Privacy Policy
Last updated 3 August 2026
In short: we hold your email address, your business profile and your billing status. We don't sell anything to anyone, we don't run advertising trackers, and you can have it all deleted by sending one email.
Who is responsible
Contracked, address not yet published, is the data controller for the personal data described here. Contact us about anything on this page at hello@contracked.io.
What we collect, and why
- Your email address: to create your account, verify that it's yours, send the alerts you asked for, and reset your password. Lawful basis: performance of our contract with you.
- Your business profile: the name, keywords, sectors, countries, regions and contract-value range you enter. This is what matching runs against. Lawful basis: performance of our contract.
- A password hash: we store a bcrypt hash, never the password itself.
- Your plan and a Stripe customer reference: so we know what you're entitled to. We never see or store your card details; Stripe handles payment entirely.
- Basic technical data: IP address and request metadata, used transiently for rate limiting and to keep the service from being abused. Lawful basis: our legitimate interest in keeping the service secure.
We do not collect special-category data, and we don't ask for anything about individuals other than the person operating the account.
What we don't do
- No advertising trackers, no third-party analytics, and no third-party cookies. The one measurement we do run is our own and is described below.
- No selling, renting or sharing of your data with data brokers.
- No profiling beyond matching tenders to the profile you wrote yourself.
Cookies and similar storage
We don't use cookies at all, and nothing here is shared with a third party.
The portal keeps your login tokens in your browser's local storage, plus a little session storage to remember things like your match count and where to send you after login. Those are strictly necessary to keep you logged in and the app working. Clearing your browser storage logs you out and removes them.
On the home page we run our own test of which background video works best. Your browser stores which version it was shown, so you keep seeing the same one rather than a different one each visit, and we count that a version was viewed and whether a sign-up followed. It is first-party only, it records no identifier for you, and nothing about it leaves Contracked. It isn't strictly necessary either, so we'd rather name it than bury it. To opt out, visit contracked.io/?notrack=1 once in each browser; that browser is then excluded and its sign-ups carry no version. Clearing your browser storage also clears it.
Who else processes your data
- Stripe: payments and subscription management.
- Resend: sending email (verification, password resets, your alerts).
- Anthropic: where AI bid/no-bid assessments are enabled, the tender text and your profile keywords are sent to generate the assessment. Your email address is not sent.
- Our hosting and database providers: to run the service.
Each acts as a processor under contract. Some may process data outside the UK/EEA; where they do, transfers rely on UK/EU standard contractual clauses or an adequacy decision.
Tender data
The notices themselves come from public procurement registers and are published by public bodies. Where a notice contains a named buyer contact, that came from the public record, not from us.
How long we keep it
- Account and profile data: while your account is open, then deleted within 30 days of closure.
- Billing records: kept for six years, because tax law requires it.
- Verification and password-reset tokens: stored only as a hash, and expire within hours.
Your rights
Under UK GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or provide it in a portable format. Email hello@contracked.io and we'll respond within one month. There's no charge.
You can stop marketing and alert emails at any time using the unsubscribe link at the bottom of every email. No account needed.
If you think we've handled your data badly, please tell us first so we can fix it. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.
Security
Passwords are hashed with bcrypt. Verification and reset tokens are stored as SHA-256 digests, so a copy of our database contains nothing replayable. Sessions can be revoked everywhere at once from your profile. We use HTTPS throughout.
Changes
If we make a material change to this policy we'll email account holders before it takes effect.