Privacy Policy

Effective date: 2 September 2026.

This Privacy Policy explains how Tenderra Pty Ltd (ABN 12 701 651 363) collects, uses, discloses, stores and protects personal information when you use tenderra.com.au, app.tenderra.com.au, Tenderra communications and related support services.

1. Who this policy covers

Tenderra is designed primarily for organisations and authorised business users. This policy covers account holders, invited team members, prospective customers, website visitors and people whose personal information is included in material submitted to Tenderra.

For account, billing, security and support information, Tenderra determines why and how that information is handled. For documents and other content uploaded by a customer, the customer generally decides what to submit and why; Tenderra processes that content to provide the service.

2. Information we collect

Depending on how you use Tenderra, we may collect:

• Identity and account information: name, work email address, login identifiers, authentication status, organisation membership and role.
• Organisation information: legal name, ABN, industry, services, capabilities, jurisdictions, registrations, insurance details, workforce information and other Company Brain entries.
• Customer content: tender notes, bid drafts, uploaded evidence, extracted facts, source references, prompts, instructions, review decisions and exports.
• Billing information: plan, subscription status, transaction identifiers and limited billing metadata. Payment card details are handled by our payment provider and are not stored by Tenderra.
• Technical and usage information: IP address, browser and device information, timestamps, security events, request logs, feature usage and diagnostic data.
• First-party acquisition measurement: browser-tab session identifiers, campaign labels, device category, page visits, selected clicks and scroll depth, linked where available to operational account and billing events. We do not send tender documents, Company Brain content or payment-card details to advertising platforms.
• Communications: support requests, emails, feedback, sales enquiries and records needed to resolve an issue.

Uploaded evidence may contain personal or sensitive information about employees, customers, referees or other people. Customers must only submit information they are authorised to use and should remove unnecessary personal or sensitive information before upload.

3. How we collect information

We collect information directly from you, from an authorised user in your organisation, through authentication and billing providers, automatically through service logs and security controls, and from tender sources where opportunity information is lawfully made available or licensed for Tenderra's use.

4. Why we use information

We use information to:

• create and secure accounts, enforce organisation and tenant isolation, and manage authorised access;
• provide tender discovery, fit assessment, Company Brain, Evidence Brain, bid workspaces, exports and alerts;
• process subscriptions, entitlements, usage limits and billing support;
• generate AI-assisted analysis and draft content requested by an authorised user;
• operate, monitor, troubleshoot, protect and improve Tenderra;
• understand website acquisition and campaign performance using first-party measurement and aggregate advertising reports;
• communicate about service, security, billing, support and material product changes;
• comply with law, respond to lawful requests, prevent fraud or misuse, and establish or defend legal claims.

We do not sell personal information or use customer evidence to build advertising profiles.

5. AI-assisted processing

When an authorised user requests an AI-assisted function, Tenderra may send relevant instructions and selected customer content to an enterprise or API-based AI provider. Tenderra currently uses OpenAI API services. OpenAI states that API inputs and outputs are not used to train its models by default unless the customer explicitly opts in. Provider retention and security controls remain subject to the provider's terms and Tenderra's configuration.

AI outputs can be incomplete or wrong. Tenderra separates verified facts, user-provided facts, inferred material and AI draft text, and requires human review. Tenderra does not automatically submit tenders or make the final bid/no-bid decision for a customer.

6. Service providers and disclosures

We may disclose or make information available to providers that help operate Tenderra, including:

• identity and authentication providers, including Auth0/Okta;
• application hosting, networking and database providers, including Railway;
• private object storage and infrastructure providers, including Amazon Web Services;
• AI service providers, including OpenAI;
• payment and subscription providers, including Stripe;
• email, monitoring, security, professional advisory and customer-support providers;
• Meta Platforms, as a source of aggregate advertising performance reports when connected by an authorised administrator. This feature does not activate Meta Pixel or remarketing.

We may also disclose information where required or authorised by law, to investigate suspected fraud or security incidents, during a corporate transaction subject to appropriate safeguards, or with your direction or consent.

7. Overseas processing

Some service providers may process information outside Australia, including in the United States and other countries where they or their subprocessors operate. Where Australian privacy law applies, Tenderra takes reasonable steps appropriate to the circumstances to require service providers to protect personal information and uses information only for the purposes described in this policy.

8. Security and tenant separation

Tenderra uses technical and organisational safeguards designed for the nature of the information handled, including authenticated access, organisation-level separation, private storage, encryption provided by infrastructure services, restricted service credentials, logging and access controls. No internet service is completely risk-free, and customers should use strong authentication, restrict team access and avoid uploading unnecessary information.

If an eligible data breach is likely to result in serious harm, Tenderra will assess and respond in accordance with applicable Notifiable Data Breaches requirements.

9. Retention and deletion

We retain information for as long as reasonably needed to provide the service, maintain security and audit records, meet contractual and legal obligations, resolve disputes and support legitimate business records. Retention periods differ by data type. Deleted information may remain temporarily in protected backups or logs before scheduled expiry. We may retain limited billing, fraud-prevention or legal records after an account closes where required or reasonably necessary.

10. Access, correction and deletion requests

You may request access to or correction of personal information Tenderra holds about you, or request deletion where applicable, by emailing privacy@tenderra.com.au. We may need to verify your identity and authority. Some information cannot be deleted immediately where retention is required by law, security, billing, dispute or backup obligations.

For customer content controlled by an organisation, requests may need to be directed to that organisation first.

11. Cookies and session technology

Tenderra uses essential cookies, secure session tokens and similar technology needed for sign-in, account security, preferences and reliable service operation. Blocking essential cookies may prevent authentication or other functions from working.

Tenderra uses first-party acquisition measurement to understand visits, signup clicks, scroll depth, account creation and payments. A random browser-tab session identifier lasts up to 30 minutes and can pass between our website and application. We record campaign labels and a mobile/desktop category; we do not store raw IP addresses in acquisition events or send business documents to advertising platforms. Do Not Track and Global Privacy Control stop optional browser measurement. Operational account and billing records remain necessary to provide the service.

Meta Pixel is not loaded. Where connected by an authorised administrator, Tenderra reads aggregate advertising performance from Meta to display spend, impressions and clicks privately. Meta applies its own reporting and attribution rules.

12. Children

Tenderra is a business service and is not directed to children under 18. Do not create an account for, or intentionally submit personal information about, a child unless the information is lawfully required for a legitimate tender response and you have authority to provide it.

13. Privacy questions and complaints

Send privacy questions or complaints to privacy@tenderra.com.au. Please include enough information for us to investigate. We will acknowledge and respond within a reasonable period. If you are not satisfied, you may be entitled to contact the Office of the Australian Information Commissioner.

14. Changes to this policy

We may update this policy as Tenderra, its providers or legal obligations change. We will publish the updated date and provide reasonable notice of material changes where appropriate.

15. Company details

Tenderra Pty Ltd
ABN 12 701 651 363
Privacy: privacy@tenderra.com.au
General support: support@tenderra.com.au