Privacy policy
Last updated 21 October 2026
Who we are
TenderGraph is a product of M Heath Consulting Ltd, a company registered in England & Wales (company number 14501165), registered office Unit 20 Tarran Way West, Tarran Industrial Estate, Wirral, England, CH46 4TT. M Heath Consulting Ltd is the data controller for the personal data described here. Contact us about anything on this page at hello@tendergraph.ai.
We hold two kinds of personal data: data about our customers and the people who use their accounts, and data about people who are named in the public procurement notices and planning records we collect. They are covered separately below.
Our customers: what we collect, and why
| Data | Why | Lawful basis |
|---|---|---|
| Name, work email, and your password (stored only as a hash) | To create and secure your account | Contract |
| Company name, the website(s) you give us, and the research our AI builds from them | To research your business and build your tender profile | Contract |
| Your targeting profile, tracked tenders, saved monitors, saved profiles and API keys | To match tenders and run your pipeline | Contract |
| Subscription status and a Stripe customer reference (card and billing details are held by Stripe) | To take payment and manage the subscription | Contract; legal obligation for tax records |
| Session records (the IP address and browser a session was opened from) and per-key API usage counts | Security, rate limiting and abuse prevention | Legitimate interests |
| Your email address, for account email and the daily digest of matching tenders — the digest is on by default once your profile is set up; turn it off in your tender tracker or with the unsubscribe link in any digest | To deliver the service | Contract |
| What you ask the AI features to work on — the websites you submit, and the tender documents you ask to be summarised | To run the feature you triggered | Contract |
We do not sell our customers' personal data, we do not use advertising or tracking cookies, and we do not profile you for anything except matching tenders to the profile you confirmed.
People named in public notices
The records we collect are public procurement notices and planning records, published by public authorities and their platforms — every source is listed on the coverage page. We did not get this data from you, so this section is how we tell you about it. Some notices name people:
- officers of buying organisations — the name, job title and work contact details a notice gives as its contact point;
- suppliers who are individuals — sole traders and individual contractors named in award notices, sometimes with a trading address or an identification number;
- people named in planning records — an application's agent and, where the planning authority publishes them, applicants' names and addresses;
- people named in the tender documents attached to notices.
Why, and on what basis. We process this data to make public procurement searchable and analysable — so suppliers can find and respond to opportunities, and journalists, researchers and buyers can follow public spending. Our lawful basis is legitimate interests — ours and our customers' — in the transparency and competition that publishing these notices is meant to serve. We keep the data as the authority published it and use it for those purposes only.
Who sees it. Our subscribers, through the website, the API and the AI tools they connect to it. Company pages and the award league tables, which summarise awards naming an organisation, are public.
How long. For as long as the notice is part of the public record we hold. We do not routinely delete notices, because they are public records and the publishing authority remains the source of record. When a publisher updates a notice and we collect it again, our copy takes the update; we do not track notices a publisher takes down, so if one that names you has been removed at source, tell us and we will act on it.
Personal identity numbers are withheld. Where a notice identifies a supplier by a personal identity number — a Colombian cédula de ciudadanía, or a Chilean RUN, for example — we treat the supplier as a private individual: the API and the MCP server never serve the number, the record says only that a personal identifier was withheld, and the verbatim source payload for that notice is not served.
Company pages are for organisations. Suppliers identified as individuals in that way are not given public company pages, and are not listed in company search or the league tables.
If you are named. You can object to our processing, ask what we hold about you, or ask us to correct or erase it. Email hello@tendergraph.ai with the page or record concerned. Where a company page, a company-search entry or a league-table line profiles you as an individual, we will withhold it from those public pages. The underlying notices stay, because they are public records, but we will tell you which authority published them so that you can ask for a correction at source. We reply within one month.
Who processes it
These providers process personal data on our behalf, on our instructions and under their data processing terms:
- Vercel — hosts the website, the API and the MCP server (London region).
- Neon — runs the Postgres database that holds accounts and the notice store (AWS London region, eu-west-2).
- Fly.io — runs the ingest worker that collects public notices, and holds the database credentials it needs to write them (London).
- Stripe — takes payments and manages subscriptions and invoices; card details go straight to Stripe.
- Resend — sends account email and the daily digest.
- Anthropic — runs the AI features you trigger: business research during onboarding, and document summaries.
The AI features run only when you trigger them, and content sent to the AI provider is not used to train its models.
International transfers
The application, the database and the ingest worker run in London. Several of our providers are nonetheless US companies — Vercel, Stripe, Resend and Anthropic among them — and a provider may process or access data from outside the UK, for example to deliver email, to process a payment, to run an AI request you trigger, or for support and security. Where personal data is transferred outside the UK, the transfer relies on UK adequacy regulations (including the UK extension to the EU–US Data Privacy Framework, where the recipient is certified under it) or on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Ask us for details of the safeguard that applies to a particular provider.
How long we keep it
- Your account — profile, pipeline, monitors, saved profiles, API keys and session records — for as long as the account exists. Nothing is deleted automatically when a subscription ends, so that you can come back to it. You can download a copy of all of it and delete the account yourself, at once, from the account page when you are signed in; or ask us to close your account and we will delete these within one month and confirm when it is done.
- Billing records — invoices and payment records are kept for at least six years, as UK tax law requires. Stripe holds them.
- Usage counters — daily counts of AI requests, which identify an account only by an internal id, are kept for cost control.
- Request logs — our hosting providers keep short-lived request logs, which include IP addresses, for the periods their services set.
Your rights
Under UK GDPR you can ask for a copy of your data, correct it, delete it, restrict or object to processing, and receive it in a portable format. Email hello@tendergraph.ai and we will respond within one month. You can also complain to the Information Commissioner's Office (ico.org.uk), though we would rather you told us first.
Cookies
Two cookies keep you signed in, and both are strictly necessary: a session cookie, which lasts up to seven days and is renewed while you use the site, and a short-lived copy of your session, which expires after five minutes and saves re-checking the database on every page. There are no analytics, advertising or third-party tracking cookies on this site, which is why you are not asked to accept any. Stripe's checkout and billing pages, which you reach from Billing, are Stripe's own and set Stripe's cookies under Stripe's policy.