Privacy

Short, because the product does little worth writing at length about. The bureau reads public procurement notices and the profile you give it. It has no interest in anything else.

What is stored

  • Your account: email address, name, and a hashed password. Passwords are never stored in a recoverable form.
  • Your company profile: the overview, disciplines and past projects you enter, plus an optional address for emailed reports.
  • Your corpus: the public procurement notices you have scraped, chunked and embedded — held against your account and nobody else's.
  • Your runs: search history, tender assessments, rankings and the token ledger explaining every charge.

Where it is stored

  • On self-hosted infrastructure, in a PostgreSQL database that is not exposed to the internet.
  • Embeddings are computed locally on that same machine. Your profile text is not sent to a third-party embedding service.

What leaves the server

  • Notice text and your company profile are sent to Anthropic's API when — and only when — you start an analysis run. That is the one outbound transfer of your content, and it is the thing you are charged for.
  • Emails, when you ask for one, go through Resend. The report PDF is the attachment.
  • If you open Chloe, the site guide — the button in the corner of every page except the sign-in screens — what you say or type goes to Deepgram. See below.
  • Nothing else is transmitted. There is no advertising pixel, and no third-party font or asset request on any page.

Chloe, the site guide

  • She is not running until you open her. There is no session, no microphone and no connection until you press the button, and closing the panel ends all three.
  • What you type or say is sent to Deepgram, which transcribes it and answers using Anthropic's Claude, then speaks the reply back. The session is opted out of Deepgram's model-improvement programme, so none of it trains anybody's model.
  • The conversation is not stored. It exists in your browser tab and nowhere else — nothing about it reaches the bureau's database, and closing the tab is the whole of the deletion process.
  • Chloe knows only what is published on this site. She has no access to any account, cannot run a search, cannot change a setting, and cannot look anything up about you — not your profile, not your runs, not your balance.
  • If you are signed in she can open a page of your workspace, in the way a link does. She cannot open one you could not have opened yourself: every one of those pages checks your session on the server, and the admin pages check it again.
  • The microphone is only ever live while you are in a voice session, and your browser shows its own recording indicator throughout. Typing instead sends no audio at all.

Isolation between accounts

  • Every stored row carries an owner. Corpus, searches, profiles, presets and analyses are per-account by construction, not by filtering after the fact.
  • The practical cost of that choice is that each account scrapes and embeds public notices for itself rather than sharing a pool. That is deliberate.

Deletion

  • Deleting your account removes your sessions, corpus, searches, profiles and analyses with it — the database enforces this, rather than relying on a cleanup job.
  • Ask, and it will be done.

Want to know what we hold on you?

Ask, and you will get a straight answer — or a deletion, which takes your corpus and your profile with it.

Ask the bureau