Privacy policy

1. Controller and scope

Brandsparkle Sp. z o.o. is the controller of account, billing, security, and contact data. TenderHunter is a Juralex service intended for organisations and business users.

If an organisation uploads documents containing other people's data, it generally determines the purpose and scope of that processing. For that content, Brandsparkle acts as processor on the organisation's documented instructions, subject to separate legal obligations.

2. Data we process

• account data: name, business email, language, organisation, and role;
• security data: password and recovery-code hashes, encrypted 2FA secret, sessions, IP address, browser type, and audit logs;
• company data: tax and registry identifiers, address, website, capability profile, and public-registry information;
• workspace content: documents, extracted text, evidence, analyses, saved searches, alerts, and review notes;
• billing data: Stripe customer identifier, selected plan, and subscription status. Full card details remain with Stripe;
• support, privacy, and security correspondence.

3. Purposes and legal bases

4. Data sources

We receive data from the user and their organisation's administrators, payment and email providers, and public procurement and company sources, especially BZP, TED, and REGON. Public-registry information may identify company representatives.

5. Recipients and transfers

Data may be entrusted to hosting and backup providers, transactional email (Resend), payments (Stripe), and, once the deployment gate is met, the AI model provider (OpenAI). Providers receive only the data needed for their task. Stripe may act as a separate controller for some payment data.

Private documents are technically blocked from being sent to an AI model until an approved European processing configuration is active. Where access by a provider outside the EEA is necessary, we use an applicable transfer mechanism such as an adequacy decision or standard contractual clauses, with required supplementary measures.

6. Your rights

Depending on the basis and circumstances, you may request access, a copy, correction, erasure, restriction, or portability, or object to processing. Consent can be withdrawn at any time without affecting earlier processing. Send requests to privacy@juralex.eu. We may ask you to verify your identity.

You may also lodge a complaint with the President of the Polish Personal Data Protection Office. UODO complaint guidance.

7. Automated decisions

TenderHunter does not make decisions about an individual based solely on automated processing that produce legal or similarly significant effects. A recommendation concerns a business tender assessment, is advisory, and requires a user's decision. The AI transparency document explains the process.

8. Cookies

The application uses one necessary cookie, th_session, to maintain a secure sign-in. It is HttpOnly, Secure in production, SameSite=Lax, and expires after 14 days. We do not use advertising or analytics cookies. If that changes, we will update this policy and request consent where required.

9. Changes and contact

We will give notice of material changes in the application or by email, with lead time appropriate to their significance. Send privacy questions to privacy@juralex.eu.

GDPR text on EUR-Lex