Privacy Policy

1. About us

TenderFinder is a registered business name operating in Australia (ABN 52 661 243 947). We operate the website tenderfinder.com.au (the Platform), which aggregates publicly available Australian government tender information and provides AI-assisted bid response tools to help small businesses discover and apply for government procurement opportunities.

We are not affiliated with the Australian Government, the Department of Finance, AusTender, or any state or territory procurement body.

For all privacy enquiries, contact our Privacy Officer at hello@tenderfinder.com.au.

2. Scope of this policy

This Privacy Policy explains how TenderFinder collects, holds, uses, and discloses personal information in accordance with the Privacy Act 1988 (Cth) (the Privacy Act) and the Australian Privacy Principles (APPs) contained in Schedule 1 of that Act. This policy applies to all personal information we collect through the Platform, our emails, and any other interaction you have with us.

3. Information we collect

We collect personal information in the following categories:

3.1 Tender alert subscriptions

• Email address — used to send you tender alert emails matching your stated preferences.
• Business type and preferences — optional information you provide to help us tailor alerts to relevant tenders.

3.2 Bid Response Generator

• Contact name and email address — used to deliver your generated document and send a payment receipt.
• Business name and ABN — used to personalise your bid response document. Your ABN is never used for credit checking or shared with third parties.
• Business contact details — phone number, postal address, and website, as provided by you. Used solely within your bid document.
• Business description and capability statement — including services offered, past projects, key personnel, and qualifications. Used to generate the content of your bid response.
• Uploaded documents — tender documents, specifications, or supporting materials you upload to improve bid quality. Text is extracted for AI processing; raw uploaded files are not permanently stored.

3.3 Payment information

Card payments are processed securely by Stripe, Inc. We do not collect, transmit, or store your credit card number, CVV, or full card details on our servers. Stripe provides us with a payment confirmation and a transaction reference only. Stripe's handling of your payment data is governed by Stripe's Privacy Policy.

3.4 Usage and analytics data

We use Google Analytics (operated by Google LLC) to collect anonymised information about how visitors use the Platform. This may include pages visited, search terms entered, referring URLs, approximate geographic region, device type, and session duration. This data is collected via cookies and similar technologies and is used in aggregated, non-personally-identifiable form to understand usage patterns and improve the Platform. See Section 8 for details on cookies.

3.5 Automatically collected technical data

Our servers may automatically log your IP address, browser type, and the date and time of requests. These logs are used for security monitoring and are retained for up to 90 days.

4. How we use your information

We use personal information only for the purposes for which it was collected, or purposes you would reasonably expect, including:

• To send you email alerts about newly published Australian government tenders that match your nominated preferences (email subscribers).
• To generate a personalised AI bid response document using the business details you provide in the bid form.
• To process your payment via Stripe and deliver your generated document to your email address.
• To send transactional emails — payment receipts, document delivery, and service notifications — via our email delivery provider, Resend.
• To analyse aggregate usage patterns via Google Analytics and improve the Platform's features and content.
• To investigate and resolve technical issues or security incidents.
• To comply with our obligations under Australian law, including taxation and record-keeping requirements.

We will not use your personal information for direct marketing unrelated to TenderFinder, nor will we sell, rent, or share it with third parties for their own marketing purposes.

5. AI processing — Anthropic Claude

Bid responses are generated using Anthropic's Claude AI. When you submit a bid generation request, the following information is transmitted to Anthropic's API:

• The tender title, description, agency, and category sourced from AusTender.
• Your business details as entered in the bid form (business name, ABN, services, past projects, key personnel, and qualifications).
• Text extracted from any tender documents or supporting materials you upload.

Anthropic processes this data in accordance with their Privacy Policy. We recommend you do not include sensitive personal information (such as health information, financial account details, or identity document numbers) in any field submitted to the bid generator. By using the Bid Response Generator, you acknowledge and consent to the processing of your submitted business information by Anthropic.

6. Disclosure of personal information

We disclose personal information to the following third-party service providers only to the extent necessary to operate the Platform:

• Stripe, Inc. (United States) — payment processing. Stripe handles your card details under PCI-DSS compliance. We share only the information necessary to initiate and confirm a transaction.
• Anthropic, PBC (United States) — AI bid response generation. We share the business details and tender information you provide to generate your document.
• Resend, Inc. (United States) — transactional email delivery. Your name and email address are passed to Resend to send alerts, receipts, and document deliveries. Resend does not use your data for its own marketing. See Resend's Privacy Policy.
• Google LLC (United States) — analytics via Google Analytics. Anonymised, aggregated usage data is collected via cookies. No personally identifiable information is shared with Google Analytics. See Google's Privacy Policy.
• Replit, Inc. (United States) — cloud hosting infrastructure. Our servers and database run on Replit's platform. Replit does not access your personal data except as necessary for infrastructure operations.

All third-party providers are required to handle personal information in accordance with applicable privacy laws. Where personal information is transferred to organisations outside Australia (APP 8), we take reasonable steps to ensure equivalent protections are in place.

7. Data retention

• Email alert subscribers — your email and preferences are retained until you unsubscribe or submit a deletion request. You can unsubscribe via the link in any alert email.
• Bid response data — business details submitted for bid generation are retained for up to 90 days to allow document re-download. After 90 days, the data is permanently deleted from our database.
• Uploaded documents — extracted text is stored within the bid record and deleted with it. Raw uploaded files are not permanently stored.
• Payment transaction records — retained for 7 years as required by the Income Tax Assessment Act 1997 (Cth) and Australian taxation law. These records contain minimal personal data (email address and transaction reference only).
• Server logs — IP addresses and request logs are retained for up to 90 days for security monitoring.
• Google Analytics data — data retention in Google Analytics is set to 14 months. Data is aggregated and anonymised.

8. Cookies and tracking technologies

TenderFinder uses the following categories of browser storage and cookies:

• Essential (functional) storage — we use browser localStorage to remember in-session preferences, such as search filters. No personal information is stored in localStorage beyond your current session preferences.
• Analytics cookies (Google Analytics) — Google Analytics uses first-party cookies (including _ga and _ga_*) to distinguish users and measure site traffic. The data collected is anonymised before being sent to Google. You can opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on, or by enabling "Do Not Track" in your browser.

We do not use advertising cookies, remarketing tags, or cross-site tracking technologies.

9. Security

TenderFinder implements appropriate technical and organisational security measures to protect personal information against unauthorised access, loss, alteration, disclosure, or destruction. These measures include:

• Encryption of all data in transit using TLS (HTTPS).
• Encrypted database storage with access controls.
• No storage of payment card data on our servers.
• Access to production systems restricted to authorised personnel only.

In the event of a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act.

10. Your rights under the Australian Privacy Principles

Under the Privacy Act 1988 (Cth) and the APPs, you have the following rights:

• Access (APP 12) — request a copy of the personal information we hold about you.
• Correction (APP 13) — request that we correct inaccurate, outdated, or incomplete personal information.
• Unsubscribe — opt out of tender alert emails at any time via the unsubscribe link in any email or by contacting us directly.
• Deletion — request that we delete your personal information. We will action deletion requests within 30 days, subject to our legal retention obligations (e.g. payment records required by tax law cannot be deleted ahead of schedule).
• Complaint — lodge a complaint about our handling of your personal information with the OAIC at www.oaic.gov.au or by calling 1300 363 992 if you are not satisfied with our response.

11. How to request data deletion

To request deletion of your personal information, email us at hello@tenderfinder.com.au with the subject line "Data Deletion Request" and include:

• The email address associated with your TenderFinder account or subscription.
• If requesting deletion of bid data, the approximate date of your bid generation and the tender title (if known).

We will confirm receipt within 5 business days and complete the deletion within 30 days. We will notify you when deletion is complete. Where we are unable to delete certain information due to a legal obligation, we will explain which data is retained and why.

12. Links to other websites

The Platform may contain links to third-party websites, including AusTender (tenders.gov.au) and government agency websites. This Privacy Policy does not apply to those websites. We encourage you to review the privacy policies of any external sites you visit.

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The updated policy will be published on this page with a revised effective date. We encourage you to review this page periodically. For material changes, we will notify active email subscribers.

14. Contact us