Privacy Policy

1. Introduction

TenderSmith (Pty) Ltd (“TenderSmith”, “we”, “us”) is committed to protecting your personal information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”) and other applicable South African legislation.

This policy explains what personal information we collect, why we collect it, how we use and protect it, and your rights as a data subject.

2. Responsible Party

TenderSmith (Pty) Ltd is the responsible party for the processing of your personal information. Contact us at privacy@tendersmith.co.za for privacy-related enquiries.

3. Information We Collect

We collect and process the following categories of personal information:

Account information: name, email address, phone number, and company details you provide during registration.

Company documents: CIDB registrations, B-BBEE certificates, tax clearance certificates, CVs, and other documents you upload to generate tender submissions.

Tender data: tender briefs, submission documents, and intelligence briefs generated through the platform.

Payment information: billing details processed through Stripe. We do not store credit card numbers on our servers.

Usage data: pages visited, features used, and interaction patterns to improve the service.

4. Purpose of Processing

We process your personal information for the following purposes:

Providing the TenderSmith service, including generating tender documents, compliance checklists, and intelligence briefs. Managing your account and subscription. Communicating with you about your account, service updates, and support requests. Improving the platform based on aggregate usage patterns. Complying with legal obligations under South African law.

5. Legal Basis for Processing

We process your personal information on the basis of: your consent (provided at registration), contractual necessity (to deliver the service you subscribed to), and legitimate interest (to improve the platform and prevent fraud). Where required by POPIA, we will obtain your explicit consent before processing sensitive information.

6. AI-Generated Content

TenderSmith uses artificial intelligence to generate tender documents, intelligence briefs, and compliance analyses. Documents produced by the engine are AI-generated drafts and should be reviewed by a qualified professional before submission. We do not guarantee the accuracy, completeness, or suitability of AI-generated content for any specific tender.

Your uploaded documents may be processed by third-party AI providers (Anthropic) to generate outputs. We have data processing agreements in place with these providers. Your data is not used to train third-party AI models.

7. Data Storage and Security

All data is hosted in South Africa (AWS af-south-1, Cape Town). Data is encrypted in transit using TLS 1.3 and at rest using AES-256 encryption. We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction.

8. Data Sharing

We do not sell your personal information. We may share data with: payment processors (Stripe) to process transactions, cloud infrastructure providers (AWS, Supabase) to host the service, AI providers (Anthropic) to generate documents, and law enforcement where required by South African law.

Your tender data is never shared with other users, competitors, or third parties for commercial purposes. Each account's data is isolated.

9. Data Retention

We retain your personal information for as long as your account is active or as needed to provide services. After account deletion, we retain data for up to 90 days for backup and recovery purposes, after which it is permanently deleted. Financial records are retained for the period required by SARS (5 years).

10. Your Rights Under POPIA

As a data subject under POPIA, you have the right to:

Request access to your personal information. Request correction of inaccurate information. Request deletion of your personal information. Object to the processing of your personal information. Withdraw consent at any time. Lodge a complaint with the Information Regulator.

To exercise any of these rights, contact us at privacy@tendersmith.co.za.

11. Information Regulator

If you are unsatisfied with our handling of your personal information, you may lodge a complaint with the Information Regulator (South Africa) at enquiries@inforegulator.org.za or call 012 406 4818.

12. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email or in-app notification. Continued use of TenderSmith after changes constitutes acceptance of the updated policy.