Privacy policy

1. Data controller

The data controller is Vibecoder Labs, SASU with share capital of 100 euros, registered office at 47 rue Vivienne, 75002 Paris, registered with the RCS of Paris under number 130 789 530.

Personal data contact: contact@tenderfindr.com

2. Data collected

We may collect the following categories of data:

• Identification data - name, first name, email address, account identifier;
• Billing data - subscription information, payment history (processed by Stripe);
• Usage data - login logs, actions taken in the application, preferences;
• Company profile - information you enter about your company (SIRET, certifications, resources, key staff, references), and public contracts already awarded to your company, retrieved from the official public procurement data (DECP) using your SIRET;
• Business phone number (required when setting up your company) - the one you provide or, failing that, your company's public business number or one provided by a professional contact database (lemlist). It is included in the bid documents you generate and used to contact you to help you use the service, never shared with third parties nor used for advertising;
• Documents and content - tender documents imported, technical proposals, attachments and any content you upload to your workspace.

3. Purposes and legal bases

Your data is processed for the following purposes:

• Providing and improving the service (performance of the contract);
• Managing accounts, billing and customer support (performance of the contract, legitimate interest);
• Sending transactional communications or, with your consent, informational messages (consent or legitimate interest);
• Complying with legal and accounting obligations (legal obligation);
• Securing the service and preventing fraud (legitimate interest);
• Contacting you about your use of the service, for example to help you get started or to suggest a tender matching your activity, based on usage indicators only (legitimate interest). You can object at any time by replying to the message or writing to us.

Analyses and technical proposals are generated automatically by artificial intelligence as drafts for you to review. No decision producing legal effects concerning you is taken solely by automated means.

4. Access by our team

The content of your workspace (company profile, tender documents, technical proposals, library) is confidential. Our team does not consult it for commercial purposes. Access is limited to what is strictly necessary: at your request for support, to fix a technical incident, to ensure security, or to comply with a legal obligation.

To follow up with our customers, we only use usage indicators (account creation date, number of files created, last activity), never the content you have entered.

5. Private documents and retention

Tender documents, technical proposals and attachments that you import into TenderFindr are treated as private documents. They are not made public and are accessible only to your account and to persons you may authorise.

You can delete your documents at any time from the application (library, responses or account settings). Deletion erases the relevant files from our storage systems, subject to any technical backups purged according to our rotation cycles, generally within thirty days.

Documents you transmit via TenderFindr are not used to train artificial intelligence models, in accordance with Anthropic's commercial API terms, which provide that Anthropic may not train models on Customer Content from its Services.

Accounts with no login for three years are deleted, after an email notice sent thirty days beforehand; logging in once is enough to keep your account. Account data is erased when you delete your account. Billing data (invoices and related Stripe records) is retained for ten years under French accounting obligations (Article L123-22 of the Commercial Code). All other personal data associated with your account - including your profile and your dossiers (tender files, generated proposals and attachments) - is erased. The only additional exception is an irreversible encrypted fingerprint of your email address, kept for 12 months solely to prevent repeated use of the free trial offer, on the basis of our legitimate interest. No other data is linked to that fingerprint (no email in clear text, no account identifier).

6. Processors

We use the following processors, who process your data solely on our behalf and according to our instructions:

• Clerk - authentication and user account management;
• Supabase - database hosting and file storage;
• Stripe - payment processing and billing (for customers in Europe, via Stripe's Irish entity);
• Resend - sending transactional emails;
• Anthropic - processing of content sent to artificial intelligence models to generate analyses and responses (under Anthropic's commercial terms, Customer Content is not used to train models);
• Vercel - hosting of the web application;
• Upstash - protection against abuse (request rate limiting based on technical identifiers such as the IP address);
• Google Workspace (Google Ireland Ltd) - our professional email;
• lemlist - sending of our business prospecting emails (see the "Business prospecting" section);
• Google (Google Ireland Ltd) - audience measurement (Google Analytics 4) and, where applicable, advertising performance measurement (Google Ads). Without your consent, no cookie is set and only anonymous, cookieless signals are sent (Google Consent Mode).

7. Transfers outside the European Union

Some of our processors are established outside the European Union, or process data outside the EU:

• Clerk, Anthropic and Vercel - companies established in the United States;
• Resend - company established in the United States; according to its documentation, account data, email metadata and API logs are stored in the United States;
• Supabase - company established in Singapore; our database and files are hosted in the European Union (Frankfurt, Germany);
• Upstash and lemlist - Upstash is established in the United States; lemlist is a French company whose service may rely on processors outside the EU;
• Google - contracting entity Google Ireland Ltd; audience and advertising measurement may involve transfers to the United States.

Stripe processes payments for customers in Europe through its Irish entity (Stripe Payments Europe, Ltd).

These transfers are framed by the European Commission's standard contractual clauses (SCCs) and, where applicable, by the EU-US Data Privacy Framework when the processor is certified under that framework.

You may request further information on these safeguards by writing to contact@tenderfindr.com.

8. Business prospecting

We may contact professionals by email or by phone to present TenderFindr or to help our users get started. The data used (name, job title, company, professional email address, professional phone number) comes from public sources, in particular the official public procurement data (DECP) listing the companies awarded public contracts, and from professional contact databases (lemlist).

This processing is based on our legitimate interest in prospecting companies, for messages related to the recipient's professional activity. Each message identifies us and lets the recipient object, simply by replying or writing to contact@tenderfindr.com. The data of prospects who do not become customers is kept for no more than three years from the last contact.

9. Recipients and disclosure of data

Your data is not sold. It may be shared with the processors listed above, with competent authorities upon legal request, or with professional advisers bound by professional secrecy when necessary.

10. Your rights

Under the GDPR, you have rights of access, rectification, erasure, restriction of processing, portability and objection, under the conditions set by the regulation.

You can download all the data of your account at any time from Settings ("My data"), and delete your account from the same page. Radar alert emails include a one-click unsubscribe link.

To exercise your rights, contact us at contact@tenderfindr.com. We will respond within one month. You may also lodge a complaint with the CNIL (www.cnil.fr).

11. Security

We implement appropriate technical and organisational measures to protect your data against destruction, loss, alteration, disclosure or unauthorised access: encryption of communications (HTTPS), access control, environment isolation, regular backups.

As no transmission over the Internet is fully secure, we cannot guarantee absolute security; we invite you to protect your login credentials.

12. Cookies and trackers

• Strictly necessary cookies - authentication and session (Clerk). Legal basis: legitimate interest, without consent.
• Audience-measurement cookies - Google Analytics 4. Legal basis: consent; set after acceptance; retained for a maximum of thirteen months. Without consent, the Google script runs in “denied” mode: no cookie is set and only anonymous, cookieless signals (e.g. a page view or a sign-up) are sent to Google.
• Advertising cookies - Google Ads (where applicable). Legal basis: consent; set after acceptance; retained for a maximum of thirteen months.
• Source cookie (tf_src) - remembers how you found the site (search, advertising, a link received by email…) so it can be linked to your account if you sign up. Legal basis: consent (set only if you accept audience measurement or advertising); kept for thirty days and deleted on sign-up.
• Vercel traffic statistics - anonymous page-view measurement, with no cookie or personal identifier. Legal basis: legitimate interest.

Sign-up and purchase measurements linked to a cookie identifier, including those sent from our servers, are only transmitted if you have accepted audience measurement; otherwise only an anonymous, cookieless signal is sent.

Your consent choice is kept for six months. It can be changed or withdrawn at any time via “Manage cookies” at the bottom of the page.

13. Changes

We may update this policy to reflect changes to the service or regulation. The version in force is the one published on this page, with the date of last update: 7 October 2026.

In the event of a material change, we will inform you by email or via a notification in the application when the law requires it.