booking consultations and walkthroughs, if you book one.

We read public information from Companies House and the Care Quality Commission. We do not send your workspace content to them. We do not sell personal data. We may disclose information where the law requires it, or to protect our rights or someone's safety.

International transfers

Some of our providers, including Stripe, Anthropic, Vercel, Cloudflare, Google, Microsoft and Brevo, may process data outside the UK, for example in the United States or the European Economic Area. Where that happens we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where a provider is certified) or on the ICO's International Data Transfer Agreement or Addendum to the EU standard contractual clauses, together with the providers' security measures. Ask us at info@tenderlab.co.uk for details of the safeguard used for a particular provider.

How long we keep it

• Account, profile and workspace content: while your account is open. When an account is closed we delete or anonymise this information within a reasonable period, unless we need to keep part of it for one of the reasons below.
• Items you delete inside the portal go to a recycle bin and are permanently removed after 60 days.
• Billing and financial records: for as long as tax and company law requires, normally six years.
• Security logs: for as long as needed to investigate and prevent misuse.
• Enquiries and support requests: while the conversation is active and for a reasonable follow-up period afterwards.

Cookies and local storage

TenderLab One does not use advertising or third-party tracking cookies. Your browser's local storage keeps your sign-in token, so you stay signed in, and preferences such as your language, light or dark theme and how menus are laid out. These are strictly necessary for the service or remember choices you made, so they do not need consent. Signing out removes the sign-in token.

Stripe sets its own cookies on its checkout and billing pages to process payments and prevent fraud. Cloudflare may set a security cookie to protect the site from attacks.

AI features

ScoreKit and the AI assistant, when switched on, send the text you ask them to review (for example a tender question and your draft answer) to Anthropic to produce a score, feedback or a suggestion. Anthropic processes it for us under its commercial terms, which state that content sent through its API is not used to train its models by default.

AI output can be wrong or incomplete. It is guidance for a person to review, not a decision about anyone, and no decision with legal or similarly significant effects on an individual is made by automated means. Do not include personal details about the people you support in text you send to AI features.

Your rights

You have the right to ask for a copy of your personal information, to have it corrected, to have it deleted, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on consent you can withdraw it at any time. Some rights have conditions and exceptions.

To use any of these rights, email info@tenderlab.co.uk. We may need to confirm your identity. We will reply within one month. If the request is about information your organisation controls in its workspace, we will pass it to your organisation and help it respond.

Security

Connections are encrypted, passwords are hashed, access inside a workspace follows the roles your owner or admin sets, staff access to client workspaces is limited to the people who need it, and sign-ins and important account changes are logged. No system is perfectly secure, so please use a strong password and tell us straight away at info@tenderlab.co.uk if you think your account has been misused.

Complaints and changes

If you are unhappy with how we have handled your information, contact us first at info@tenderlab.co.uk. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

We will update this policy when the service changes and show the new date at the top. We will tell account owners by email before any change that materially affects how we use their information.