Privacy policy
The short version: your documents stay on Canadian infrastructure, are never used to train anything, and are never shared between accounts. The rest of this page is the detail behind that sentence.
Who we are
Tender Helper ("we", "us") is a sole proprietorship operated by Bailey Irving, providing construction estimating software at tenderhelper.ca and app.tenderhelper.ca, based in Ottawa, Ontario, Canada. For anything in this policy: [email protected].
What we collect
- Account information — your name, email address, company name, and role on the account. Passwords are stored only as salted argon2id hashes; we cannot read yours.
- The documents you upload — tender packages: specifications, drawings, addenda. These are the point of the product and are treated as confidential (see below).
- The work you produce — scope items, review decisions, takeoff measurements, RFIs.
- Billing information — handled by our payment processor. Card numbers are entered on their own secure pages and never touch our servers; we hold only a customer reference, your plan, and subscription status.
- Operational records — sign-in sessions (opaque tokens, stored hashed), request logs, and per-account AI usage records used to enforce plan budgets.
- Marketing-site analytics — a privacy-focused, cookieless analytics tool that does not profile or track you across sites. The app itself sets one session cookie so you stay signed in, and nothing else.
How we use it
To run the service you signed up for: storing and reading your tender documents, producing your draft scope of work, operating the takeoff workspace, billing your plan, answering support, and keeping the service secure. We do not sell personal information, we do not run advertising, and we do not use your documents to improve results for any other customer.
AI processing — and the no-training commitment
Producing a scope of work means sending document content to two AI providers: Anthropic, which reads specification text and drafts scope items, and Google, which transcribes scanned pages and reads drawing sheets. What crosses to them is the text of pages within your extraction scope and, for drawings, the sheet itself — never your takeoff measurements, pricing, or other tenders.
Neither provider trains on this material. Anthropic does not train models on API-submitted data. Google does not train on data submitted through the paid tier of its API — and we use the paid tier for exactly that reason.
Where your data lives
Uploaded files and the database both run on Canadian infrastructure, in the Toronto region. Some of our service providers process data outside Canada in the course of providing their service — notably our payment processor, Anthropic and Google (AI processing), and our transactional email provider (account verification, password resets, and trial notifications). While in another jurisdiction, data is subject to that jurisdiction's laws. We choose providers with contractual confidentiality and no-training commitments.
Service providers
| Category | What they process |
|---|---|
| Hosting, database & storage (Canada) | Hosting, database, and document storage |
| Anthropic | Document content, for AI extraction (no training) |
| Document content, for OCR and drawing analysis (paid tier, no training) | |
| Payment processor | Payments and subscription management |
| Transactional email provider | Delivery of account verification, password-reset, and trial-notification emails |
| Analytics provider | Marketing-site delivery and cookieless analytics |
How long we keep things
Your data is kept while your account is active. If a trial ends without a plan, the account goes read-only and stays fully readable; the original PDFs are removed 30 days later, with an email before it happens — everything you built (scope of work with citations, RFIs, takeoff measurements) is kept regardless. Our database provider takes automatic daily backups of the database. Deleting a document or tender in the app removes the stored file permanently. To delete an entire account, contact us and we will remove it.
Security
Everything moves over TLS. Every request is scoped to your organisation at the database layer — a request for another account's record is answered as if the record does not exist. Passwords are argon2id hashes; sessions are opaque HttpOnly cookies stored only as hashes, so a database backup contains nothing replayable as a login.
If a breach happens
If a breach of security safeguards involving your personal information creates a real risk of significant harm, we will notify the Office of the Privacy Commissioner of Canada and you, as soon as feasible, and keep a record of the incident — as required under PIPEDA. Not every incident meets that threshold, but we take the assessment seriously either way.
Your rights
You can access and correct your account information in the app, and export your work at any time. You can ask us what personal information we hold about you, ask for corrections, or ask for deletion, by writing to [email protected] — we answer within 30 days. If you're not satisfied with our answer, you may complain to the Office of the Privacy Commissioner of Canada.
Changes
If this policy changes, the new version is posted here with a new date, and material changes are announced to account owners by email. Continued use after a change means the current version applies.
The technical companion to this policy — exactly what happens to a file when you upload it — is at How your documents are handled.