# **Privacy Policy – TendersAlerts Platform**

**Version:** 2.1
**Effective date:** 2026-09-10

## **1. Introduction and Scope**

This policy explains how personal data is collected, processed and protected when you use the **TendersAlerts.com** platform, its applications and its services (the **"Platform"**).

This policy applies to every means of accessing the Platform: the website, the mobile applications, the MCP server, and the Application Programming Interface (API) product, and it applies to visitors, registered users, subscribers and customers alike.

This policy is to be read together with the **Terms of Use** published on the Platform, of which it forms an integral part. Use of the API product is additionally governed by the **API Terms of Use** published on the Platform.

## **2. Data Controller**

The controller of personal data is **Evotik Innovations FZ-LLC** (the **"Company"**, **"we"** or **"us"**), which owns and operates the Platform.

For any matter relating to privacy or to the exercise of your rights:

**[privacy@tendersalerts.com](mailto:privacy@tendersalerts.com)**

## **3. Data We Collect**

### **3.1 Data you provide to us directly**

- Account data: name, email address, mobile number, password.
- Organization data: organization name, activity, city.
- Verification documents: commercial registration, Ministry of Labour file number, national ID or residency permit.
- Subscription and billing data: plan, subscription date, transaction history, and the data required to issue invoices and meet tax obligations.
- The content of your correspondence with us: support messages, complaints, enquiries, and any associated recordings or conversations.
- Your preferences: notification settings, activities and regions of interest, saved filters.

**We do not store bank card details on our systems.** Payments are processed by a licensed payment service provider, and we retain only the transaction reference and the last digits of the card where necessary.

### **3.2 Data collected automatically**

- Technical data: IP address, device and browser type, operating system, device identifiers, interface language.
- Usage data: pages you visit, tenders you view, searches and filters, login times, and usage rates.
- Anonymized recordings of browsing sessions and interaction maps (clicks and scrolling), with **field and text content masked**, so that what you enter into forms and what your account displays is not captured.
- Programmatic access logs: requests issued by integration keys or API keys linked to your account, and requests received through the MCP server in accordance with Article (7.3).
- Data collected through cookies and tracking technologies, in accordance with Article (6).

Some of this data is collected in order to verify compliance with usage limits and to prevent account sharing and misuse, as set out in the Terms of Use.

### **3.3 Data from external sources**

The Platform relies on government tender data published in official sources and available to the public. This data may include information relating to natural persons, such as the contact details of representatives of participating entities or companies.

This data is processed as **officially published data for a legitimate purpose**, namely enabling organizations to study tenders and prepare to participate in them, and it is not used for marketing directed at the individuals concerned.

We may also obtain an organization's logo or visual identity elements from publicly available sources, such as the organization's website or its official accounts, in order to display them within your account on the Platform and in the context of describing the service, in accordance with Article (5).

## **4. Purposes of Processing and Legal Basis**

PurposeLegal basisCreating, operating and maintaining the account and delivering the servicePerformance of contractProcessing subscriptions and payments and issuing invoicesPerformance of contract / legal obligationVerifying identity and organization statusLegal obligation / legitimate interestSending tender alerts according to your preferencesPerformance of contractEnabling access to your account data through the MCP server or the APIPerformance of contractTechnical support and responding to enquiriesPerformance of contractImproving the Platform, developing services and analysing performanceLegitimate interestPreventing fraud and misuse and verifying usage limitsLegitimate interestProtecting intellectual property rights and detecting unauthorized data extractionLegitimate interestDirect marketing and promotional messages to our existing customers regarding similar servicesLegitimate interest, with an unsubscribe option in every messageDirect marketing to non-customersConsentComplying with regulations and responding to requests from competent authoritiesLegal obligation## **5. Use of Customer Names and Logos**

We may wish to display your organization's name or logo among the Platform's customer listings on our website or in our marketing materials.

- An organization's name and logo are **not personal data**, and their use is governed by a separate clause in the **Terms of Use**, not by this policy.
- You may at any time request that we stop displaying your organization's name or logo by contacting us, and we will action the request within **thirty (30) days**.

## **6. Cookies and Tracking Technologies**

We use cookies and similar technologies such as device identifiers, pixels and analytics tools, for the following purposes:

CategoryPurposeNecessaryLogin, security, session persistence, device tracking, preventing account sharing and misuseFunctionalSaving preferences, language and display settingsAnalyticsMeasuring usage and browsing patterns and improving Platform performanceMarketing / AdvertisingMeasuring campaign impact and retargeting- The **Necessary** category is an essential part of how the Platform operates and how compliance with the Terms of Use is verified, and it cannot be disabled while the account remains in use.
- The **Functional, Analytics and Marketing/Advertising** categories are enabled based on your consent through the preference management tool available on the Platform, and you may withdraw your consent or change your choices at any time through that same tool.
- Cookie lifetimes vary by category and purpose; some expire at the end of the session, and others persist for longer, up to a maximum of **twelve (12) months**.
- You may also control or delete cookies through your browser settings, noting that disabling the Necessary category may prevent the Platform from working correctly or prevent access to your account.

## **7. Data Sharing and Service Providers**

We do not sell your personal data. We may share it only in the following cases:

### **7.1 Service providers (processors acting on our behalf)**

We engage technical service providers who process data on our behalf, under our instructions, and under processing agreements defining their confidentiality and protection obligations. Their categories include:

CategoryExample providersPurposeCloud hosting and infrastructureAmazon Web Services (AWS), Hetzner, ContaboOperating the Platform and storing dataPayment and subscription management providersStripe, Apple, RevenueCatProcessing subscriptions and payments, including in-app purchases, and managing subscription status and renewalEmail and messagingArsel.ai (a platform owned by the same company)Sending alerts and operational and marketing messagesInstant messaging and WhatsApp supportWhatsApp Business (Meta), ManyChatCommunicating with customers, sending alerts and responding to enquiriesAnalytics and performance measurement toolsGoogle Analytics, Microsoft ClarityUnderstanding usage and browsing patterns and improving the service, including session recording and interaction maps, with content masking fully enabledMarketing and advertising platformsMeta (Facebook / Instagram), Google Ads, X (Twitter)Managing campaigns, measuring their impact and retargetingArtificial intelligence servicesOpenAI, AnthropicPowering certain analysis and processing features within the PlatformWe may engage additional providers within the same categories, and we update this table when a material change occurs.

**User data is not used to train artificial intelligence models.** We do not train any model on your data, and the AI service providers listed above are not permitted to use data sent to them to train or improve their models, under the contractual terms agreed with them.

### **7.2 Other cases**

- **Competent authorities**: where there is a legal or judicial request, or to comply with a legal obligation.
- **Protection of rights**: where necessary to establish, exercise or defend legal rights, including cases of misuse or unauthorized data extraction.
- **Corporate transactions**: in the event of a merger, acquisition or transfer of assets, with notice to users and a commitment by the receiving party to this policy.

### **7.3 Access via the MCP Server, the API and AI Assistants**

The Platform allows you to connect your account to external AI tools and assistants through the **MCP server** or through the **API**. This case differs from Article (7.1): the receiving party here is not a processor acting on our behalf, but a tool **you choose** and grant permission to access your account.

**How the connection works:** the connection is made through an OAuth authorization that you grant explicitly. Your username and password are never transmitted to the tool under any circumstances — only an access token linked to your account.

**What the tool can access:** once connected, the tool can read the tender data available to your account, read your notification settings and the email address associated with them, and create, modify or archive notification settings. It cannot access your password, your payment data or your identity verification documents.

**Who is responsible for the data once transferred:** once data reaches the tool you have chosen, it is subject to that tool provider's own privacy policy, and we do not control how it is stored or used there. We recommend reviewing the privacy policy of any tool before connecting it to your account.

**Revoking the connection:** you may revoke the authorization at any time from your account settings on the Platform or from within the tool itself, and access stops immediately. Revoking the connection does not delete data the tool has already obtained.

**Logs:** we retain a log of requests received through the MCP server and the API for security purposes and to verify usage limits, for the periods set out in Article (9).

## **8. Transfers of Data Outside the Kingdom**

Some data may be processed or stored with service providers outside the Kingdom of Saudi Arabia.

In such cases we take the necessary measures in accordance with the Personal Data Protection Law and its implementing regulations, including verifying the adequacy of the level of protection at the receiving party, entering into appropriate contractual safeguards, and limiting the transfer to what is necessary for the purpose.

## **9. Data Retention**

We retain data for as long as is necessary to achieve the purpose for which it was collected, after which we delete it or render it anonymous, as follows:

Data typeRetention periodAccount and profile dataFor the life of the account, then **ninety (90) days** after closureFinancial records and invoices**Ten (10) years**, in line with financial and tax regulationsIdentity verification documentsFor the duration of the contractual relationship, then **ninety (90) days**, unless a longer period is required by lawUsage and login logs**Twelve (12) months**MCP and API access logs**Twelve (12) months**Support correspondence**Twenty-four (24) months** after the request is closedAccess and authorization tokens (OAuth)Until expiry or revocation of the connection, whichever comes firstOfficially published tender dataRetained as reference data about tenders, unlinked to any specific account## **10. Data Security**

We apply technical and organizational controls including encryption in transit, access control, access logging, and periodic review of systems.

Nevertheless, the security of any means of transmission over the internet cannot be absolutely guaranteed, and you are responsible for keeping your login credentials and access keys confidential.

In the event of a personal data breach likely to cause you harm, we undertake to notify the competent authority and those affected within the periods and in accordance with the procedures prescribed by law.

## **11. Your Rights**

Under the Personal Data Protection Law of the Kingdom of Saudi Arabia, you have the right to:

- **Be informed**: to know the legal basis for and purpose of collecting your data.
- **Access**: to request to view the data we hold about you and to obtain a copy of it.
- **Obtain a copy in a machine-readable format**.
- **Rectification**: to request correction, updating or completion of your data.
- **Erasure**: to request deletion of your data once it is no longer needed, subject to what we are legally required to retain.
- **Withdraw consent**: where processing is based on consent, without affecting the lawfulness of prior processing.
- **Object**: to processing based on legitimate interest or to direct marketing.

To exercise any of these rights, contact us at the address given in Article (2). We may request proof of identity before actioning the request. We respond within **thirty (30) days** of the request being complete.

If you are not satisfied with our response, you have the right to lodge a complaint with the **Saudi Data and Artificial Intelligence Authority (SDAIA)**, the authority competent to supervise the application of the Personal Data Protection Law in the Kingdom.

## **12. Children's Privacy**

The Platform is intended for professional and commercial use and is not directed at anyone under **eighteen (18) years of age**. We do not knowingly collect children's data, and if we become aware that we have, we take steps to delete it.

## **13. Changes to This Policy**

We may update this policy from time to time by updating this page, the version number and the effective date.

Where we make a material change affecting how your personal data is processed, we undertake to notify you by email at your registered address or by notice within the Platform before the change takes effect.

## **14. Contact Us**

For any privacy-related enquiry, request or complaint:

**[privacy@tendersalerts.com](mailto:privacy@tendersalerts.com)**

For technical support and general enquiries:

**[care@tendersalerts.com](mailto:care@tendersalerts.com)**