Privacy Policy

Last updated: 30 June 2026

1. Who we are

This Privacy Policy explains how TendorAI Ltd ("TendorAI", "we", "us", "our") collects, uses, stores and protects personal data when you use our website at tendorai.com and our services, and when we hold data about your firm that we have obtained from public sources.

TendorAI Ltd is a company registered in England and Wales under company number 16521860, with its registered office at [FILL: registered office address, Wales]. We are the data controller responsible for your personal data.

TendorAI is an AI visibility platform. We measure how often AI assistants recommend regulated professional-services firms, diagnose why a firm may be invisible to those assistants, and help firms close the underlying technical gaps.

2. The data we collect

(a) Firm data from public registers

We maintain profiles for UK regulated firms using information published in public registers. For each firm this may include:

• Firm or trading name and any branch/office names
• Regulatory and registration identifiers (for example SRA ID, Companies House number, VAT number, ICAEW firm number, FCA reference, Propertymark membership)
• Business address and service-coverage areas
• Regulatory status and areas of practice
• Business contact details published in the register (such as a business email address, telephone number and website)
• Where published, the names of principals, partners or named contacts — which, for sole practitioners and partnerships, constitutes personal data

Section 6 sets out the specific sources, legal basis and retention for this category, as required by Article 14 UK GDPR.

(b) Account data

If you register for a free or Pro account, we collect:

• Your name, job title and business email address
• Login credentials
• The firm you represent and details you choose to add or correct on your profile
• Your communication preferences

(c) Billing data

If you subscribe to our Pro plan (£299/month), payment is processed securely by Stripe. We do not store full card details on our own systems. We retain transaction records (such as invoices and the subscription status) as required for accounting and tax purposes.

(d) Reports and diagnostic data

When you use the platform we generate AI-visibility scores, diagnostics and content drafts relating to your firm. Where these are linked to your account, they are treated as your personal data.

(e) Website and analytics data

• Page views, navigation and search/filter activity
• Device type, browser and operating system
• IP address

(f) Communications

If you email us or use our contact form, we keep a record of that correspondence and the information you provide.

3. Where we obtain your data

• Directly from you — when you register, subscribe, complete your profile or contact us.
• From public registers and published sources — including the Solicitors Regulation Authority (SRA), Companies House, the Institute of Chartered Accountants in England and Wales (ICAEW), the Financial Conduct Authority (FCA) and Propertymark, and from firms' own public websites.
• Automatically — through cookies and similar technologies when you use the website (see Section 9).

4. Why we use your data and our legal basis

We process personal data for the following purposes, on the bases shown:

• Operating the platform and firm profiles — to measure and report AI visibility for regulated firms. Legal basis: legitimate interests (running a B2B benchmarking and visibility service for professional-services firms), balanced against the rights of the individuals concerned (see Section 5).
• Providing the service to account holders — to create and manage your account, generate reports and deliver features. Legal basis: contract.
• Billing and payments — to take payment and keep financial records. Legal basis: contract and legal obligation (accounting/tax law).
• Marketing communications to firms — to tell firms about the platform. Legal basis: legitimate interests for corporate subscribers, and consent where required by the Privacy and Electronic Communications Regulations (PECR). You can opt out at any time.
• Website analytics — to understand and improve how the site is used. Legal basis: consent.
• Security, fraud prevention and legal compliance. Legal basis: legitimate interests and legal obligation.

5. Our legitimate interests

Where we rely on legitimate interests, we have weighed our interest in operating an AI visibility platform against your interests, rights and freedoms. We only process business and professional contact information that is already published in public registers or on firms' own websites, we limit the data to what is needed to run the service, and we give every firm a clear and easy route to object or be removed. You can ask for a copy of our balancing assessment by emailing us.

6. Firm data obtained from public registers (Article 14 UK GDPR)

If your firm appears on our platform and you did not provide your data to us directly, this section is your privacy notice under Article 14 UK GDPR.

• What we hold: the firm-data categories listed in Section 2(a).
• Where we got it: publicly accessible registers and published sources, namely the SRA, Companies House, ICAEW, the FCA, Propertymark, and firms' own public websites.
• Why we hold it and our legal basis: our legitimate interest in operating an AI visibility benchmarking platform for UK regulated professional-services firms (Article 6(1)(f) UK GDPR), as explained in Section 5.
• How long we keep it: for as long as we operate the platform and the firm remains on the relevant public register, reviewed periodically, and removed promptly on a valid objection or erasure request (see Section 7).
• Your rights: you have the rights set out in Section 10, including the right to object to this processing and to ask us to remove your firm's profile.

To object, correct your details, or ask for your firm's profile to be removed, email scott.davies@tendorai.com. We will action valid requests without undue delay.

7. Who we share data with

We do not sell your personal data. We share it only with the service providers (processors) that help us run the platform, each under a data-processing agreement:

• Vercel — website/frontend hosting
• Render — backend application hosting
• MongoDB Atlas — database hosting (UK/EU region)
• Stripe — payment processing
• Resend — transactional and service email delivery
• Google Analytics — website analytics
• AI service providers (including Anthropic) — used to generate content and to measure how AI assistants respond to queries about firms. To perform this core function, firm identifiers and public profile information may be sent to third-party AI platforms.

We may also disclose data where required by law, to enforce our terms, or to protect our rights, property or safety.

8. International transfers

Some of our providers (including Stripe, Google and certain AI service providers) process data outside the UK, including in the United States. Where personal data is transferred outside the UK, we rely on appropriate safeguards — such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, UK adequacy regulations, or the UK extension to the EU–US Data Privacy Framework — so that your data receives equivalent protection. You can ask us for details of the safeguards that apply.

9. Cookies

• Essential cookies — required for the site to work (for example session management and authentication). These are set without consent because the site cannot function without them.
• Analytics cookies — Google Analytics cookies that help us understand site usage. These are only set after you give consent through our cookie banner, and you can withdraw consent at any time.

You can also control cookies through your browser settings.

10. How long we keep data

• Firm register data: as described in Section 6.
• Accounts: while your account is active; deleted within 30 days of closure, except where we must keep it for legal reasons.
• Billing and financial records: retained for 6 years to meet UK accounting and tax (HMRC) requirements.
• Analytics data: individual analytics data retained for up to 14 months; aggregated data may be kept longer.
• Marketing opt-outs: if you opt out, we keep a minimal record indefinitely so that we can honour your choice.

11. Your rights

Under the UK GDPR you have the right to:

• Access a copy of the personal data we hold about you
• Rectification of inaccurate or incomplete data
• Erasure of your data (the "right to be forgotten")
• Restriction of processing in certain circumstances
• Portability — to receive your data in a machine-readable format
• Object to processing based on legitimate interests, including profile listings; and an absolute right to object to direct marketing at any time
• Withdraw consent at any time where we rely on consent

To exercise any of these rights, email scott.davies@tendorai.com. We will respond within one month. You will not normally have to pay a fee.

12. Complaints

If you are unhappy with how we have handled your data, please contact us first at scott.davies@tendorai.com. We will acknowledge your complaint within 30 days and work to resolve it.

You also have the right to complain to the Information Commissioner's Office (ICO) at any time. TendorAI Ltd is registered with the ICO as a data controller under reference [FILL: ICO reference, e.g. ZA123456]. You can contact the ICO at ico.org.uk.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post any significant changes on this page and update the "last updated" date above. Your continued use of our services after changes are posted constitutes acceptance of the updated policy.

14. Contact us

TendorAI Ltd
[FILL: registered office address, Wales]
Email: scott.davies@tendorai.com