Privacy

Short version: your email, your name, your Interests, and anything optional you chose to give us. We count how the site is used without cookies and without keeping your IP address, and we do not link what you do in the product to you unless you ask us to.

Last updated 30 September 2026

What we store

  • Your email address. It is your identity here, and where the Digest and sign-in codes go.
  • Your name. Asked once at signup.
  • Your Interests. The phrases you saved to describe what your business does.
  • Optional profile fields. City, state, company name, business type and your website, if you filled them in. All skippable, and none of them affects which Tenders you are matched to.
  • Your Digest settings. Whether it is on, how often, and when you last received one.
  • Consent records. The time you agreed to these terms and this page, which is the thing the DPDP Act asks us to keep. If you choose to link your product usage to your account, we also keep that you did, and when.

Signing in

Signing in is handled by Clerk, with a code we email you. There is no password. Clerk holds your email address and your name, and the sign-in sessions that keep you signed in. Signing up is protected against bots by Cloudflare Turnstile, which Clerk runs. Each night we also take a safety copy of your Clerk account data, and keep it for 7 days.

Founders can view the site as a user in order to help them, and every such session started from our panel is logged.

What we do not store

  • Payment details. There is no payment step and no processor involved. Nothing is paywalled.
  • Advertising or cross-site tracking identifiers. There are none on this site.
  • Your IP address. It is not stored in our database or in our analytics.
  • Your bids. Bidding happens on CPPP or GeM. We never see it.

How we count use

Visits are counted without cookies. We do this with our own code and with Umami, which runs on our own server. Your IP address is used to tell one visitor from another on a given day and is never stored. Umami stores an approximate country and city worked out from it, along with your browser, operating system, device type and the page that referred you. Visitors are counted per day, so a person who comes back on another day is counted again.

What happens in the product is recorded without your account attached. That covers, for example, a search (with its text, up to 100 characters), a Tender being opened, and a click through to a portal. These records are not linked to you.

Linking is your choice. Those records carry your account only if you choose to link your usage to it at signup or in settings. If you have made that choice you can withdraw it, which unlinks the records already made, and deleting your account deletes any records linked to it.

How long. Individual records are kept for 13 to 14 months. Daily totals, which carry no account, are kept indefinitely. Search phrases outlive 13 months only when three or more different visitors searched them.

Email

  • The Digest and announcements record delivery, clicks on the links in them, and approximate opens, through Resend. Opens are approximate because some mail apps load every image automatically, whether or not you read the message.
  • Account notices and sign-in codes are not tracked.
  • Unsubscribing. The unsubscribe button built into your mail app is not tracked. The unsubscribe link at the foot of a message passes through Resend’s link tracking like every other link; we never keep its token and never count it as a click. Unsubscribing does change your settings, of course.
  • Announcements are messages to a group of users about the service. They are opt-out: you receive them unless you unsubscribe, and every one carries its own unsubscribe link.

Cookies

Clerk sets its sign-in cookies from your first visit, whether or not you sign in. They include two Cloudflare security cookies on Clerk’s sign-in domain. The longest last about 13 months; the two Cloudflare cookies are short-lived. We set one cookie ourselves, sidebar_state, which remembers whether the side menu is open. All of them are strictly necessary to the service. There is no analytics cookie and no advertising cookie. The only embedded third-party check is Clerk’s Turnstile on sign-up.

Because every cookie is strictly necessary, there is no consent banner. A banner that appears when there is nothing to consent to trains people to click through the ones that matter.

Who else processes data

  • Clerk handles sign-in.
  • Resend delivers our email and records the delivery, click and open events described above.
  • DeepSeek reads the text of the website you give us, to suggest Interests, and reads Tender documents. Your email address is never sent to it.
  • Sentry records errors in our software. It is hosted in Frankfurt, in the EU, and is set up not to collect personal data such as your name or email.
  • Cloudflare stores our database backups, encrypted at rest, and runs our DNS.
  • Oracle Cloud (Mumbai, India) provides the servers our application and database run on.

Umami is not on this list because it is not a third party: it runs on our own servers.

We do not sell your data, we do not share it for anyone else’s marketing, and we do not build a profile of you for advertising.

Tender data is not your data

The Tenders themselves are public records published by CPPP and GeM. We read them, normalise them and link back to the portal that published each one. Nothing about your account is sent to a portal, and browsing a Tender here does not tell its buyer anything.

How long we keep things

  • Your account, until you delete it.
  • Sign-in sessions, until they expire or you sign out. Signing out everywhere ends all of them at once.
  • Digest history. Which Tenders we sent you, until about a month after each one closes. A record of each send (date and counts), until you delete your account.
  • Product usage records, as described under How we count use.
  • Email log and events, until you delete your account. Resend keeps its own copy for 30 days.
  • Nightly safety copy of your Clerk account data, as described under Signing in.
  • Mail suppression list. If mail to an address bounces for good or is reported as spam, we keep that address on a list so we do not mail it again. It is keyed on the address, so it is kept after an account is deleted.
  • Backups, nightly, kept in a rolling window of up to about eleven days, then deleted. Deleting your account does not reach into a backup already taken; it ages out.

Your rights

Under India’s Digital Personal Data Protection Act you can ask to see what we hold about you, correct it, withdraw the consent you gave at signup, have your data erased, and make a complaint. To do any of these, write to support@tenderwala.co. Some you can also do yourself:

  • Correct it — your Interests are editable on Interests and your profile in settings.
  • Stop the email — turn the Digest off in settings, or use the unsubscribe link in any Digest or announcement. That stops the mail and nothing else.
  • Unlink your usage — turn linking off in settings. Records already made are unlinked, and the account is untouched.
  • Erase it — deleting your account in settings removes your profile, your saved Interests and every session, completely. It is not a deactivation.

Withdrawing the consent you gave at signup and deleting the account are the same action here, because that consent is what the account runs on. Linking your usage is a separate choice, and turning it off leaves the account alone.

Children

This is a tool for businesses bidding on government contracts. It is not directed at children and we do not knowingly hold data about them.

Changes to this page

If what we store changes, this page changes with it, and the short notice shown above the consent checkbox at signup changes at the same time. The date at the top is the one to check.