Legal

Privacy Policy

What we collect, what we do with it, and what rights you have. We're an EU company, hosted in the EU, and we don't train models on your data.

calendar_today Last updated: 2026-04-16

1. Who we are

Tenderiser is a product of Agentic d.o.o., a company registered in the Republic of Slovenia (European Union) at Dunajska cesta 20, Ljubljana. For anything in this policy, contact us via the support page. Under the EU General Data Protection Regulation (GDPR), Agentic d.o.o. is the data controller for personal data you provide to us when you contact us or use the service.

2. What we collect

  • Contact information you give us (name, business email, company, message) when you use the contact form or email us directly.
  • Account information if we set up an account for you (name, business email, role).
  • Your catalogue data that you upload to Tenderiser (SKUs, product descriptions, specs, units, and any other fields you include).
  • Tender content that you load into the add-in for matching (line items, specs, and free text from the RFP).
  • Usage data generated when you use the add-in (which features you use, errors, approximate timing). We use this to fix bugs and improve the product.

3. How we use it

  • Running the service: matching tender line items to your catalogue and returning results into your Excel workbook.
  • Support: answering questions you send to us.
  • Product improvement: aggregate, non-identifying usage data to spot bugs and prioritise what to build next.
  • What we do not do: we do not sell your data, we do not share it with advertisers, and we do not use your catalogue or tender content to train shared models.

4. Where your data goes — SaaS

  • Hosting: the SaaS version of Tenderiser runs on Hetzner Online GmbH inside the European Union. Your catalogue data, account data, and usage data are stored on Hetzner infrastructure.
  • AI matching: when you run a match in the SaaS version, the relevant tender line(s) and candidate catalogue entries are sent to the OpenAI API for processing. OpenAI Ireland Ltd. is the contracting party for customers in the EU and acts as a subprocessor. Per OpenAI's published API data-usage policy, API inputs and outputs are not used to train OpenAI's models.
  • International transfers: where OpenAI's processing involves infrastructure outside the European Economic Area, the transfer is governed by the EU Standard Contractual Clauses included in OpenAI's Data Processing Addendum. We do not transfer your data to any other third country.
  • No other third parties receive your catalogue or tender content. If that changes we will update this policy and tell existing customers.

5. On-premise deployment

We also offer an on-premise deployment for customers with strict data-residency or confidentiality requirements. In this mode Tenderiser runs on infrastructure you control, using open-source models retrained on your own catalogue. Your catalogue and tender data never leave your network, and neither Agentic d.o.o. nor OpenAI has access to it. Scope and terms for on-premise deployments are set out in the order form you sign with us.

6. Cookies

The tenderiser.ai website uses only strictly necessary cookies (session and security). We do not use advertising cookies, analytics cookies, or third-party trackers on this site. If we ever add analytics we will ask for your consent first and update this policy.

7. Your rights

Under GDPR you can:

  • Access a copy of the personal data we hold about you.
  • Correct inaccurate or incomplete data.
  • Delete your data ("right to erasure"), subject to any legal retention we are required to honour.
  • Export your data in a common machine-readable format.
  • Object to or restrict specific processing.
  • Withdraw consent at any time where processing is based on consent.
  • Lodge a complaint with your local data protection authority. For customers in Slovenia, that's the Information Commissioner (Informacijski pooblaščenec).

To exercise any of these rights, contact us via the support page. We will respond within one month.

8. Retention

  • Contact-form messages: kept for up to 24 months, then deleted.
  • Account data: kept for the life of the account, then deleted within 30 days of account closure — unless we are required to keep it longer under Slovenian law (e.g. invoicing records for tax purposes).
  • Catalogue and tender data: kept while your account is active; deleted on request or within 30 days of account closure.

9. Changes to this policy

If we change this policy we will update the "Last updated" date at the top. For material changes, we will email customers with active accounts before the change takes effect.

10. Contact

Questions, data requests, or anything else related to privacy: use the support page. Postal mail: Agentic d.o.o., Dunajska cesta 20, Ljubljana, Slovenia.