Privacy policy

It covers the representative who signs up, the company they sign up on behalf of, and anyone visiting this website. Quick Tenders accounts are company accounts: information tied to a company is available to that company, and to nobody else using the service.

• Account details you give us at signup: your name, your work email address, your company name, industry, region and company size.
• The company domain, derived from the email address you confirm. It identifies the account and is what keeps one company separate from another.
• Tender activity: the tenders matched to your company, the scores and deadlines attached to them, their status, and the documents drafted for them.
• Technical records created by using the service: request logs, approximate location from IP address, browser and device information.

We do not ask for payment card details on the free trial, and we do not buy personal data from third parties to enrich your account.

• To run the account and let you sign in.
• To match tenders to your company, which is what the industry, region and size are for.
• To draft response documents against your company profile.
• To send service messages, such as a deadline approaching or a trial ending.
• To keep the service secure and diagnose faults.

We do not use your tender activity to advertise to you, and we do not sell it.

Application data is held in a managed Postgres database and object storage operated by Supabase, our hosting provider and a processor acting on our instructions. Traffic to the service is encrypted in transit, and data at rest is encrypted by the hosting provider.

Where our providers store or process data outside your own country, that transfer relies on the safeguards those providers have in place. If you need the specifics for a procurement questionnaire, ask and we will send the current list of processors.

Access is enforced in the database itself, not only in the application. Every table carries row level security policies that resolve your company from your signed-in identity, so one company cannot read another company records even if the application were asked to fetch them. The public, unauthenticated role has no read access to any table.

Our own staff access is limited to what is needed to operate the service and respond to support requests. The security page describes the controls in more detail, including what is not yet in place.

The service sets cookies that hold your authentication session and keep you signed in. They are necessary for the product to work. We do not set advertising cookies and we do not run third-party ad trackers on this site.

Account and tender data is kept for as long as the company account is open. If a trial ends without becoming a paid plan, the account and its data are deleted after a reasonable retention window. Technical logs are kept for a shorter period for security and debugging.

We may keep a minimal record of a closed account where we have to, for example to meet a legal or accounting obligation.

Depending on where you are, you can ask us to give you a copy of your data, correct it, export it, delete it, or restrict how we use it. You can also object to processing in some circumstances, and complain to your local data protection authority.

Send requests to the privacy address below. We will ask you to confirm you control the company domain on the account before acting on a request that affects company data.

If this policy changes in a way that affects you, we will update the date at the top and tell account holders by email before the change takes effect.

Privacy questions and data requests go to privacy@quicktenders.ke. Other routes are on the contact page.