Privacy Policy

• Account information — name, email address, phone number, job title, and password (stored only as a cryptographic hash by our authentication provider).
• Organization information — company name, addresses, trades, service areas, certifications, projects, documents, and contacts you add to a profile.
• Procurement content — tenders, documents, questions, answers, addenda, and bids submitted through the Platform, with timestamps and audit records of key actions.
• Billing information — handled by Stripe. We receive subscription status and a payment reference; we never see or store full card numbers.
• Usage information — IP address, device and browser data, and page interactions, collected through Google Analytics, Vercel Analytics, server logs, and Google reCAPTCHA (used to protect our forms from abuse).
• Communications — messages you send us and delivery events for email we send you (delivered, bounced, complaint), which we use to stop sending to addresses that bounce or opt out.

Our contractor directory includes profiles of businesses compiled from public sources — public procurement open data and companies’ own websites. This is business contact information (company name, business address, business phone and email, trades) published by or about the business itself. Each unclaimed profile is labelled as such, names its data source, and carries instructions to claim, correct, or remove it. If your business appears and you want the listing corrected or removed, email support@tendering.ca — removals are honoured promptly and recorded so the listing is not re-created by a future data import.

• to provide the Platform: accounts, profiles, tenders, sealed bidding, and billing;
• to send transactional and activity email (receipts, addenda, answers, awards), alerts you configure, and commercial messages permitted under Canada’s Anti-Spam Legislation — each with unsubscribe controls, and per-category preferences in your dashboard;
• to generate AI-assisted summaries and descriptions of tender content (tender text is processed for this purpose by our AI provider; see section 4);
• to secure the Platform, prevent fraud and abuse, and keep audit records of procurement actions;
• to understand aggregate usage and improve the product.

We do not sell personal information.

We share information only with service providers who process it to run the Platform, under their own contractual and security obligations:

• Supabase (database, authentication, and file storage)
• Vercel (hosting and site analytics)
• Stripe (payments)
• Resend (email delivery)
• Google (Analytics; reCAPTCHA on our forms)
• Anthropic (AI processing of tender text for summaries)

Information you choose to publish — a public tender, a public profile, a question on a tender — is visible to visitors by design. A sealed bid is disclosed to the tender’s buyer only after the tender closes. We may also disclose information where the law requires it, or in a business transfer, subject to this policy.

Some providers store or process data outside Canada (primarily in the United States). While outside Canada, information is subject to the laws of those jurisdictions. We select providers with strong security practices and limit what each receives to what its function requires.

We use necessary cookies to keep you signed in and secure the site, and analytics (Google Analytics, Vercel Analytics) to measure traffic. Analytics data is used in aggregate. You can block cookies in your browser — the site works signed-out without them — and opt out of Google Analytics with Google’s browser add-on. We do not use advertising cookies and do not respond to browser “Do Not Track” signals beyond the practices in this policy.

Account and profile information is kept while your account is active. Procurement records — published tenders, submitted bids, addenda, acknowledgements, and audit trails — are retained after a tender concludes, and may be retained after account closure, because other parties to the procurement reasonably rely on them as records of the process. Email suppression records (opt-outs, bounces) are retained so we keep honouring them. Other information is deleted or anonymized when no longer needed.

Data is encrypted in transit; access is controlled by row-level security in our database, including the sealing of bids until tender close; administrative access is limited and logged. No system is perfectly secure, but we design so that the most sensitive data — sealed bids and credentials — has the narrowest possible access.

You may access the personal information we hold about you, correct it, ask us to delete it (subject to the retention needs in section 6), withdraw consents, and — for Quebec residents — request a copy of computerized personal information you provided in a structured, commonly used format. Most profile and notification data can be managed directly from your dashboard, including per-category email preferences. For anything else, contact the privacy officer at support@tendering.ca; we respond within 30 days. If you are unsatisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada or your provincial privacy regulator (in Quebec, the Commission d’accès à l’information).

If a breach of security safeguards creates a real risk of significant harm, we will notify affected individuals and report to the appropriate privacy regulators as the law requires, and we keep records of all breaches.

The Platform is a business tool and is not directed at or intended for anyone under 18.

We may update this policy; material changes will be announced by email or in-app notice before taking effect. The current version is always at tendering.ca/privacy. See also our Terms of Service.