Privacy Policy

Last updated: 2 July 2026 · Effective date: 2 July 2026

This Privacy Policy explains how TenderAI (“TenderAI”, “we”, “us”, or “our”) collects, uses, discloses, and safeguards your information when you use our website at tenderai.co.zw, our web application at app.tenderai.co.zw, and any related services (collectively, the “Service”). We are committed to protecting your privacy and handling your data in an open and transparent manner.

We process personal information in accordance with Zimbabwe's Data Protection Act [Chapter 11:12] and, where applicable, comparable international data-protection standards. By using the Service, you agree to the collection and use of information in accordance with this Policy.

1. Who We Are (Data Controller)

TenderAI is the data controller responsible for your personal information. For any privacy-related matter, you can reach our data protection contact at privacy@tenderai.co.zw.

2. Information We Collect

The personal information we ask for, and the reasons why, are made clear to you at the point we request it. We collect the following categories of information:

  • Account information: your name, email address, phone number (including your WhatsApp number, if provided), password (stored only as a secure hash), and profile preferences.
  • Company & tender data: PRAZ certificates, tax clearance certificates (ITF263), CR14/CR6 and company registration documents, company profiles, past bids, pricing information, and tender notices you upload or paste into your secure Vault.
  • Generated content: the proposals, compliance analyses, and documents produced for you through the Service.
  • Payment information: plan selection, transaction references, and billing history. Card and mobile money credentials (such as full card numbers or EcoCash PINs) are handled directly by our payment partners — we never see or store them.
  • Usage & technical data: log data, device and browser type, IP address, pages visited, feature usage, and diagnostic information used to operate and improve the Service.
  • Communications: messages you send to our support team and your notification preferences.

3. How We Use Your Information

We use the information we collect to:

  • Provide, operate, and maintain the Service and your account;
  • Generate your ZPPA-compliant proposals and compliance checks using AI;
  • Process payments and manage your subscription or credits;
  • Send compliance/document-expiry alerts and tender deadline reminders via WhatsApp or email;
  • Provide customer support and respond to your enquiries;
  • Improve, personalise, and expand our features, and analyse how the Service is used;
  • Detect, prevent, and address fraud, abuse, security incidents, and technical issues;
  • Comply with legal obligations and enforce our Terms of Service.

4. Lawful Basis for Processing

We rely on the following legal bases to process your personal information:

  • Performance of a contract — to deliver the Service you sign up for;
  • Consent — for optional communications such as WhatsApp notifications and marketing, which you can withdraw at any time;
  • Legitimate interests — to secure, maintain, and improve the Service;
  • Legal obligation — where we are required to retain or disclose information by law.

5. AI Data Usage Guarantee

TenderAI explicitly guarantees that your proprietary company data, pricing strategies, and generated proposals are never used to train public or third-party foundation AI models. Your content is processed through enterprise-grade AI APIs operating under zero-retention terms for model training. Your data is used only to produce outputs for you.

6. How We Share Information

We do not sell your personal information. We share it only with trusted service providers (“processors”) strictly to operate the Service, including:

  • Infrastructure & database hosting (e.g. Supabase) for storage and authentication;
  • AI providers (e.g. Anthropic and OpenAI) to generate proposals and analyses;
  • Payment gateways (e.g. Paynow, EcoCash, Stripe) to process transactions;
  • Messaging providers (e.g. the WhatsApp Business API and our email provider) to send notifications.

These providers are bound by contractual confidentiality and data-protection obligations. We may also disclose information where required by law, court order, or a lawful request by a competent authority, or to protect the rights, property, and safety of TenderAI, our users, or the public.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. Vault documents and generated proposals are retained until you delete them or close your account. Following account closure, we delete or anonymise your data within a reasonable period, except where we must retain certain records (for example, transaction records) to comply with legal, accounting, or tax obligations.

8. Security

We use administrative, technical, and physical safeguards to protect your information, including 256-bit TLS encryption in transit and AES-256 encryption at rest via our secure infrastructure (Supabase), hashed passwords, access controls, and audit logging of administrative actions. No method of transmission or storage is 100% secure, but we work continuously to protect your data and will notify you and the relevant authority of a material breach as required by law.

9. Your Rights

Subject to applicable law, you have the right to:

  • Access the personal information we hold about you;
  • Request correction of inaccurate or incomplete information;
  • Request deletion of your information (“right to be forgotten”), subject to legal retention requirements;
  • Object to or restrict certain processing;
  • Withdraw consent for optional communications at any time;
  • Request a portable copy of the data you provided to us;
  • Lodge a complaint with the Data Protection Authority (the Postal and Telecommunications Regulatory Authority of Zimbabwe, POTRAZ).

To exercise any of these rights, contact us at privacy@tenderai.co.zw. We will respond within the timeframe required by applicable law.

10. Cookies & Tracking

We use essential cookies and similar technologies to keep you signed in, remember your preferences, and understand how the Service is used. You can control cookies through your browser settings, though disabling essential cookies may affect core functionality such as authentication.

11. Children's Privacy

The Service is intended for businesses and users aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can remove it.

12. International Transfers

Some of our service providers may process data on servers located outside Zimbabwe. Where this occurs, we take reasonable steps to ensure your information receives an adequate level of protection consistent with this Policy and applicable law.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the revised version on this page and update the “Last updated” date above. Material changes may also be communicated to you by email or in-app notice. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

14. Contact Us

If you have questions or require more information about this Privacy Policy, or wish to exercise your rights, contact us at privacy@tenderai.co.zw.