Tendersmith

Legal · Draft for legal review

Privacy notice

Updated 28 September 2026.

Who we are

Tendersmith is operated by ZLT Contractors Ltd, a company registered in England and Wales under company number 13997354, trading as Tendersmith (“we”, “us”). Registered office: c/o Hawkins Accounts Ltd, Unit 10 Saxon House, Upminster Trading Park, Warley Street, Upminster RM14 3PJ. VAT number GB 449284558.

Contact for anything in this notice: [email protected]. We are registered with the Information Commissioner’s Office (registration number: to be added once issued).

Our role and yours

We are the controller of your account, sign-in, billing and support information, of the business contact details we use for marketing, and of our security logs.

For the documents and records you put into your workspace (for example staff CVs, certificates, case studies and client references), your company is the controller and we process that information on your behalf, only to provide the service, under the data processing terms in our terms of service. You are responsible for having a lawful basis to share it with us and for telling the people concerned.

What we collect

  • Account details: your name, email address, company name, password (stored only as a one-way hash), sign-in and security records, and your email preferences.
  • Company evidence you add: company profile, trades and regions, case studies, policies and certificates, team members and CVs, referees, owner decisions and commitments, reusable answers and questionnaire answers.
  • Tender work: buyer pack documents you upload, the text extracted from them, AI results, your edits, approvals, pricing inputs, exports and the history of each run.
  • Billing records: plan, subscription state, billing address, VAT number if you give one, and Stripe identifiers. We never see or store full card details.
  • Technical data: IP address, browser details, request logs and security events, and the essential cookies described below.
  • AI usage records: for every AI request, which step ran, the model and host that answered, token counts, cost and outcome. These records never contain your document text or the AI’s answer.

Only upload information you are authorised to use. Keep personal data in CVs and documents to what a bid actually needs, and do not upload special category data (such as health information) or criminal records information unless it is essential for the bid and you have a lawful basis for it.

How we use it and our lawful bases

  • To provide the service you signed up for: your workspace, tender matching, the AI steps you start, exports and support (contract).
  • To keep accounts and data secure, prevent abuse, control AI spending and fix faults (legitimate interests).
  • To take payments, issue VAT invoices and keep business records (contract and legal obligation).
  • To send occasional product tips and offers to customers who have not opted out, and to contact businesses about Tendersmith as described under “Business prospects” (legitimate interests; you can object at any time).

Public tender notices are collected from Contracts Finder and Find a Tender. We do not make decisions about you that have legal or similarly significant effects by automated means alone. The AI steps produce drafts and reviews for you to check; you decide what to submit.

AI processing: which services see your documents

AI runs only when you start a step (such as the tender review, buyer pack analysis, answer drafting, evaluator review, final audit or Ask for changes). When you do, the text needed for that step is sent for processing. It can include extracts of the buyer’s documents, your uploaded documents, your company evidence and personal data in them, such as names, roles and qualifications from CVs.

  • Gateway: every AI request goes through OpenRouter, Inc. (United States), our AI sub-processor. OpenRouter is the only AI gateway the hosted service uses.
  • Drafting, reviews and checks: Claude, developed by Anthropic. We ask OpenRouter to send these requests first to Google Cloud Vertex AI in Europe, then to Amazon Bedrock in Ireland (EU), and only to hosts that OpenRouter lists as zero data retention. If neither is available, OpenRouter may use another zero-data-retention host of the same model, which can be outside the UK and the EU, including in the United States.
  • Reading and extraction steps (page summaries of long documents, buyer pack analysis, pricing and quantity extraction, the specialist tender review readers): models developed by Xiaomi (MiMo models), with MiniMax models as a stand-by. These companies are based in China. These requests also go only to hosts OpenRouter lists as zero data retention, which can be in the United States, China or elsewhere.

Your content is not used to train AI models. We do not use it for training ourselves, and every request tells OpenRouter to use only hosts that do not store prompts or outputs for training (“data collection denied”, always on). The hosted service sends requests only to endpoints OpenRouter lists as zero data retention; if none is available, the step waits or fails rather than use another endpoint. Model tools (such as web browsing) are switched off.

These routing settings are instructions to OpenRouter, not a guarantee from us: processing and retention also depend on OpenRouter’s terms and those of the host that handles the request. Do not upload material whose handling rules forbid this, such as documents marked for UK-only handling or security-classified material.

Other service providers

  • Hosting: A dedicated Apple Mac operated by ZLT Contractors Ltd in the United Kingdom, reached through Cloudflare Tunnel (Cloudflare, Inc.). Your workspace data and uploads are stored there, and encrypted backups are kept for 30 days.
  • Cloudflare, Inc. (United States) carries all traffic to the site through its network and tunnel, and protects it from attacks. It processes IP addresses and request details.
  • Resend, Inc. (United States) sends our emails from its EU region. It receives the recipient address and the message.
  • Stripe hosts checkout and the billing portal and processes payments under its own terms. It acts as a separate controller for its own fraud-prevention and legal purposes.
  • Google Workspace (Google) hosts our email inboxes, so support emails you send us are stored there.

International transfers

Some of these providers are in, or may process data in, countries outside the UK, including the United States and China. Where UK law requires it, we rely on UK adequacy regulations (including the UK extension to the EU–US Data Privacy Framework where the provider is certified) or on the UK International Data Transfer Agreement or Addendum in the provider’s terms. Contact us for more detail.

Emails we send

Service emails go to every account: email verification, invitations, password resets, a message when AI work you started has finished (you can turn this off in Account → Email notifications), billing notices, data-retention notices and security notices.

Trial and paid accounts also get a weekly email listing the new tenders matched to the trades and regions in their company profile, with the bids and saved tenders that close soon. It is a service email about your account, sent only when there is something new; we use your account email address and your matches to send it, under our contract with you. You can turn it off in Account → Email notifications or with the one-click link in every weekly email. It is separate from product tips and offers.

We may also email customers occasional product tips and offers about Tendersmith. You can opt out when you sign up, from the one-click unsubscribe link in every such email, or at any time in Account → Email notifications. Opting out does not affect service emails.

Business prospects

We may contact UK limited companies about Tendersmith. For this we use company details from public contract award notices (Contracts Finder and Find a Tender), Companies House (including directors’ names) and the company’s own website (a general business email address and switchboard number). Our lawful basis is legitimate interests. We do not buy personal email lists, guess personal email addresses or collect personal mobile numbers for this, and we screen phone numbers against the Telephone Preference Service and Corporate Telephone Preference Service before calling.

You can object at any time by replying “unsubscribe” or emailing [email protected]. We will stop, and keep only a minimal suppression record (company, domain, email address or phone number) so that we do not contact you again. Prospect records are deleted or re-checked 12 months after we collect them unless you become a customer.

How long we keep it

  • Open accounts: account records and files are kept while the account is open, including after a paid plan ends, so you can still read and download your work.
  • Closing your account: you can download an archive of your data and close your account from Account & security. Closure revokes access straight away and deletes the account once any active work has stopped.
  • Free trials that end without a subscription: kept for 90 days after the trial ends, then deleted automatically in the same way as a closure. We email you 14 days before deletion; subscribing before then keeps everything.
  • Sign-ups never verified: deleted after 30 days.
  • Backups: encrypted, kept for 30 days; a restore re-applies later deletions.
  • Server logs: kept for 14 days. They contain account ids and page addresses, never document content.
  • Billing and VAT records: kept for six years after the end of the financial year they relate to, as UK tax law requires.
  • AI usage records and anonymous usage totals: kept for cost reconciliation; they contain no document text.

How we protect it

Your workspace is private to your company. Data is encrypted in transit, backups are encrypted, passwords are hashed, sign-in is rate-limited, and the server accepts no inbound connections except through the Cloudflare tunnel. Access to customer data by our staff is limited to support you ask for, security and legal needs.

Your rights

You can ask to access, correct or delete your personal data, restrict or object to our use of it (including an absolute right to object to direct marketing), or receive a copy in a portable format. Email [email protected]; we reply within one month. If your information is in a customer’s workspace (for example your CV), we will pass your request to that customer, who controls it. If you are unhappy with how we handle your data you can complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113).

Cookies and similar storage

We use only storage the service needs. We do not use advertising or analytics cookies, so we do not ask for cookie consent.

  • Session cookie: keeps you signed in and holds the security token that protects forms. Deleted when you close the browser.
  • remember_token: set only if you tick “Keep me signed in”; lasts 14 days.
  • Cloudflare security cookies (such as __cf_bm): may be set by Cloudflare to tell people from bots; they last up to 30 minutes.
  • Browser storage: a list of the last tenders and bids you opened (tw-recent, kept in your browser only, for the “recent” menu) and a one-time message after saving changes. Nothing in it is sent to us.

Changes to this notice

We will update this page when what we do changes, and email account holders about significant changes before they take effect.