Privacy Policy

SA Tenders AI, operated at satendersai.co.za, is the “Responsible Party” as defined under POPIA. We determine the purpose and means of processing your personal information on our platform. By creating an account or using the platform, you consent to the processing described in this policy.

Information Officer: As required by POPIA, we have designated an Information Officer who oversees our data-protection obligations. Queries may be directed to privacy@satendersai.co.za.

2.1 Information you provide

• Account: name, email address, phone number and password.
• Organisation: business name, CIPC registration number, role and BBBEE details you choose to add to your supplier profile.
• Tender documents you upload for AI analysis (compliance checks, Bill of Quantities extraction), and the outputs we generate from them.
• Communications: support requests, feedback and messages you send us.

2.2 Information collected automatically

• IP address, browser type, device identifiers and operating system.
• Pages visited, features used, and session activity, to keep the platform secure and improve it.

2.3 Payment information

We do not collect, store or process raw card details. All payments are handled by PayFast, a South African PCI-DSS-compliant payment processor. We receive only transaction references and status (e.g. complete, failed) needed to activate or renew your plan.

• To create and authenticate your account and organisation.
• To run the AI features you request — compliance matching, document analysis and BOQ extraction.
• To process subscription and once-off payments via PayFast, and to manage your plan.
• To send tender alerts and service notifications by email and (on eligible plans) SMS.
• To provide support, prevent fraud and abuse, and comply with our legal obligations.
• To improve platform performance and reliability using aggregated, de-identified usage data.

Under POPIA we process personal information on the following grounds:

• Contractual necessity — to provide the services you have subscribed to.
• Legal obligation — to comply with applicable South African law.
• Legitimate interest — for security, fraud prevention and product improvement.
• Consent — for optional communications such as marketing, which you may withdraw at any time.

We do not sell your personal information. We share data only with trusted operators who help us run the platform, under contract and only for the stated purpose:

• PayFast — payment processing.
• Cloud hosting & infrastructure — secure application and database hosting.
• Email & SMS providers — delivery of alerts and account notifications.
• Law enforcement / regulators — where required by law, court order or a valid regulatory request.

The tender documents you upload are used solely to generate your analysis. They are not shared with other organisations and are never published to the public supplier directory unless you explicitly mark a BBBEE profile as public.

• Account & organisation data: retained while your account is active and up to 5 years after closure, or as required by law.
• Payment records: retained for at least 5 years to meet financial record-keeping requirements.
• Uploaded documents & AI outputs: retained to give you continued access to your results; you may request deletion at any time.
• Support communications: retained for up to 3 years from last contact.

On expiry of the applicable period, data is securely deleted or de-identified.

• Access — request a copy of the personal information we hold about you.
• Correction — ask us to correct inaccurate or incomplete information.
• Deletion — request deletion where the information is no longer required lawfully.
• Objection — object to processing based on legitimate interest or direct marketing.
• Withdraw consent — at any time, without affecting prior lawful processing.
• Complain — lodge a complaint with the Information Regulator of South Africa.

To exercise any right, email privacy@satendersai.co.za. We respond within 30 days.

We apply appropriate technical and organisational measures — encrypted transmission (HTTPS/TLS), access controls, isolated per-organisation data, and regular reviews. Your session is protected by secure authentication tokens and an automatic idle-logout. In the event of a data breach that poses a risk to your rights, we will notify you and the Information Regulator as required by POPIA.

We may update this policy from time to time; the “Last revised” date above reflects the latest version and material changes will be communicated on the platform. For any privacy question:

• Information Officer: privacy@satendersai.co.za
• General support: support@satendersai.co.za
• Information Regulator of South Africa: inforegulator.org.za