Privacy notice
Last updated 19 October 2026. This explains what personal information Tender Ready handles, why, and how to exercise your rights under the Protection of Personal Information Act (POPIA, Act 4 of 2013).
Who this covers, and two different roles
When your company signs up, your company is the responsible party for the personal information of its own staff - key people's ID numbers, qualifications, project history, phone numbers, CVs - and its directors' details. Tender Ready processes that information on your company's behalf, which makes Tender Ready an operator, under your company's instruction.
For your own account - the email address and password (or Google/Microsoft login) you sign in with - Tender Ready is the responsible party.
What we collect, and why
Only what a SANRAL or other public-sector tender submission actually requires: company registration details (CIPC number, VAT, tax, CIDB/CSD numbers), director details, key people's ID numbers, qualifications, project histories and CVs, and the compliance documents you upload (COID letters, tax clearance, insurance, B-BBEE certificates). None of it is collected for any purpose beyond preparing and tracking your company's own tender submissions.
A CV you upload is read by an AI step to pull out structured fields (name, qualifications, project history) for your review before anything is saved - you confirm or correct every field, nothing is saved automatically. Any South African ID number is matched and removed from that text locally, on our own servers, before the remaining text is sent to Anthropic (the AI provider) for extraction - the ID number itself never leaves Tender Ready's own infrastructure for that step.
Who we share it with
Your data is never shared with another company using Tender Ready. The product is built so that every customer's data is isolated from every other customer's - enforced at the database level, not just hidden in the interface, and independently tested for exactly that (ask us for the details if you'd like them).
A small number of infrastructure providers process data on our behalf, strictly to run the service: Supabase (database and file storage), Vercel (hosting the web app), and Anthropic (CV text extraction, as above, with ID numbers removed first). We are confirming each provider's hosting region and data-processing terms as part of finishing our POPIA documentation (see "What's still in progress" below).
Your rights
You (or your company's admin) can view and correct every key person's details directly on their People page at any time. Deleting a person removes their record, including their uploaded and generated CV files. If you need help exercising any right under POPIA - access, correction, deletion, or raising a concern about how your information is handled - contact us at the address below.
Security
Every customer's data is scoped by row-level security in the database, not only by the app's interface - meaning even a direct database query from one company's session cannot read another company's rows. File storage paths are similarly confined to each company's own folder. These protections are covered by an automated test suite that runs on every change to the database.
What's still in progress
In the interest of being straightforward rather than overstating where things stand: we have not yet registered an Information Officer with the Information Regulator, finalised a data retention period for generated documents, or confirmed the hosting region for every provider above. We are completing this paperwork and will update this notice as each item is finished.
Contact
Questions about this notice, or a request relating to your personal information, can be sent to privacy@tendertool.co.za.