Our GDPR position

Data controller

The data controller for Tenders AI is Xerovi OÜ, Tööstuse tn 75-71, Põhja-Tallinna linnaosa, 10416 Tallinn, Harju maakond, Estonia. For any privacy matter, contact us at info@xerovi.com.

Legal basis

We process personal data on two legal bases: (a) performance of a contract — running the service you signed up for; and (b) legitimate interest — delivering features like geolocation defaulting and email alerts. You can object to legitimate-interest processing at any time via info@xerovi.com.

Data residency

Primary storage is in Supabase's EU (Frankfurt) region. Redis cache is EU (Dublin). Email processing occurs in Resend's EU region. AI inference calls to Google Gemini may be routed internationally under Google's Standard Contractual Clauses and their enterprise data-protection commitments — prompt content is not retained for model training.

Data retention

Account data: retained until account deletion + 30 days for reversibility. Saved tenders and analyses: deleted immediately with the account. Billing records: retained for 7 years per Estonian accounting law. Ingested TED data: retained indefinitely as it is public-domain EU data.

Your rights under Articles 15–22

• Right of access to your personal data (Art. 15).
• Right to rectification of inaccurate data (Art. 16).
• Right to erasure (Art. 17) — self-service from Billing.
• Right to restriction of processing (Art. 18).
• Right to data portability (Art. 20) — machine-readable export.
• Right to object (Art. 21).
• Rights around automated decision-making (Art. 22).

Contact & complaints

For any data-protection request, contact info@xerovi.com. You also have the right to lodge a complaint with your national supervisory authority. Our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).