TenderHawk

Privacy Policy

Who we are

Asban Inc. (“Asban”, “we”), a corporation under the laws of Québec, Canada, operates TenderHawk at https://app.tenderhawk.ca. Privacy officer / questions: contact@tenderhawk.ca.

Scope

This policy covers the TenderHawk web application, transactional email, and the public marketing site only as they share a brand. It applies to invited users, the companies they represent, and people who write to us via the contact form.

Law

We comply with Québec’s Act respecting the protection of personal information in the private sector as amended by Law 25, and with PIPEDA for interprovincial and international disclosures. Where they differ, we apply the stricter rule to Québec residents.

What we collect — accounts

Name, email, hashed password, role (platform admin / manager / member), language (`en`/`fr`), digest frequency (daily / weekly / off) including a per-company choice, whether opportunity emails are aligned-only, last digest timestamp, newsletter opt-in, chosen AI models per action, invite and password-reset tokens (time-limited), and email-confirmation tokens for public sign-up.

What we collect — companies

Legal and trade names, website, address, activity region, languages, business type, headcount, diversity / Indigenous designations, about / mission / values, exceptions, uploaded knowledge documents and extracted text, brand logo and palette, service lines, keywords, and encrypted third-party portal usernames and passwords the company chooses to store so TenderHawk can fetch bid documents.

What we collect — procurement work

Notices copied from public portals (title, buyer, dates, descriptions, attachments), the company’s match scores and verdicts, shortlist / dismiss timestamps, user-uploaded files on a notice, executive briefs, chat questions and answers, citations, token counts and model names used for metering, bid workspace text and exports, public contract awards (winner, value, award date), and supplier profiles rebuilt from those awards. An incumbency note on an opportunity repeats what the public record shows; it is not a judgment about the supplier.

What we collect — tenants / billing

Tenant name, status, Stripe customer and payment-method identifiers (not full card numbers; Stripe stores those), credit balance, credit packages, auto top-up settings, billing name, street, city, province or territory, and postal code (used to calculate GST, HST or QST), invoice records (number, subtotal, tax, tax label), and encrypted per-tenant object-storage keys.

What we collect — contact form

Name, email, message, and the submitting IP (for rate limiting).

What we collect — technical

Session cookies required to stay signed in; CSRF token; localStorage keys `th-theme` and `th-nav` (theme and sidebar, device-local, not sent to us). Bunny Fonts loads Archivo and Public Sans.

Why

Provide the service (match notices, generate briefs, answer document-grounded questions, store files, bill credits); send the digest the user chose; send optional newsletter later; secure the service; answer contact requests; improve reliability. We do not sell personal information. We do not use personal information for third-party advertising.

Automated decision-making (Law 25)

TenderHawk uses machine-learning models to score whether a public notice appears relevant to a company profile (triage) and to draft research briefs and chat answers. These outputs are decision-support. They are not a legal determination of eligibility or a binding bid. A user can always read the source notice, override the verdict, and ignore a brief. You may request information about the personal information used to generate a recommendation by writing to contact@tenderhawk.ca.

AI models we run

A manager can choose, per action, an OpenAI model or a Google Gemini model. OpenAI is used for chat, structured output, vision and embeddings. Gemini is used for chat, file search, vision, document extraction and research briefs. Prompts may include company profile text, notice text, and document excerpts the user or a public portal supplied. We do not use customer content to advertise. Providers’ own data-use terms apply to the API traffic they receive.

Who else receives data

  • Stripe (United States) — payment processing, payment methods and invoices.
  • OVH (Beauharnois, Québec) — infrastructure and object storage used to host platform data, documents and uploads.
  • Amazon Web Services / Amazon SES — transactional email delivery, including invitations, password resets, notifications and digests. Email addresses and the contents of messages may be processed for delivery.
  • OpenAI (United States) — AI model inference and embeddings when OpenAI-powered features are used.
  • Google Gemini (United States) — AI model inference and file-search functionality when Gemini-powered features are used.
  • Bunny Fonts — font delivery. When fonts are loaded from Bunny's infrastructure, Bunny may receive standard connection information such as IP address, browser information and referring origin.

Transfers outside Québec

OpenAI, Google, Stripe, and Amazon SES process in the United States. Law 25 requires us to assess privacy protection before such a transfer. We do it because those processors are integral to payments, email delivery and model inference and we contract them as service providers. You may write to the privacy officer for more detail.

Retention

Account and company data last for the life of the tenant contract, then are deleted or anonymized within 90 days of a written deletion request or contract end, except records we must keep for tax, dispute, or security logs (up to 7 years). Password-reset tokens expire in 60 minutes; invite tokens in 72 hours. Contact-form emails are kept in the inbox as ordinary business correspondence.

Security

Passwords hashed; portal credentials and tenant cloud keys encrypted at rest; documents streamed through the app rather than public URLs; role-gated admin; per-tenant databases and buckets.

Your rights (Law 25 / PIPEDA)

Access; rectification; withdrawal of consent where processing is consent-based (newsletter, optional portal credentials); data portability where required; to be informed of processing and of automated decisions; to lodge a complaint with Asban and with the Commission d’accès à l’information du Québec (https://www.cai.gouv.qc.ca) or the Office of the Privacy Commissioner of Canada. Identity will be verified before access. We respond within 30 days.

Children

The service is for organizations. We do not knowingly collect information from children under 14.

Changes

Material changes will be posted on this page with a new “Last updated” date and, where Law 25 requires, notified to affected users.

Last updated

18 August 2026