Privacy notice

19 Beresford Road Holdings Limited, registered in England and Wales, no. 17549743. Registered office: Flat B, 19 Beresford Road, London, N5 2HS.

We’re the controller of your information: we decide how it’s used. Contact us about anything in this notice at harry@tenderwave.co, or by post to our registered office.

We keep what you type (a website or company name), the text we read from that website, the company’s public Companies House record (such as its name, number, status, industry codes and the area of its registered office), the profile and matches we build, any changes you make to the profile, and the matches you rate.

A website-reading service reads the site for us, and AI models read its text to build the profile and judge the matches. We take email addresses and phone numbers out of the text before any model sees it, and we don’t keep them.

To stop abuse, we keep a scrambled form of your IP address (a keyed hash), never the address itself, and count how many scans come from it each day.

We use this information to make your shortlist, to stop abuse, and to improve our matching: we look at scans and ratings to find where it goes wrong. Each of these is in our legitimate interests, and making your shortlist is in yours.

If someone scans the same website within 7 days, we show them a copy of the latest profile and matches, including changes made to the profile, so the site isn’t read twice. They don’t see who scanned it before or how they rated the matches.

We delete scans, with their ratings and IP hashes, after 30 days, and daily counts within two days. We keep a scan longer only if you become a founding member from it (see below), or if you chose a plan from it before we took payments: we keep that scan for up to 12 months, so we can follow it up.

Stripe takes your payment and collects your name, email address, billing address and card details; we never see your card details. Stripe also uses some of this information for its own legal duties, such as preventing fraud, under its own privacy notice.

We receive a record of the payment (the plan, the amount, the date and Stripe’s reference for you) and link it to the scan you joined from. We use your name and email address to send your alerts and run your membership. If we talk on a call, we keep notes of what you tell us; we don’t record a call without asking you first.

We need this information to provide the membership you’ve paid for (our contract with you), and the law requires us to keep accounting records.

We keep your details and the scan you joined from while you’re a member, and delete them within 12 months after your membership ends. Payment records are the exception: we keep them for six years after the end of the financial year they fall in, as the law requires.

We write to limited companies and LLPs that recently won a public contract and are small by their latest accounts. We use the company’s name and the contract it won, from the public award notice; its public Companies House record; and the contact email address the company gave on its award notice or, failing that, a general address such as info@ on its own website. An award-notice address is sometimes a person’s work address. Each email says where we found the address.

Before we write, we check that the address’s domain can receive email (a public lookup; nothing is sent to it) and build a free scan of the company from its website. We keep a record of what happens: when we wrote, and whether you replied, the email bounced or you unsubscribed.

Our system chooses who to write to, and an AI model writes a few lines of each email from the company’s profile and the contract it won, never from your address. Emails that pass all our checks send themselves; a person reads the rest before they go, and reads every reply. We send at most two emails, and stop as soon as you reply, unsubscribe or tell us to.

We do this because it’s in our legitimate interests, and we think yours, to tell businesses about tenders they could win. We’ve weighed this against your interests in a written assessment, which you can ask to see.

We keep the address while we’re in touch and for 12 months after our last email, and the scan for 30 days. If you unsubscribe, we delete the address and keep only a one-way scrambled form of it (a hash) and the company number, so we never write to you again.

Public tender and award notices sometimes name a contact at the buyer or the supplier, with a work email address or phone number. We copy notices as Find a Tender, Contracts Finder and Public Contracts Scotland publish them, under the Open Government Licence, to show tenders, link to them and learn who wins what. That’s in our legitimate interests and those of the businesses we help.

We take contact details out before an AI model reads a notice, and we don’t show them in shortlists. The only ones we use are suppliers’ addresses, for the emails described above. We keep notices for as long as we run TenderWave, because past contracts are part of how we match.

We don’t use cookies to track you or for advertising, so we don’t ask you to accept any.

The free scan uses Cloudflare Turnstile to check that a person is using it. It reads signals such as your IP address and browser, and may store a little information in your browser for that check, which is needed to stop abuse. Cloudflare also uses these signals to improve its bot detection, under its own privacy notice.

Our hosting provider sees your IP address when it serves a page, and keeps it in its logs for a short time. Signing in to our admin pages sets a cookie that keeps you signed in; only we use them.

We use these services to run TenderWave. They act only on our instructions, except where we say otherwise:

• Vercel (hosting the website, which runs in London)
• Supabase (our database, in London)
• Trigger.dev (background jobs, in the EU)
• Anthropic (Claude, which reads websites and tender notices to build profiles, and writes lines of our emails)
• Google (Gemini, which compares texts and judges how well tenders fit a profile; and Google Workspace, our email)
• Firecrawl (reading websites, and searching the web for a company’s website)
• Cloudflare (Turnstile, which checks that a person is using the scan; it also uses what it sees to improve its bot detection)
• Stripe (payments; it also uses some information for its own legal duties, such as preventing fraud)

Several of these companies are based in the US, and some information reaches them there. When it does, it’s protected by the safeguards UK law requires: the UK–US data bridge for companies certified under it, or otherwise the UK’s International Data Transfer Addendum in our contract with them.

We don’t sell personal information. We share it with no one else, unless the law requires us to or we sell our business, when the buyer would have to keep to this notice.

Our system decides which tenders to show a business and which businesses to email, with the help of AI models. These are decisions about businesses, and none has a legal or similarly significant effect on anyone. If you’d like a person to look at one, write to us.

You can object at any time to our using your information for our legitimate interests, and we’ll stop unless we have a compelling reason to carry on. We’ll always stop emailing you when you ask. Write to harry@tenderwave.co, or reply “stop” to any of our emails.

You can ask for a copy of the information we hold about you, and ask us to correct it, delete it, limit how we use it, or give it to you in a form you can take elsewhere. It’s free, and we’ll answer within a month. Write to harry@tenderwave.co.

Tell us first, at harry@tenderwave.co or by post to our registered office. We’ll acknowledge your complaint within 30 days, look into it and tell you what we’ve done. If you’re still unhappy, you can complain to the Information Commissioner’s Office at ico.org.uk.

We’ll update this notice when what we do changes. The date at the top shows the latest version, and we’ll email founding members about changes that affect them.