Privacy policy

1. Data controller

The data controller is Vibecoder Labs, a company pending registration.

Personal data contact: contact@tenderfindr.com

2. Data collected

We may collect the following categories of data:

• Identification data - name, first name, email address, account identifier;
• Billing data - subscription information, payment history (processed by Stripe);
• Usage data - login logs, actions taken in the application, preferences;
• Documents and content - tender documents imported, technical proposals, attachments and any content you upload to your workspace.

3. Purposes and legal bases

Your data is processed for the following purposes:

• Providing and improving the service (performance of the contract);
• Managing accounts, billing and customer support (performance of the contract, legitimate interest);
• Sending transactional communications or, with your consent, informational messages (consent or legitimate interest);
• Complying with legal and accounting obligations (legal obligation);
• Securing the service and preventing fraud (legitimate interest).

4. Private documents and retention

Tender documents, technical proposals and attachments that you import into TenderFindr are treated as private documents. They are not made public and are accessible only to your account and to persons you may authorise.

You can delete your documents at any time from the application (library, responses or account settings). Deletion erases the relevant files from our storage systems, subject to any technical backups purged according to our rotation cycles, generally within thirty days.

Account and billing data is retained for the duration of the contractual relationship, then archived in accordance with applicable legal obligations, including ten years for accounting records.

After you delete your account, associated personal data - including your account profile and your dossiers (tender files, generated proposals and attachments) - is erased. The only exception is an irreversible encrypted fingerprint of your email address, kept for 12 months solely to prevent repeated use of the free trial offer, on the basis of our legitimate interest. No other data is linked to that fingerprint (no email in clear text, no account identifier).

5. Processors

We use the following processors, who process your data solely on our behalf and according to our instructions:

• Clerk - authentication and user account management;
• Supabase - database hosting and file storage;
• Stripe - payment processing and billing (for customers in Europe, via Stripe's Irish entity);
• Resend - sending transactional emails;
• Anthropic - processing of content sent to artificial intelligence models to generate analyses and responses;
• Vercel - hosting of the web application;
• Google (Google Ireland Ltd) - audience measurement (Google Analytics 4) and, where applicable, advertising performance measurement (Google Ads), activated only after your consent.

6. Transfers outside the European Union

Some of our processors are established outside the European Union, or process data outside the EU:

• Clerk, Anthropic and Vercel - companies established in the United States;
• Resend - company established in the United States; according to its documentation, account data, email metadata and API logs are stored in the United States;
• Supabase - company established in Singapore; database and file hosting may involve processing outside the EU depending on the project configuration;
• Google - contracting entity Google Ireland Ltd; audience and advertising measurement may involve transfers to the United States.

Stripe processes payments for customers in Europe through its Irish entity (Stripe Payments Europe, Ltd).

These transfers are framed by the European Commission's standard contractual clauses (SCCs) and, where applicable, by the EU-US Data Privacy Framework when the processor is certified under that framework.

You may request further information on these safeguards by writing to contact@tenderfindr.com.

7. Recipients and disclosure of data

Your data is not sold. It may be shared with the processors listed above, with competent authorities upon legal request, or with professional advisers bound by professional secrecy when necessary.

8. Your rights

Under the GDPR, you have rights of access, rectification, erasure, restriction of processing, portability and objection, under the conditions set by the regulation.

To exercise your rights, contact us at contact@tenderfindr.com. We will respond within one month. You may also lodge a complaint with the CNIL (www.cnil.fr).

9. Security

We implement appropriate technical and organisational measures to protect your data against destruction, loss, alteration, disclosure or unauthorised access: encryption of communications (HTTPS), access control, environment isolation, regular backups.

As no transmission over the Internet is fully secure, we cannot guarantee absolute security; we invite you to protect your login credentials.

10. Cookies and trackers

• Strictly necessary cookies - authentication and session (Clerk). Legal basis: legitimate interest, without consent.
• Audience-measurement cookies - Google Analytics 4. Legal basis: consent; set after acceptance; retained for a maximum of thirteen months. The Google script is loaded only after your consent.
• Advertising cookies - Google Ads (where applicable). Legal basis: consent; set after acceptance; retained for a maximum of thirteen months.

Your consent choice is kept for six months. It can be changed or withdrawn at any time via “Manage cookies” at the bottom of the page.

11. Changes

We may update this policy to reflect changes to the service or regulation. The version in force is the one published on this page, with the date of last update: 27 September 2026.

In the event of a material change, we will inform you by email or via a notification in the application when the law requires it.