Privacy policy

Last updated: 11 October 2026

This policy explains what personal data Eshmere Ltd collects when you use Tenda, why, who else handles it, how long we keep it and what your rights are. Tenda is our service for finding and bidding for public sector contracts in the UK, the US, Canada and the European Union. It includes the Tenda connector in ChatGPT, Claude and Muse, the Tenda dashboard, the Tenda button for Chrome and Edge, and Tenda in Slack and Microsoft Teams. This policy also covers people named in the public notices Tenda holds.

1. Who we are

Tenda is run by Eshmere Ltd, a company registered in England and Wales, company number 17239365. Our registered office is Apartment 120, 10 Hall Street, Birmingham, B18 6BX.

We are the controller of the personal data described in this policy, except where we handle data for your organisation as its processor (section 10).

For anything about your data, email hello@eshmere.ai.

2. What we collect

Your account

When you sign in, our sign-in provider, Clerk, tells us your name, your email address once you've verified it, and an ID for your account. You have one Tenda account whether you sign in on the dashboard or from ChatGPT, Claude or Muse. We never see your password. Clerk may also check that a person, not a program, is signing up.

Your workspace and team

• The workspace's name, time zone and plan.
• Its members and their roles.
• Invitations: the email address invited, the role offered, who invited them and when. Tenda emails the invitation to that address, with a link to join.
• An activity log of changes in the workspace: who did what, and when. It can include the email addresses of people invited, the reasons given for bid calls, and the names of connected Slack and Teams channels.

Your company and your bids

• The company profile. This is what you and your colleagues enter, plus what Tenda finds on Companies House: the company's number, name, status, date of incorporation, industry codes, the town and postcode of its registered office, and its type of accounts. For a US company, Tenda finds its registration on SAM.gov instead: its Unique Entity ID, legal and trading names, whether the registration is active and when it expires, its address, its industry (NAICS) codes and its small business certifications. Tenda also finds the public contracts the company has won.
• Your pipeline: the tenders you add, your answers and reasons for each bid or no-bid call, the bid steps and who completed them, the tenders you mark "Not for us", and alerts.
• Searches and tenders you ask Tenda to watch, and the alerts Tenda makes for them.
• Which e-tendering portals your team has accounts on, as your team tells Tenda, so that it doesn't ask again.
• If you use Tenda in ChatGPT, Claude or Muse without a workspace, your own company profile.
• Text from tender documents you add, up to 20,000 characters each, and what Tenda takes from it, such as conditions to meet.
• If an owner or admin connects your organisation's SharePoint (on Team Plus and Team Pro): the Microsoft account that connected it, and a sealed key that lets Tenda read files, read-only. Tenda reads only the folders your team adds, up to 100 files, and keeps each file's name, address and text, up to 40,000 characters each. Tenda never changes or shares the files.
• If you connect your Google Drive (on Team Plus and Team Pro): your Google account's email, and a sealed key that lets Tenda read only the files you choose in Google's file picker, read-only. Tenda keeps each chosen file's name, address and text, up to 40,000 characters each, and who chose it. Tenda can't see the rest of your Drive, and never changes or shares your files.

If you add tender documents without signing in, Tenda reads them to answer you and keeps nothing from them: what it reads isn't stored, and no one else sees it. Signed in, Tenda keeps what it reads for your own later checks of that tender, and only yours. Only add documents that the buyer has published.

Payments

When you pay for a plan, Stripe collects your card details and billing address, and a tax ID if you give one. We never see your full card details. We keep:

• the IDs Stripe gives to the customer record and the subscription;
• the plan, its status and its billing period;
• the name and email address we gave Stripe for the account.

Slack and Microsoft Teams

If your workspace connects Tenda to Slack or Teams, we keep:

• the Slack workspace, or the Microsoft organisation, team and channel, by their IDs and names;
• for Slack, the access token that Slack gives Tenda, sealed with encryption.

Someone who links their Slack or Teams account to Tenda gets a one-time link. Until it's used, we hold their display name with it. After that, we keep their Slack or Teams user ID and the Tenda account it belongs to.

We don't store what people type to Tenda in Slack or Teams, except while Tenda's AI is answering (below).

Calendar link

If you make a calendar link, we keep its secret address and when it was last read. When you add it to Outlook, Google Calendar or Apple Calendar, that service fetches your workspace's dates from Tenda: tender titles, buyers, values, deadlines and bid steps.

The Tenda button

The Tenda button is a browser extension for Chrome and Edge. It reads the page you have open only when you press it: the page's address, title, main heading, the start of its text and its links. It sends Tenda the address, title, heading and that text, to find which tender the page is. It doesn't read other pages, record your browsing, or see your passwords for buyers' portals.

When you press Send, the button downloads the files you ticked from the portal, as you, and reads them on your computer. Tenda gets each file's name and text, never the file itself. It keeps them with that tender's bid in your workspace, with who sent them and when, and notes that your team has an account on that portal. Everyone in the workspace can see them.

When you connect the button, Tenda gives it a key of its own, which it keeps in your browser. We keep only a fingerprint of that key, and when it was last used.

Using Tenda from ChatGPT, Claude and Muse

We record which Tenda tool was used, by which account, when, whether it worked and how long it took. We don't record what you asked. Tenda doesn't ask for or receive your conversation history.

Talking to Tenda's AI in Slack, Teams and Ask Tenda

When you talk to Tenda in Slack or Teams in your own words, or in Ask Tenda in the dashboard, Tenda's AI answers. What you say to it, and what Tenda looks up to answer you, goes to our AI providers, OpenAI and Anthropic, which work out the reply. We keep the latest messages of each conversation with Tenda for a day, so that it can follow the conversation. We keep your own latest 12 messages with Tenda in each workspace, and its replies to them, for 30 days, so that Ask Tenda can pick up where you left off. Only you see them there, and nothing you say in Ask Tenda is shown in Slack or Teams. We also count the answers each person gets, for the fair-use allowance.

Tenda drafting your bids

On paid plans, Tenda can draft a whole bid for your team. To do that, our AI providers, OpenAI and Anthropic, read the buyer's questions and the tender documents you share, your company profile, the public contracts your company has won, your team's answers to Tenda's questions, its fact sheet and any winning bids it has shared, and your team's Tenda Memory notes. They work out the answers, Tenda's marks and its checks.

• We keep the draft, with its answers and marks, in your workspace, where your team reads, rewrites and downloads it, until the workspace is deleted.
• We keep your team's answers to Tenda's questions as a short fact sheet in your workspace, so that later bids don't ask again. Your team can read and change it in Tenda's Library.
• If your team chooses to share bids it has won, we keep them in your workspace, with what Tenda learnt from them, until someone removes them in the Library. Tenda uses them only for your workspace's own drafts.
• We count the credits each account spends on drafting.
• Leave out personal details that a bid doesn't need, in what you share as well as in what Tenda writes. Where a bid names people, such as the contract manager, you're responsible for having their agreement.

Tenda Memory

Tenda's AI keeps short notes about what matters to your team, such as "Interested in cleaning tenders in Surrey" or "Prefers short answers". It uses them to tailor its answers and to suggest changes to your company profile. It never makes a change without a yes. After each conversation with Tenda, OpenAI reads the exchange and the notes already kept, to work out what to note.

• Notes about your company and its bidding are shared with your workspace. Notes about your own preferences are seen only by you.
• Notes don't record secrets, financial or health details, or anything about people outside your team.
• You can see the notes in Tenda under Settings, then Tenda Memory, and delete any of them there. You can also tell Tenda "forget that" in the chat.

Asking a person to review a bid

When Tenda offers a review by a person and you ask for one, we keep your request, your notes and the contact email you give.

Technical data

Our hosting provider, Vercel, keeps short-lived logs of requests to Tenda. These include your IP address, your browser type, the address requested, and any errors. Tenda's own code doesn't record IP addresses.

Cookies

Tenda only uses the cookies it needs to work. There are no advertising or analytics cookies.

• Clerk's sign-in cookies keep you signed in and protect sign-in from misuse.
• tenda_session records that this session has been through Tenda's welcome step. It lasts until you close your browser.
• tenda_workspace remembers the workspace you last chose, for 400 days.

These cookies are strictly necessary, so we don't ask for consent to use them.

3. People named in public notices

Tenda holds tender and contract award notices that public bodies publish:

• in the UK, on Find a Tender, Contracts Finder and Public Contracts Scotland;
• in the US, on SAM.gov and USAspending.gov;
• in Canada, on CanadaBuys;
• in Australia, on AusTender;
• in Germany, on oeffentlichevergabe.de;
• in France, in the BOAMP;
• in Kenya, on the Public Procurement Information Portal (tenders.go.ke);
• across the European Union, on TED (Tenders Electronic Daily).

It also holds company records from Companies House and SAM.gov. These can include personal data, such as the name and email address of a buyer's contact, or the name of a supplier who trades as a sole trader. Tenda shows them as they were published, so that suppliers can find and respond to public contracts.

We rely on legitimate interests for this: helping suppliers find and bid for public contracts, in keeping with the transparency these registers exist for. If you're named in a notice and object to Tenda showing your details, contact us (section 8). The original notice stays with the body that published it.

4. How we use your data, and our lawful basis

• To provide Tenda: your account, workspace, pipeline, alerts and connections, and Tenda's answers in ChatGPT, Claude, Muse, Slack and Teams. Our basis is our contract with you or your organisation, and our legitimate interest in providing Tenda to the people who use it.
• To take payment and keep accounts. Our basis is our contract, and the legal obligation to keep financial records.
• To keep Tenda secure and working, including finding and fixing faults and stopping misuse. Our basis is legitimate interests.
• To understand how Tenda is used, from the record of tool use, which holds no content. Our basis is legitimate interests.
• To answer you when you contact us. Our basis is legitimate interests.

We don't sell personal data. We don't use it for advertising, and we don't use it to train AI models. Tenda doesn't make decisions about people automatically: fit scores and readiness checks are suggestions for you to weigh.

5. Who we share it with

• People in your workspace see its data, including who did what.
• Service providers that run Tenda for us. Our contracts with them require them to protect the data and to use it only for us.
  • Vercel Inc. hosts Tenda. Our servers run in London.
  • Neon Inc. hosts Tenda's database, in London.
  • Clerk Inc. handles sign-in.
  • Resend, Inc. sends Tenda's own emails, such as invitations, from servers in Ireland.
  • Stripe handles payments. Stripe is also a controller of payment data, under its own privacy policy.
  • OpenAI works out the answers from Tenda's AI in Slack and Teams, and drafts and checks the bids Tenda writes. When Tenda drafts a bid, that includes the passages from your SharePoint and Google Drive files that best match the bid's questions. OpenAI doesn't use the data to train its models, and may keep it for up to 30 days to check for misuse.
  • Anthropic, PBC works out answers from Tenda's AI, and drafts and checks bids, as OpenAI does. Which of the two does each job depends on the job and your plan: Anthropic's Claude marks and checks every bid, for example. Anthropic doesn't use the data to train its models, and deletes it within 30 days, unless it needs to keep it longer to enforce its usage policy or the law requires it.
• Services you choose to use with Tenda. These are ChatGPT (OpenAI), Claude (Anthropic), Muse (Meta), Slack, Microsoft Teams, SharePoint, Google Drive, Outlook, Google Calendar and Apple Calendar. What Tenda sends to them is handled under their own terms and privacy policies. For example, Tenda's answers in ChatGPT, Claude or Muse can include colleagues' names on pipeline activity, and contact details from public notices.
• Companies House. When you look up a company, we send the name or number you search for.
• SAM.gov and USAspending.gov. When you look up a US company, we send its Unique Entity ID or the name you search for.
• Where the law requires it, or to protect people's rights, property or safety.
• A buyer of Eshmere's business, if it is sold or merged. The buyer would be bound by this policy.

The Tenda button. What the button reads is used only to send a tender's files to its bid in Tenda and to find which tender a page is. It isn't sold, used for advertising or credit decisions, or used to train AI models, and people at Eshmere don't read it unless you ask us to, for security, or where the law requires.

Google user data. Tenda's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Tenda uses what it reads from Google Drive only to show you your files in Tenda and to draft and check your team's bids. It doesn't sell it, use it for advertising, or use it to train AI models, and people at Eshmere don't read it unless you ask us to, for security, or where the law requires.

6. Data outside the UK

Tenda's servers and its database are in London. Our service providers are based in the United States, though, and may reach or process data elsewhere. When personal data leaves the UK, we rely on one of these:

• UK adequacy regulations, including the UK–US data bridge where the provider is certified;
• the Information Commissioner's International Data Transfer Agreement, or its Addendum to the EU's standard contractual clauses.

Ask us for details.

7. How long we keep it

• Your account, workspace and company data: until you delete them. You can do that yourself in Tenda at any time, and it happens straight away:
  • A workspace: its owners delete it at the foot of Settings. Everything in it goes, for everyone in it. If it's the last workspace on its account, the account and its paid plan go too.
  • Your account: anyone can delete their own account, from Settings. Everything that's only yours goes, with any workspace only you are in. You leave the others: your team keeps its work, such as the bids you wrote and the steps you ticked off, with your name taken off. While you're the only owner of a workspace with other people in it, make someone else an owner, or delete the workspace, first.
  • You can also email us, and we'll delete it, and its data, within 30 days, except as set out below.
• Payment records: six years, as UK tax law requires. Stripe keeps the invoices and receipts of an account that's deleted.
• The activity log and the record of tool use: while the workspace or account exists. When someone deletes their account, the entries that name them stay with their workspace, with their name taken off.
• Members who leave: removing a member deletes their calendar link.
• Slack and Teams: disconnecting a channel deletes its access token. One-time codes for connecting and linking are deleted a day after they expire.
• SharePoint: Tenda reads each folder again every day. A file that leaves a folder is deleted from Tenda then. Removing a folder deletes what Tenda read there, and disconnecting SharePoint deletes Tenda's key, the folders and everything it read.
• Google Drive: Tenda looks at each chosen file again every day. Removing a file deletes what Tenda read from it. Disconnecting your Google Drive, or leaving the workspace, deletes your key, the files you chose and everything Tenda read from them. You can also remove Tenda's access at myaccount.google.com/connections.
• The Tenda button: what it sent stays with the bid until the workspace is deleted. Sending a file with the same name again replaces it. Disconnecting the button, leaving the workspace or being removed from it deletes its key.
• Conversations with Tenda's AI: the latest messages of each conversation, for a day, and each person's own latest 12 in each workspace, for 30 days. The count of answers stays with the account.
• Tenda Memory's notes: until someone deletes them, or the workspace is deleted.
• Bid drafts: until the workspace is deleted.
• The fact sheet and shared winning bids: until someone changes or removes them in the Library, or the workspace is deleted.
• Backups: deleted data leaves our database provider's backups within 30 days.

8. Your rights

Under UK data protection law, you can ask us to:

• give you a copy of your personal data;
• correct it;
• delete it;
• limit how we use it;
• stop using it, where we rely on legitimate interests;
• give you your data in a form you can move, where we use it under a contract.

You can delete your account, and owners their workspaces, yourselves in Tenda (section 7). For anything else, email hello@eshmere.ai. We'll reply within one month, and there's no charge. If your data is in your organisation's workspace, we may pass your request to your organisation (section 10).

9. Security

• Each workspace's data is kept apart by row-level security in the database, as well as by role checks in Tenda.
• Slack access tokens are sealed with AES-256-GCM encryption.
• Tenda checks the signature on every request from Slack, Microsoft and Stripe.
• Data is encrypted on its way to and from Tenda, and our hosting and database providers encrypt it where it's stored.
• Calendar links are long random secrets, and you can replace yours at any time.

If something goes wrong with your data, we'll tell you without undue delay. Where the law requires it, we'll also tell the Information Commissioner's Office.

10. When we act for your organisation

In a workspace, your organisation decides what goes into Tenda and who can see it. For the personal data in the workspace's content, we act as your organisation's processor, under section 14 of our terms of use. That content includes people's names in your pipeline, your notes and your documents. We are the controller for account, sign-in, payment and security data.

11. Children

Tenda is for businesses. It isn't for anyone under 18.

12. Changes to this policy

We'll post any changes here and update the date at the top. If a change matters to you, we'll tell account owners in Tenda or by email before it takes effect.

13. Complaints

Please contact us first, at hello@eshmere.ai. You can also complain to the Information Commissioner's Office, at ico.org.uk/make-a-complaint or on 0303 123 1113.