Privacy Policy

This policy explains how Licitora (licitora.eu) processes personal data under the EU General Data Protection Regulation (GDPR).

1. Who is responsible

The controller is Alina Kovtun, Gdansk 80-416, NIP 5842834961, REGON 525274099 ("we", "us"). For any privacy question or request, write to hello@licitora.eu. We have not appointed a data protection officer, as we are not required to.

For personal data that customers add to their workspace about their own team, we act as a processor on the customer's behalf under our Data Processing Agreement.

2. What we process and why

Visiting the website. Our hosting provider processes your IP address, browser details and the requested page to deliver the site and protect it from abuse (legitimate interest, Art. 6(1)(f) GDPR). We do not use advertising or tracking cookies and do not build visitor profiles.

Demo and CPV finder. When you enter a company website in the demo, we fetch the public pages of that website, extract the text and use AI to build a company profile and find matching tenders. We store the website address, the generated profile and results, and a one-way hash of your IP address (salted SHA-256, not your IP itself) to enforce usage limits. Cloudflare Turnstile checks that you are not a bot. Basis: legitimate interest in providing the demo and preventing abuse (Art. 6(1)(f)).

Your account. Email address, optional name, language, sign-in records (by Supabase Auth), workspace and team membership, and your plan. Basis: performance of the contract (Art. 6(1)(b)).

Using the Service. Company profiles (name, website, description, keywords, CPV categories, countries, value range), the website text used to build them, your saved tenders, statuses, match feedback (relevant / not relevant verdicts, optional reason and note) and settings such as digest time and time zone. To score and summarise tenders, we send the company profile, tender texts and anonymised feedback examples (never your email address) to our AI provider to improve the relevance of your results. Basis: contract (Art. 6(1)(b)).

Emails. We send sign-in links, the daily digest of matching tenders, deadline reminders, trial and account notices, team invitations and, where relevant, billing notices. We log which emails were sent to avoid duplicates. Each digest contains a one-click link to stop it. Basis: contract (Art. 6(1)(b)). We do not send marketing newsletters without your consent.

Payments. Paddle.com, our Merchant of Record, collects your payment and billing details and acts as an independent controller for them (see Paddle's privacy notice). We receive from Paddle your subscription status, plan, billing email and country, and invoice references. Basis: contract and legal obligations for accounting (Art. 6(1)(b) and (c)).

Product statistics and security. We record usage events (for example "tender opened" or "digest sent") linked to your workspace to understand how the Service is used and improve it, and technical logs and error reports to keep it secure and working. Error reports are configured not to include IP addresses, cookies or request bodies. Basis: legitimate interest (Art. 6(1)(f)).

Support. If you write to us, we process your message and contact details to answer it (Art. 6(1)(b) or (f)).

Feature requests and votes. When you submit a feature request or vote on one in the app, we store the request text, type and your vote. Published requests are visible to other customers without your name or company. Basis: contract (Art. 6(1)(b)). You can delete your request by contacting us at hello@licitora.eu.

Business contacts from public award notices. To offer the Service to companies that take part in public tenders, we use company names and business contact details (company website, generic or business email address, country) published in contract award notices on TED. We may contact such companies about the Service where the law allows, and every message explains how to object. Basis: legitimate interest in B2B marketing (Art. 6(1)(f)). You can object at any time at hello@licitora.eu; we then mark the contact as "do not contact" and stop.

Company profile pages from public award notices. We publish profile pages for companies that have won public contracts, using data from contract award notices published on TED (company name, country, awarded contracts and their values). We publish pages only for legal entities with at least three awards in the last 12 months, never for individuals or sole traders. These pages exist as long as the company has award data from the last 12 months. Basis: legitimate interest in providing transparency about public procurement (Art. 6(1)(f)). If you represent a listed company and want to request a correction or removal, contact us at hello@licitora.eu or use the contact form. We process opt-out requests within 24 hours.

3. Where your data is processed

The main database runs in the EU (Frankfurt, Germany) and the application in Frankfurt. Some providers are based in, or may access data from, the United States or the United Kingdom. Transfers outside the EEA rely on an adequacy decision (including the EU–US Data Privacy Framework for certified providers, and the decision for the United Kingdom) or on the European Commission's Standard Contractual Clauses. The current list of providers, purposes and locations is on our Subprocessors page.

Our AI provider (Anthropic) does not use data sent through its API to train its models and keeps it only for a limited period under its commercial terms.

4. How long we keep data

• Account and workspace data: while your account exists. When you delete your workspace or account in Settings → Privacy, the data is deleted immediately from the live database and disappears from backups within 7 days. Usage statistics are kept afterwards only without a link to you.
• Demo runs (website, profile, results, hashed IP): 30 days.
• Rate-limit records: 1 day.
• Payment webhook records from Paddle: 90 days.
• Billing and accounting records: as long as tax law requires (in Poland, generally 5 years from the end of the year).
• Support emails: up to 3 years after the conversation ends.
• Business contacts from award notices: up to 24 months after our last contact, or until you object.
• Company profile pages: while the company has award data from the last 12 months, or until the company requests removal.
• Feature requests and votes: while your account exists, or until you request deletion.
• Workspaces without a paid plan and without sign-in for 12 months may be deleted after an email notice at least 30 days in advance.

5. Cookies and local storage

We use only what is necessary for the Service to work, so no consent banner is needed:

Name	Purpose	Duration
sb-…-auth-token	Keeps you signed in (Supabase Auth)	Session, refreshed while signed in
demo_run_id	Shows your demo result after you sign up	7 days
NEXT_LOCALE	Remembers the site language	Session
theme (local storage)	Remembers light or dark mode	Until cleared
Cloudflare Turnstile	Bot check on the demo and tools	Session
Paddle checkout	Set by Paddle only when you open the checkout	See Paddle's notice

6. Your rights

You have the right to access your data, to rectify it, to have it erased, to restrict processing, to data portability, and to object to processing based on legitimate interest, including direct marketing at any time. Many of these you can do yourself: Settings → Privacy offers a full data export and deletion of your workspace or account. For anything else, write to hello@licitora.eu; we answer within one month.

You may also lodge a complaint with a supervisory authority, in Poland the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or with the authority in your EU country.

7. Security

Data is encrypted in transit (TLS) and at rest. Access to each workspace is enforced in the database (row-level security), administrative access is limited and protected with two-factor authentication, IP addresses are stored only as salted hashes, and websites are fetched through a filter that blocks internal network addresses.

8. Automated decisions

Relevance scores decide which tenders appear in your feed and digest. They only help you choose which public tenders to look at: they do not produce legal effects for you, and every tender remains available in full on TED. No decision with legal or similarly significant effect is made solely by automated means.

9. Changes

We update this policy when our processing changes and show the date at the top. For material changes we inform account owners by email.