Privacy

Short, because the product does little worth writing at length about. The bureau reads public procurement notices and the profile you give it. It has no interest in anything else.

What is stored

  • Your account: email address, name, and a hashed password. Passwords are never stored in a recoverable form.
  • Your company profile: the overview, disciplines and past projects you enter, plus an optional address for emailed reports.
  • Your corpus: the public procurement notices you have scraped, chunked and embedded — held against your account and nobody else's.
  • Your runs: search history, tender assessments, rankings and the credit ledger explaining every charge.

Where it is stored

  • On self-hosted infrastructure, in a PostgreSQL database that is not exposed to the internet.
  • Embeddings are computed locally on that same machine. Your profile text is not sent to a third-party embedding service.

What leaves the server

  • Notice text and your company profile are sent to Anthropic's API when — and only when — you start an analysis run. That is the one outbound transfer of your content, and it is the thing you are charged for.
  • Emails, when you ask for one, go through Resend. The report PDF is the attachment.
  • Nothing else is transmitted. There is no analytics script, no advertising pixel, and no third-party font or asset request on any page.

Isolation between accounts

  • Every stored row carries an owner. Corpus, searches, profiles, presets and analyses are per-account by construction, not by filtering after the fact.
  • The practical cost of that choice is that each account scrapes and embeds public notices for itself rather than sharing a pool. That is deliberate.

Deletion

  • Deleting your account removes your sessions, corpus, searches, profiles and analyses with it — the database enforces this, rather than relying on a cleanup job.
  • Ask, and it will be done.