Privacy Policy

CloudNala (Pty) Ltd (registration number 2023/851288/07) is the responsible party for personal information collected through this platform. We are incorporated in South Africa and operate from Sandton, Gauteng, South Africa.

Privacy and data-rights requests can be submitted through our contact page.

We collect the following categories of personal information:

• Account information: your name, email address, and company name when you register for an account.
• Usage data: pages visited, tenders viewed, searches performed, and features used on the platform.
• Document content: tender documents you upload for analysis, and the content our AI analysis extracts from them.
• Communication data: messages you send us through the contact form or by email.
• Payment information: billing details for paid subscriptions, processed securely by our payment provider (Yoco). We do not store card details.
• Device and technical data: IP address, browser type, and device identifiers for security and functionality purposes.

We process your personal information for the following purposes:

• To provide you with access to the TenderCity platform and its features, including AI-assisted document analysis.
• To send you tender alerts and notifications you have subscribed to (email and, where enabled, WhatsApp).
• To process subscription payments and manage your account and credit balance.
• To respond to your enquiries and provide customer support.
• To improve our platform based on how users interact with the service.
• To comply with legal obligations and prevent fraud or abuse.

Document intelligence, go/no-go scoring, and response drafting are performed using third-party AI providers (currently OpenAI and Google Gemini). When you upload a tender document or request an analysis, relevant content is sent to these providers for processing under their own data processing terms. We do not permit these providers to use your data to train their models.

The tender and award data displayed on TenderCity is sourced from public procurement portals, government gazettes, and publicly available sources. This data is public information. We do not collect personal information about individuals listed in tender documents unless you are a registered platform user.

We do not sell your personal information. We may share information with:

• Service providers: hosting (Google Cloud), database (Supabase), payment processing (Yoco), email delivery (Resend), and AI analysis providers (OpenAI, Google) who process data on our behalf.
• Legal and regulatory authorities: where required by South African law, court order, or to protect our rights.
• Business transfers: in the event of a merger, acquisition, or sale of assets, your information may be transferred to the successor entity.

Some of our service providers process and store data outside South Africa — notably, our database provider (Supabase) stores data in the European Union (Ireland), and our hosting provider (Google Cloud) and AI analysis providers (OpenAI, Google) may process data in other countries.

Under section 72 of POPIA, we may only do this where the recipient country provides a level of protection substantially similar to POPIA, or another basis in section 72 applies. We rely on this being the case for our EU-based processing: the European Union’s GDPR is a comprehensive data protection framework, and our providers operating in the EU are bound by it and by data processing agreements incorporating Standard Contractual Clauses. Transferring your data is also necessary for us to provide you the service you’ve signed up for, which is an independent basis under section 72.

We retain your personal information for as long as your account is active or as needed to provide services. Account data is deleted within 30 days of a verified account deletion request. Usage logs may be retained for up to 24 months for security and audit purposes.

Under the Protection of Personal Information Act, you have the right to:

• Know what personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion of your personal information (subject to legal retention requirements).
• Object to the processing of your personal information for direct marketing.
• Lodge a complaint with the Information Regulator of South Africa.

To exercise any of these rights, contact us through our contact page. We will respond within 30 days.

We implement technical and organisational measures to protect your personal information, including encryption in transit (TLS/HTTPS), row-level access controls on our database, and access-limited service accounts. However, no internet transmission is completely secure and we cannot guarantee absolute security.

We use only essential cookies required for the platform to function — signing you in and keeping your session secure. See our Cookie Policy for details.

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email and by posting the updated policy on this page with a revised “Last updated” date.

For any questions about this Privacy Policy or your personal information, use our contact page.

You may also contact the Information Regulator of South Africa at inforegulator.org.za.