Privacy policy

1. Information we collect

1.1 Information you provide

We may collect information you provide directly, including:

• Account information: your name, email address, password and email-verification status. Passwords are stored in hashed form rather than as readable text.
• Business-profile information: your business name, description of what your business supplies or can deliver, and any other profile details you choose to provide.
• Contact and alert information: your email address and verified WhatsApp number, email, WhatsApp and push alert choices, your consent, verification and opt-out status, and other account-level notification settings.
• Procurement preferences and activity: categories, buyers and locations you follow, suppliers you watch, tracked tenders, search keywords and filters, saved and default searches, alert subscriptions, AI matches and your read, unread or dismissal choices.
• Team information: organization membership, seat assignments, roles, permissions and invitations where a plan supports team access.
• Billing information: your selected plan, subscription status, billing cycle, transaction references, invoices, receipts, refund records and limited payment details returned by payment providers. For MMG payments this includes your wallet number and any consent to save it for renewal requests. For bank transfers it may include payer details, a bank transaction reference and an optional receipt you upload. We do not receive or store your complete card number or card-security code.
• Push subscription information: when you enable notifications, we store the browser subscription address, keys needed to encrypt and authenticate notifications, a browser and device label, and subscription or revocation timestamps. We also keep delivery-attempt and provider-response information.
• Communications: information in support requests, correction or removal requests, feedback, surveys and other messages you send us.
• Content you submit: tender information, notes, replies, mentions, files and other material you provide through publishing and collaboration features. Tender submissions include the buyer's name, your authority to publish, contact details, requirements, deadlines, documents and review history.

Private notes and team discussions: we store notes, replies, mentions, discussion preferences and read status attached to tracked tenders and saved searches. Private notes are visible only to their author. Team discussions are shared with authorised members of the relevant Business Profile. Account owners may moderate shared discussions but cannot view another user’s private notes. Discussion notifications use your account delivery preferences and do not include the note body.

Removing a tracked tender or saved search preserves its notes for recovery. Removed searches can be restored from the Notes archive. Permanently deleting an account, Business Profile or source record removes associated notes according to the applicable deletion process. Shared contributions may remain attributed to a former team member after that member leaves; private notes are removed when their author’s account is permanently deleted.

Google sign-in: if you choose to sign in with Google, we receive your Google account identifier, name, email address, email-verification status and, when available, profile picture. We use this information to authenticate you, create or connect your tenders.gy account, display your account identity and help protect account access. We may store a copy of your profile picture in our private application storage. We request only the openid, email and profile sign-in scopes. We do not request access to your Gmail messages, Google Drive files, contacts or calendars. We do not store Google access or refresh tokens as part of the sign-in connection.

Google sign-in information is used for account access and related account administration, not to build advertising audiences or train our tender-matching AI. It is distinct from the optional Google Analytics and Google Ads technologies described below. You can disconnect Google in Passwords & sign-in methods when another sign-in method is available, or request deletion as described in section 14. Disconnecting Google does not itself delete your tenders.gy account or your Google account.

1.2 Information collected automatically

When you use the Service, our systems may automatically collect:

• IP address, browser type, operating system, device type and user-agent information;
• access times, pages or routes viewed, referring pages, links selected and feature interactions;
• authentication, session, security, error and diagnostic logs; and
• cookies and similar technologies used to keep you signed in, protect forms, remember preferences and operate the Service.
• information collected through the Meta Pixel about visits and selected actions on tenders.gy, such as pages viewed and account-registration or subscription events, together with browser and device information, IP address, referring URL and identifiers stored in cookies or similar technologies.
• if Google Analytics is enabled, information about pages viewed, sessions and interactions with the Service, together with approximate location, browser and device information and identifiers stored in first-party cookies such as _ga. Your browser also sends information such as the page URL and IP address to Google when its tag loads.
• if Google Ads tracking is enabled, information about visits and selected actions on tenders.gy, such as account registration or subscription events, together with page URLs, browser and device information, ad-click information and identifiers stored in cookies or similar technologies.

1.3 Information from other sources

We may receive information from:

• payment providers, including Whop, such as subscription status, payment confirmation, billing country and transaction identifiers;
• buyers and authorized contributors that provide tender notices, procurement documents or organization information;
• public procurement sources, including websites, portals, newspapers, documents and other public notices; and
• service providers that help us detect abuse, deliver communications, host the Service or maintain its security.

2. Personal information in procurement records

Tender notices, bid openings, awards and source documents may contain business contact information about people acting in a professional capacity, such as a buyer contact’s name, title, work email address or telephone number, or a supplier’s name, bid amount or contract-award value. We organise and connect relevant public records into searchable tender histories and supplier profiles. We collect and display this information where it is included in a public procurement record or supplied by an authorized party and is relevant to understanding or responding to the opportunity.

We do not use public procurement contact information to create personal consumer profiles. If you believe personal information in a listing is inaccurate, inappropriate or should be removed, contact hello@tenders.gy and include the listing URL and supporting details.

3. How we use information

We may use personal information to:

• create, verify, secure and administer accounts;
• provide tender search, filtering, saved preferences, award information, personal and shared saved searches and team tools;
• build and maintain your business profile;
• match your business with potentially relevant procurement opportunities;
• send requested email, WhatsApp and push alerts about AI matches, saved-search matches, followed opportunities, tracked-tender updates, deadlines and supplier activity, and manage delivery failures and opt-outs;
• process subscriptions, confirm payments and maintain billing records;
• respond to support, privacy, correction and removal requests;
• understand how the Service is used and improve its performance, usability and reliability;
• use Google Analytics, when enabled, to measure traffic and understand how visitors use the Service;
• use Google Ads tracking, when enabled, to measure ad clicks and conversions, assess campaign performance and create or exclude audiences for tenders.gy advertising;
• measure the effectiveness of our advertising, understand actions taken after someone sees or clicks an ad, and show or exclude relevant audiences from tenders.gy advertisements on Meta platforms using the Meta Pixel;
• develop, test and evaluate new features and matching methods;
• detect, investigate and prevent fraud, abuse, security incidents and violations of our Terms of service;
• protect our users, rights, property and Service; and
• comply with legal obligations and establish, exercise or defend legal claims.

4. AI-powered features

We use OpenAI’s API to help extract, describe, categorize and compare procurement notices and documents. Those materials may contain professional contact details published in the original notice. For AI-powered matching, we may send relevant business-profile information, selected categories, preferences and tender information to OpenAI to assess whether an opportunity fits your business.

We send information needed for the particular AI task, not your payment-card details or account password. AI output may be inaccurate and does not determine your eligibility to bid. Buyers do not receive an eligibility or credit decision from tenders.gy. You can read about OpenAI’s handling of API data in its API data controls.

5. Our reasons for processing information

Depending on the information and applicable law, we process personal information because:

• it is necessary to provide the Service or perform a contract with you;
• you have given consent, including for optional alert channels or non-essential cookies where required;
• it is necessary for our legitimate interests in operating, securing and improving tenders.gy, provided those interests are not overridden by your rights; or
• it is necessary to comply with law or protect legal rights.

You may withdraw consent at any time, but doing so does not affect processing that was lawful before withdrawal.

6. How we share information

We may share personal information with:

• Google, for optional Google sign-in, to authenticate the Google account you select and return the basic sign-in information described in section 1. Google processes your interaction with its sign-in service under Google’s Privacy policy. We store the resulting account connection and profile data using our application hosting and storage providers; we do not sell this Google sign-in information or share it with advertising platforms for targeting.
• Amazon Web Services (Amazon SES), to deliver account emails and alerts. AWS receives the recipient email address, subject, message content and information needed to route messages and report delivery outcomes. See AWS’s data-privacy information;
• Browser and device push providers, including Google, Apple, Mozilla or Microsoft depending on your browser and device. Encrypted notification payloads and delivery metadata pass through the provider’s push service to reach your device. The browser or operating-system provider also handles your permission choice under its own privacy terms;
• Meta, through the WhatsApp Business Platform, to send WhatsApp alerts to numbers that have opted in. Meta receives the destination number, approved message content and information needed to deliver the message, and returns delivery and other message-status information. This is a messaging integration, not the Meta Pixel. See the WhatsApp Business terms;
• Meta, through the Meta Pixel and Conversions API, for advertising measurement and audience creation. The Pixel sends Meta information about your browser or device, IP address, pages visited (including public news pages), referring URL, cookie identifiers and selected actions on tenders.gy. Meta may associate that information with its services and process it under its own Privacy Policy. We do not intentionally send passwords, payment-card details or the contents of private business profiles or tender documents as Pixel event data;
• Google, through Google Analytics, when enabled to measure visits and use of the Service. Google may receive page URLs, interaction events, cookie identifiers, browser and device information and IP addresses transmitted when its tag loads. Google explains its collection and use of information from sites that use its services here. We do not intentionally send passwords, payment-card details or the contents of private business profiles or tender documents as Analytics event data;
• Google, through Google Ads, when enabled for conversion measurement and advertising audiences. Google may receive ad-click information, page URLs, selected conversion events, cookie or similar identifiers, and browser and device information. If we link Google Analytics and Google Ads, selected Analytics events or audiences may also be shared with Google Ads. We do not intentionally send passwords, payment-card details or the contents of private business profiles or tender documents as Ads event data. Google explains its collection and use of information from sites that use its services here;
• OpenAI, for the AI processing described in section 4;
• other service providers that support hosting, infrastructure, database services, security, customer support and other business operations;
• payment processors, including Whop, to process subscriptions, manage checkout, prevent fraud and confirm payment status;
• your organization’s account owner or administrators, where you use a team account, so they can manage seats, permissions and organization activity. Shared searches and their criteria are visible to team members who have the required Business Profile access. A member’s private saved searches are separate from shared team searches;
• professional advisers, such as legal, accounting, insurance and security advisers, where reasonably necessary;
• law-enforcement, regulators, courts or other authorities where required by law or reasonably necessary to protect rights, safety and the Service;
• a successor organization in connection with a merger, financing, reorganization, sale of assets or transfer of all or part of the business; and
• other parties at your direction or with your consent.

We do not sell personal information. We use the Meta Pixel for advertising measurement and audience creation as described above and in section 9. Our use of Google Ads tracking is also described there. Each provider may process information it receives under its own terms and privacy policy.

7. Payments

Card payments and supported digital-wallet card checkouts are processed by Whop, Inc. Whop handles payment credentials under its own privacy terms. We receive transaction and subscription details needed to administer access, billing and refunds, but do not store complete card details. Whop’s payment-processing role does not replace Topaz Interactive’s responsibility for the tenders.gy service. Payment authorisation and renewal rules are described in our Terms of service.

For MMG Mobile Money, we process your MMG wallet number, payment and provider references, status information and any choice to save the wallet for future renewal requests. The MMG provider receives the details needed to request and verify payment. Each payment requires your approval in MMG. Do not enter an MMG password, PIN or one-time approval code on tenders.gy.

Bank transfer is available for the monthly or yearly prices offered at checkout. We may collect payer details, bank transaction references and optional uploaded receipts to reconcile payments. Only upload information needed to identify the transfer; remove unrelated transactions or other unnecessary details where possible. Billing records and payment evidence may be retained for accounting, fraud prevention, disputes or legal requirements.

8. Communications and alerts

We send service communications needed to operate your account, such as verification, password-reset, billing, security and important product notices. Turning off optional alerts does not stop essential service messages while you keep an active account.

Account settings and saved-search subscriptions

Eligible users manage email, WhatsApp and push delivery through their own Alerts & Notifications settings. Destinations belong to the user account, rather than a Business Profile. Each team member has their own settings. Saved searches use the same account email address, verified WhatsApp number and enabled push devices, with separate channel choices for each search subscription. Team members choose their own subscriptions to searches they can access.

Saved-search alerts start with newly published matching tenders after you subscribe. Existing results and historical records remain searchable without sending an alert backlog. Sharing a search makes its name and criteria available to authorised team members; it does not let them change your personal alert destinations.

Starter users can choose a weekly discovery email based on their Business Profile's selected category. Pro users can choose a weekly activity digest based on their account preferences and currently accessible profiles, saved items, follows and supplier activity. Weekly emails require a verified account email and are sent only when there is eligible activity to include.

Email is delivered through Amazon SES. We receive delivery, deferral, bounce, complaint and failure information to monitor delivery and avoid sending to addresses that cannot receive messages. You can stop optional email alerts using account settings or an email alert’s unsubscribe link.

WhatsApp alerts

WhatsApp alerts require a number you control and your opt-in. We send a short-lived code to verify a newly added or changed number, storing a one-way hash of the code until it is used or expires. Messages may include a Business Profile or search name, tender title, closing date and a link. Meta may return sent, delivered, read or failed statuses. Replying STOP stops WhatsApp alerts to that number across alert subscriptions. Opting in again requires a new verification. You can also change your choices in Alerts & Notifications.

Push notifications and devices

Push notifications are optional and require permission through your browser or operating system. Enable them separately on each browser or device you want to use. Installing the web app does not itself grant notification permission. You can disable an enabled device in Alerts & Notifications or revoke permission in your browser or device settings. Disabling one device does not automatically disable other devices, email or WhatsApp.

Notifications may appear when the site is closed, on a lock screen or on other connected notification displays. Anyone who can see those displays may see the notification text. Delivery and visibility depend on browser support, permissions, connectivity and device settings such as Focus or Do Not Disturb. A push provider accepting a message does not confirm that it was displayed or read. Following a notification link may require sign-in and current access rights.

If your plan or team access no longer includes a feature, the corresponding alerts stop. Account destinations, subscriptions and preferences may remain so they can be reused if you regain access. Turning off alerts does not delete your account or Business Profiles; see our Data Deletion page to request removal of information.

9. Cookies and similar technologies

We use essential cookies and related technologies to maintain secure sessions, authenticate users, protect against fraudulent requests, connect your signed-in state across tenders.gy, and remember necessary preferences.

Essential technologies support authentication, account access, form protection and security. Preference technologies remember choices such as appearance and interface settings. You can restrict or delete cookies through your browser, although blocking essential cookies may prevent login or other features from working.

Our Settings → Consent page covers essential cookies, saved display preferences, analytics and advertising across tenders.gy and its news site. Optional categories are on by default. The cookie notice offers “Ok, got it” to keep your current choices or Opt Out to disable all optional categories. You can also choose each optional category separately. Essential session, security, requested-payment and consent-preference cookies remain active. We remember your browser’s choices for 180 days by default; the Consent page shows the current preference duration. We respect Global Privacy Control. Turning off analytics or advertising also stops related server conversion reporting that has not already been sent; it cannot recall information already received by a provider. External payment and sign-in services control cookies on their domains.

When Meta advertising tracking is enabled, it starts automatically on eligible application and public news pages. We use the Meta Pixel and Conversions API on tenders.gy to measure Facebook and Instagram advertisements, visits, account registrations and confirmed Pro purchases or paid upgrades. Both the Pixel and Conversions API can report page visits, using a shared event identifier to avoid counting the same visit twice. The Pixel may place or read advertising cookies such as _fbp and _fbc. The Conversions API sends selected events from our server, including event time, a public source URL, purchase amount and currency where applicable, browser identifiers, IP address and browser type captured during your visit, and a normalized, hashed email address for matching. Hashing does not make this information anonymous. We do not send your Business Profile text, private searches, MMG wallet number or payment receipt. You can turn this tracking off or on using Settings → Consent on application pages. We also honor Global Privacy Control signals. Turning tracking off does not affect essential account functions. The choice applies to both the Pixel and Conversions API. Google Analytics and saved display preferences have separate controls on the same page. Opt Out disables every optional category. Matching data in our conversion delivery records is removed after seven days. To prevent replaying recent browser conversions, we remember only their event identifiers in browser storage for up to 24 hours while marketing is allowed; opting out clears those identifiers. Your browser tracking record and any advertising preference are retained for 180 days. Automatic tracking is not recorded as your explicit consent. The integration is separate from WhatsApp messaging described in sections 6 and 8.

We use Google Analytics as a non-essential measurement technology. When enabled, it may use first-party cookies such as _ga to distinguish visitors and sessions and send the information described in sections 1, 3 and 6 to Google.

We use Google Ads tracking, when enabled, as a non-essential advertising technology. When enabled, Google tags may place or read cookies or similar identifiers, recognize ad clicks and send selected conversion events to Google to measure our campaigns. We may also use data about visits or interactions to create advertising audiences, and may link Google Analytics with Google Ads to share selected events or audiences. Google Ads tracking, Google Analytics and the Meta Pixel may use related website technology but serve distinct advertising or measurement purposes.

Google advertising cookies may include _gcl_*. Our google_ads_touch cookie stores encrypted Google ad-click identifiers such as gclid, gbraid and wbraid for campaign attribution for up to 90 days. These identifiers are captured only when both analytics and advertising are allowed. Turning either category off removes this stored Google ad-click context. Google consent signals reflect your analytics and advertising choices.

Our analytics category also covers our own campaign and article attribution records, including campaign_touch and news_article_touch. Consent preferences control related browser and server-side tracking, not only cookies. The preference duration describes how long we remember your choice, not the retention period of every cookie or record. Essential account, security and payment records remain subject to their own retention requirements.

You can restrict or delete cookies in your browser and manage how activity from advertising partners affects the ads you see through Meta’s ad preferences and Google’s My Ad Center. Browser restrictions may not remove information already received by a provider or stop all advertising. To change cookie categories on this site, visit Settings → Consent.

You can also use Google’s Analytics opt-out browser add-on where supported. The site’s analytics control is also available in Settings → Consent.

Installed web app and local storage

You may choose to install tenders.gy as a web app on a supported device. It uses the same service, account and plan. We use browser local storage to remember that you dismissed the installation panel for seven days for your account on that browser. Other browser storage may hold session or interface preferences. Our current service worker handles push notifications; it does not intercept page requests or cache account pages for offline use. Internet access is needed to use the service.

Removing the installed app or clearing local browser data does not delete information held on our servers, close your account or cancel a subscription. Manage notifications and billing separately, and contact us if you want stored personal information deleted.

10. Data retention

We retain personal information for as long as reasonably necessary to provide the Service, maintain your account, comply with legal and accounting requirements, resolve disputes, enforce agreements and protect the Service.

Retention periods vary by type of information. Account and profile information is generally retained while your account is active. Billing and transaction records may be retained longer where required for tax, accounting, fraud-prevention or legal purposes. Security logs and backups may remain for a limited period after other information is deleted.

For completed email, WhatsApp and push communications, our current retention setting is 90 days. After that period, our scheduled process redacts recipient and message-content fields from active communication records and removes detailed provider-event data. Message statuses, timestamps and limited delivery metadata may remain. Pending, retrying, sending or blocked messages may be retained longer while delivery is outstanding. Provider copies and backups follow their own retention schedules.

Push-device subscriptions are separate from message-content records. Disabling a device in Alerts & Notifications marks its subscription inactive; it does not immediately erase its stored address, keys or device label. These details may remain until account deletion or the handling of a deletion request. We do not currently apply a fixed automatic purge period to inactive push subscriptions. You can request their removal using the Data Deletion instructions.

Public procurement records may be retained as part of the platform’s historical tender and award archive even after the source opportunity closes, subject to applicable law and valid correction or removal requests.

Tender drafts, uploaded documents and review records are kept to operate publishing and review changes. Approved notices, their contact information and attached documents are public and may remain in the procurement archive after the submitting account is closed.

11. Data security

We use reasonable technical and organizational safeguards designed to protect personal information. These may include access controls, hashed passwords, secure session management, backups, monitoring and restrictions on administrative access.

No online service or storage method is completely secure. You are responsible for keeping your credentials confidential and should contact us promptly if you suspect unauthorized access to your account.

12. International processing

Our providers, including Meta, Google, OpenAI, Amazon Web Services and the browser/device push providers described above, may process information outside Guyana, including in the United States or other countries where they or their infrastructure operate. Privacy protections in those countries may differ from those in Guyana.

Where required, we use contractual, organizational or other appropriate safeguards for international processing and require service providers to protect information consistently with this policy and applicable law.

13. Your choices and rights

Depending on applicable law, you may have the right to:

• request access to personal information we hold about you;
• correct inaccurate or incomplete information;
• request deletion of certain information;
• object to or restrict certain processing;
• receive certain information in a portable format;
• withdraw consent where processing is based on consent; and
• complain to an appropriate privacy or data-protection authority.

You can update some account, business-profile and notification information through your settings. For another request, email hello@tenders.gy. We may need to verify your identity and authority before completing a request. Some requests may be limited where information must be retained by law, is needed for security or legal claims, or concerns another person’s rights.

14. Account deletion

You may request deletion of your account by contacting hello@tenders.gy. Deleting an account may remove access to tracked tenders, followed buyers and categories, watched suppliers, business-profile information, personal saved searches, alert subscriptions, push-device registrations and other account data. Shared team resources and other people’s records may be affected differently depending on ownership and permissions; we will consider those rights when handling a request. We may retain limited information where required for billing, fraud prevention, security, dispute resolution or legal compliance.

15. Children’s privacy

The Service is intended for adults and businesses and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided personal information to us, contact us so we can review and, where appropriate, delete it.

16. Third-party links and services

The Service links to procurement portals, buyer websites, source documents and other third-party services. Their privacy practices are controlled by their respective operators, not by tenders.gy. Review their privacy policies before providing personal information to them.

17. Changes to this policy

We may update this Privacy policy as the Service, our providers or legal requirements change. We will publish the revised policy on this page with a new effective date and provide additional notice where a change is material.

18. Contact us

Questions, requests or complaints about privacy may be sent to hello@tenders.gy or directed to Topaz Interactive in Georgetown, Guyana.