How we handle your
information.

What we collect

1. Account information. Your email address. Signing in requires a verified email address.
2. Proposal content. RFP source documents you upload, reviewed text, and proposal details you submit.
3. Knowledge Base content. Original documents, extracted source text, citation references, reusable answers, and search embeddings.
4. Free tools. Text you paste or a PDF or DOCX file you upload for anonymous requirement analysis. If you request the full compliance matrix, we store your email, the title or source, the request timestamp, and your optional marketing choice, and we send a lead notification to hello@tendercrestai.com.
5. Usage analytics, only after you opt in. A signed random browser identifier that lasts up to 30 days, and consent preferences that last 30 days. Analytics does not collect proposal text, document names, form content, passwords, full URLs, referrers, or email addresses as event attributes. Daily keyed IP hashes are used for admission limits and removed after two days.
6. Advertising and affiliate tracking, only after a separate opt-in. The OpenAI advertising pixel on the public homepage and demo only, Google Ads measurement on public homepage and demo pages, and Rewardful affiliate attribution. These are separate choices from usage analytics.

How we use and store your information

Uploaded sources are stored in private Supabase Storage buckets. Reviewed text, proposal details, and Knowledge Base content are stored in Supabase PostgreSQL. Access is checked against account ownership, and Knowledge Base access is scoped to active organization membership and role permissions.

Submitted proposal text is sent to Airtable for the proposal workflow. Airtable AI processes submitted text to create and revise drafts. Completed drafts are sent by email through Resend.

Knowledge Base indexing and compliance analysis send bounded source excerpts to the OpenAI API to create embeddings or identify requirements and facts. Optional AI writing in the proposal workspace sends saved section text, linked requirements, company name, and accepted evidence excerpts to the configured OpenAI chat API only when you explicitly choose it and confirm processing consent. Those writing requests use store:false. Free-tool analysis sends extracted source text to the configured OpenAI service with store:false.

Standard provider retention may still apply. We do not promise zero provider retention, and this is not a verified Zero Data Retention arrangement.

Generated submission packages expire after seven days. This is not a seven-day deletion promise for all project or provider data. Retained emailed-draft copies expire after 90 days. Free-tool temporary source, job, and requirement records expire after 24 hours. Lead records are retained for 90 days. Usage analytics reports cover the last 90 days, and daily keyed IP hashes are removed after two days. On the Team plan, Airtable AI providers may retain inputs and outputs for up to 30 days for safety and compliance moderation.

Services that process your information

We use the following services to operate TenderCrest AI. Each provider processes data under its own terms.

1. Supabase: account data, document storage, and database.
2. Airtable: proposal workflow and AI drafting. Airtable's published AI terms prohibit using customer inputs and outputs to train generative AI models.
3. OpenAI: embeddings, compliance analysis, and optional AI writing. OpenAI's applicable account agreement and API data controls govern those requests.
4. Resend: email delivery of completed drafts.
5. Stripe: payments.
6. Netlify: hosting.
7. Rewardful: affiliate attribution, only with your consent.
8. Google Ads and the OpenAI advertising pixel: advertising measurement, only with your consent.

See our security and data handling page for more detail on how proposal documents move through these services.

Your choices and deletion requests

Usage analytics, advertising tracking, and affiliate attribution are optional and start only after you opt in. You can decline or withdraw using the settings in the footer. Withdrawing stops collection. It does not erase data a provider already collected or remove provider cookies.

The document upload page does not currently provide self-service deletion. To request deletion, email hello@tendercrestai.com and include your account email. Do not attach the confidential document.

A deletion request is not completion. Its status appears in My Account. Deletion has limits: shared project copies, provider retention, financial and audit records, received emails, and separately held backup copies are separate. Archiving a Knowledge Base source removes it from future retrieval but does not delete its original file, extracted text, embeddings, or audit history, and does not request deletion from downstream providers. Revoking access stops future requests but cannot recall copies someone already downloaded.

Children

TenderCrest AI is a business service for proposal teams. It is not directed at children.

What we do not claim

This site does not claim SOC 2 certification, SSO, a contractual uptime SLA, or verified Zero Data Retention. Ask for evidence of any certification or contractual assurance you require before sending regulated or confidential bid material.

Contact

Questions about this policy, or a deletion request: email hello@tendercrestai.com. TenderCrest AI, Seattle, WA.