Privacy Policy

Last updated 2026-10-27. This policy explains how TendifyAI ("we", "us") handles personal data when you use the TendifyAI website (tendifyai.com) and app (app.tendifyai.com). We follow India's Digital Personal Data Protection Act, 2023 ("DPDP Act").

1. Who we are

TendifyAI is software for Indian businesses that sell to the government. For data you give us about yourself, we are the data fiduciary. For data your business puts into its workspace (for example its customers' and staff's details), your business decides how it's used and we process it on your behalf.

2. What we collect

• Account details: name, email address, phone number, password (stored only as a secure hash), and your role in the workspace.
• Business records you add: company details (such as GSTIN, PAN, Udyam number, address), tenders, quotations, orders, delivery challans, invoices, payments, and documents uploaded to the Knowledge Vault. These can contain personal data of people your business deals with.
• Usage and security data: sign-in times, IP address, browser and device type, and an activity log of actions in your workspace (who created, edited or issued what, and when).
• Website data: messages sent through our contact form, and website analytics (see section 7).

We don't sell personal data, and we don't use your business records to advertise to you.

3. Why we use it

• To create and run your account and workspace, and to sign you in securely.
• To provide the features you use: reading tenders, checking eligibility, preparing documents, quotations, challans, billing and reports.
• To send service emails: verification codes, invitations, password resets and important notices.
• To keep the service secure, prevent misuse, fix problems and improve the product.
• To reply to messages you send us.
• To meet legal obligations.

We process your data on the basis of your consent when you sign up or contact us, and for the legitimate uses the DPDP Act allows.

4. AI processing

When you ask TendifyAI to read a document (for example a tender, quotation or certificate), the text of that document is sent to an AI provider — Anthropic first, and Google or NVIDIA only as a backup if Anthropic is unavailable — only to extract the details you asked for. We use their developer API services, under their terms for API customers. Anthropic's terms say it doesn't train its models on API data. We currently use Google's free Gemini API tier, under which Google may use submitted content to improve its products and human reviewers may read it; we plan to move to a paid tier, which doesn't allow this. AI results are checked against the source document, and anything not proven is marked "please check" for a person to confirm.

5. Who processes data for us

We use these service providers to run TendifyAI. They may process data outside India, under their own security and contractual commitments:

• Supabase — database and file storage
• Render — application servers
• Vercel — website and app hosting
• Cloudflare — domain and DNS
• Resend — sending emails
• Anthropic, Google and NVIDIA — AI reading of documents you submit (Google and NVIDIA only as backups)
• Google Analytics — website visit statistics (public website only)

We may also share data if the law requires it, or to protect the rights and safety of our users or the public.

6. Who can see your workspace

Only members of your workspace, according to the roles your owner or admin gives them. Each workspace is kept separate from every other. Issued documents such as challans are kept as issued; corrections create a new version so the history stays accurate.

7. Cookies and analytics

The app stores a sign-in token in your browser to keep you signed in. The public website uses Google Analytics to count visits and see which pages are useful; Google Analytics sets its own cookies. The app itself does not use Google Analytics. You can block cookies in your browser settings, though signing in to the app needs local storage.

8. How long we keep data

• Workspace data is kept while your account is active.
• When an owner deletes a workspace, it can be restored for a limited period shown at the time of deletion, and is then permanently removed.
• Backups and logs are kept for a limited time and then deleted on a rolling basis.
• Contact-form messages are kept as long as needed to reply and follow up.
• We keep records longer only where the law requires it (for example tax records).

9. Security

Data travels over encrypted (HTTPS) connections. Passwords are stored as secure hashes, access is limited by role, and files are kept in private storage. No system is perfectly secure; if a breach affects your personal data, we will inform you and the Data Protection Board of India as the DPDP Act requires.

10. Your rights

Under the DPDP Act you can:

• ask what personal data we hold about you and how it's used;
• ask us to correct, complete or update it;
• ask us to erase it, unless we must keep it by law;
• withdraw consent (this may mean we can no longer provide the service);
• nominate someone to exercise these rights for you;
• raise a grievance with us, and then with the Data Protection Board of India if it isn't resolved.

An owner can also download all workspace data, or delete the workspace, from My Account in the app.

11. Children

TendifyAI is a business tool and isn't meant for anyone under 18. We don't knowingly collect children's data.

12. Contact and grievances

For any privacy question, request or complaint, use our contact form and mention "Privacy" in your message. We'll reply as soon as we can, and within the time the law requires.

13. Changes

We'll update this page if our practices change, and change the date at the top. If a change is significant, we'll tell signed-in users in the app or by email.