Privacy Policy · DevTender

1Who we are

DevTender (devtender.ai) helps consulting firms find tenders from development banks and UN agencies and prepare their bids. It is run by Limited Liability Company “First Byte” (ООО «Первый Байт»). First Byte is registered in the Republic of Tajikistan and is a resident of the IT Park technology park. Its address is 45 M. Tursunzoda Street, office 408, Dushanbe 734001, Republic of Tajikistan.

In this policy, “we” and “us” mean First Byte. “You” means anyone who visits devtender.ai or uses DevTender.

2What this policy covers

This policy covers the devtender.ai website, the DevTender app, the DevTender browser extension, the Send to DevTender bookmarklet, and the emails we send about DevTender. It does not cover the websites of banks, UN agencies or other buyers you visit, or Google. Those have their own policies.

We follow the Law of the Republic of Tajikistan on personal data protection. Where it applies to you, we also follow the EU General Data Protection Regulation (GDPR).

3Your firm’s data, and ours

Your firm decides what goes into its DevTender: its files, its people’s CVs and its bids. For that data we only follow your firm’s instructions, as its service provider (the GDPR calls this a “processor”). Your firm must have the right to give us that data. For example, it should tell its experts that their CVs are kept in DevTender.

For your account, visits to our website and the emails we send, we decide how the data is used, and we are responsible for it (the GDPR calls this a “controller”). If your firm needs a data processing agreement, write to us.

4What we collect

Your account: your name and email address, and your password, kept only as a one-way hash that no one can read. Also your role in your firm, your settings, when you signed in, and security actions such as a password change.
Invitations: the email address of anyone your firm invites, who invited them and their role. An invitation link expires after 7 days.
Your firm’s record: the files you add, kept as you gave them, and the text read from them. Also the facts you confirm, your people and their CVs, your partners, registrations and past projects, and the website and LinkedIn addresses you give us.
Your bids: the tender documents you bring, drafts, your team, the choices you make and the packages you download.
Pages you send with the DevTender extension or the Send to DevTender bookmarklet: the address, title and visible text of the page, taken only when you click (section 8).
Google Drive, if your firm connects it: the files you pick, read only (section 7).
What you tell us: messages you send through “Tell us” in the app, and emails to us. When the app fails in your browser, we also get an error report with the error message and the page’s address, never what was on the page.
Technical data: our servers and Cloudflare handle your IP address and browser details to deliver the site and protect it, for example to stop repeated sign-in attempts.

DevTender takes no payments today, so we collect no payment details. If that changes, we will update this policy first. We never ask for sensitive data such as health or religion. A CV may contain personal details such as a date of birth or nationality. We keep those only as part of your firm’s record.

5How we use it

To run DevTender for your firm: read your files, match tenders to your record, check whether you are eligible, draft parts of your proposal, put your team together and build your package.
To keep your account safe and DevTender working: signing in, fixing errors and stopping misuse.
To send emails about DevTender: invitations, password resets and important notices about the service or these documents. We send no marketing emails unless you agree to them.
To answer you when you write to us.
To improve DevTender, using what you tell us and error reports.

We don’t sell your data, we don’t show ads, and we don’t use your firm’s files, CVs or bids to train AI models.

We use your data because we need it to provide DevTender under our agreement with your firm, because we have a legitimate interest in keeping it safe and working, because the law requires it, or because you agreed (where we ask you).

6Where AI reads it

Some tasks use AI: reading a file, checking a tender against your record, and drafting part of your proposal. For each of these, the text the task needs is sent to OpenAI’s API. Under OpenAI’s API terms it is not used to train their models. OpenAI may keep it for up to 30 days to detect abuse, then deletes it.

AI can be wrong. DevTender shows you what it drafted so you can check it. It never sends anything to a buyer.

DevTender makes no automated decisions about people that have legal or similarly important effects on them. When it compares an expert’s CV with a tender, it only suggests. Your firm decides.

7Google Drive

If your firm connects Google Drive, DevTender asks Google for read-only access to the files you pick. It can also get folders you pick, but only if your firm turns that on. DevTender reads those files just like files you upload, to add them to your firm’s record, including through OpenAI’s API as section 6 describes. It never changes, moves or deletes anything in your drive. The access key Google gives us is stored encrypted. You can disconnect at any time, in DevTender or in your Google account.

DevTender’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Neither we nor OpenAI use data from Google to train AI models, and we never use it for advertising.

8The DevTender browser extension

The DevTender extension for Chrome and Edge brings the tender page you are on into your DevTender, when you click its button. The Send to DevTender bookmarklet does the same and reads the same.

It reads only the page you click it on, and only when you click. Nothing runs in the background.
From that page it reads the address, the title and the visible text. It never reads your passwords, what you type into forms, your browsing history or cookies from other sites.
It reads one of DevTender’s own cookies, a security token for devtender.ai, so that DevTender knows the request comes from you.
It sends the page only to DevTender, signed in as you, and stores nothing in your browser.

The use of information received from the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

10Where it is kept

Your data is kept on our server in Nuremberg, Germany. Every night it is backed up. Each backup is encrypted on that server before it leaves, then stored with Cloudflare R2.

Some of the companies in section 9 handle data in other countries, including the USA and Switzerland. Each of them protects the data under a data processing agreement with us. Where the GDPR applies, these agreements include the EU’s standard contractual clauses.

11How long we keep it

Your account and your firm’s data: while your firm’s account is open.
When your firm closes its account or asks us to delete its data: we delete its records, files and bids within 30 days. Backups that still hold them expire within 14 days after that. If you want a copy of everything, ask for it first.
Invitation links: 7 days. Password reset links: 1 hour when sent by email, 1 day when an administrator creates one.
Messages to us: as long as we need them to help you.
Anything the law requires us to keep: for as long as the law requires.

12How we protect it

Connections to DevTender are encrypted (HTTPS). Passwords are kept only as one-way hashes. Backups are encrypted before they leave our server. Each firm’s data is kept separate from every other firm’s.

To run the service, the DevTender team sees firm names, bid titles and how much AI each firm has used. The team sees what is inside a bid only if your firm allows support access to that bid. Support access lasts seven days, and every view is logged.

No system is perfectly secure. If a breach puts your data at risk, we will tell you and the authorities without undue delay, as the law requires.

13Your rights

You can ask us to:

show you the data we hold about you, and give you a copy;
correct it;
delete it;
limit how we use it, or object to a use;
give it to you in a common format, to take to another service;
stop using it where you agreed to a use (you can change your mind).

Write to [email protected] and we will answer within 30 days. If a firm added your CV or other details about you, that firm decides about that data. We will pass your request to the firm and help it answer. You can also complain to a data protection authority, for example where you live or work.

14Cookies

DevTender uses only the cookies it needs to work: one keeps you signed in (procura_session), one remembers you on your device (procura_remember), and one is a security token (procura_csrf). Cloudflare may add a security cookie that tells people from bots. We use no advertising or tracking cookies, so we don’t need to ask for your consent to cookies.

15Children

DevTender is for firms and the people who work for them. It is not for anyone under 18, and we don’t knowingly collect data about children.

16Changes to this policy

When we change this policy, we will post the new version on this page with its date. If a change is important, we will also tell you by email or in the app, at least 14 days before it applies.

17Contact us

LLC “First Byte” (ООО «Первый Байт»), resident of IT Park
45 M. Tursunzoda Street, office 408, Dushanbe 734001, Republic of Tajikistan
[email protected]