Privacy

Privacy policy

TenderFill handles ID numbers, tax reference numbers, bank details and the tender documents you upload. This is what happens to them.

Who is responsible

TenderFill is operated by Sinneo Group Pty Ltd, the responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA). Questions, requests and complaints: info@sinneogroup.co.za.

The free SBD 4 and SBD 9 tool keeps nothing

What you type into the free tool is sent once to our server, turned into a PDF in memory and sent straight back to your browser. It is not written to a database or a file, not emailed, not logged and not counted. There is no account and no email address involved.

What we collect when you have an account

Your email address, to send sign-in links. PayFast emails your payment receipt.
Your company profile: registered name, CIPC, tax, VAT and CSD numbers, addresses and contact details, declarations, B-BBEE and CIDB details, ownership percentages and bank details.
Directors, members and partners: full name, ID number, personal tax reference, role, whether they may sign for the business, and whether and where they are employed by the state.
Supporting documents you upload: the file, what kind of document it is, its issue and expiry dates as you enter them, and who uploaded it. When you ask, the text of a PDF you uploaded is read on our server to suggest details for your profile. The text is not kept, nothing is saved until you save your profile, and no file is sent to any other service.
A record of access: each time a download link for one of your documents is issued, the time, the account and the network address it was issued to, and each time a document is read to suggest profile details.
Each pack: the tender details you enter, the answers for that bid, the generated PDF, and a record of which value came from where.
Payment status: a PayFast reference and the date paid. PayFast handles your card or bank details; we never receive them.
Tender packs you upload for a check: the files, the text of each page, and the findings we produce with the page and words each one cites. A tender pack can contain other people’s details, such as a buyer’s contact officer, so we treat it as personal information too. We do not ask for your own bid and do not read it: the check covers your company’s readiness, not your bid.
Past bids you add to your bid library: the files and the text of each page, used to draft and answer questions only from your own documents.

When you enter a director’s details you are supplying another person’s personal information. Enter only what the forms need, and make sure the people concerned know you are doing so for the business’s bids.

Why

Only to fill in your bidding forms, run the consistency checks, check a tender pack against your company’s records, and give you your packs and reports. We do not sell or share your information for marketing and we do not send marketing email.

How AI is used, and what it is sent

To check a tender, the text of its relevant pages is sent to an AI model, which lists the requirements and quotes the words each one rests on. A scanned page is sent as an image so it can be read. Your bid library pages are sent the same way when you ask for a draft or ask a question. Every quote the model gives back is matched word for word against the stored page on our own server before it is shown to you; a quote that cannot be found is thrown away. Decisions such as whether a document has expired are made by our own code, not by the model.

The model provider is Anthropic (Claude), through its commercial API. Under those terms Anthropic does not train its models on what we send or on its answers, and keeps them only for a limited period (currently up to 30 days) to monitor for abuse, after which they are deleted. No other model provider is used. The ID numbers, tax references and bank details on your company profile are never sent to a model, but a document you upload is sent as it is, so leave such details out of bid library files where you can. Our records of each model call hold token counts and outcomes, never the text.

Where it is kept, and how

Database and files: Supabase. Hosting: Vercel. Email: Resend. Payments: PayFast. AI model: Anthropic.
Some of these providers process data outside South Africa. We use them under their data processing terms, which bind them to protection comparable to POPIA’s (section 72).
Every row is locked to the members of your organisation by row level security in the database, not just hidden in the interface.
ID numbers, personal tax references and bank account numbers are encrypted in the database, including in the copy kept with each pack, under a key held separately from the data. They are decrypted only on our server, for someone allowed to see that profile.
Documents are in private storage. Every download link issued for one is recorded and expires after 15 minutes.
Pack files are in private storage. A download link is issued per request, after a payment check, and expires after 15 minutes.
Our logs record ids and outcomes only; never a profile, a director, a form value or a payment body.

How long we keep it

Company profile and directors: until you change them or close your account. Removing a director from your profile deletes their row at once.
Packs, pack PDFs and the record of where each value came from: until you close your account, so that you can download a pack again and see what went into it. A pack is regenerated only if its generation failed.
Supporting documents: until you delete them, or 7 years after their expiry date (7 years after upload if they have none), whichever comes first. Then the file is deleted and the record marked deleted. Uploads that were never completed are removed too. These clean-ups run automatically every night, so something may stay for up to a day after it becomes due.
The record of document access: as long as the document record, so we can say who saw it.
Tender packs, their page text, checks, findings, drafts and questions: until you delete them, close your account, or one year after the tender’s closing date (one year after upload if no closing date was given), whichever comes first.
Bid library files and their page text: until you delete them or close your account.
Your email address and sign-in record: until you close your account.
Server logs: ids and outcomes only, never a value you entered. Our host keeps them for no more than a few days.
Database backups: our database provider keeps rolling backups for up to 7 days. Data you delete disappears from the live database immediately and from backups when they roll off.
Payments: PayFast keeps its own transaction records for as long as the law requires it to. We cannot delete those.
The free tool keeps nothing, so there is nothing to delete.

Closing your account

Signed in, go to Account and delete it. If you are the only person in your organisation, that removes every supplier profile, director, pack, pack PDF and document, then your sign-in, straight away. If you share the organisation with someone else, they keep its profiles and only your sign-in and access are removed. It is a real deletion, not a flag, and it cannot be undone. If you cannot sign in, email info@sinneogroup.co.za from the address on the account and we will do it for you.

Who processes it for us

These providers process personal information on our behalf, under their data processing terms:

Supabase: database, sign-in and file storage.
Vercel: hosting and page-view counts.
Resend: sign-in emails, tender alerts you opt into, document expiry reminders, and operator alerts carrying ids and reason codes only.
Anthropic: the AI model that reads tender and bid library pages and answers questions about them.
PayFast: card and EFT payments. Your card or bank details go to PayFast, not to us.

Getting a copy of what we hold

Signed in, open a supplier profile and choose Download export. It gives you one file with the profile, its directors, every pack and pack PDF, every document and the record of who downloaded each document. You can also ask by email.

Access to information (PAIA)

Our manual under section 51 of the Promotion of Access to Information Act 14 of 2002 is available on request from info@sinneogroup.co.za. It sets out the records we hold and how to ask for them.

If you prepare bids for other businesses

A bid consultant or programme that keeps other businesses’ profiles here is the responsible party for that information, and we process it on their behalf. Ask us for our processing agreement before you add a client’s details.

Counting visits

We count page views with Vercel Web Analytics, which sets no cookies and does not identify you. It sees which pages were visited, never what was typed on them.

Your rights

You may ask what personal information we hold about you, have it corrected, or have it deleted, and you may object to its processing. Email info@sinneogroup.co.za. If you are not satisfied with our answer you may complain to the Information Regulator at inforegulator.org.za.

What TenderFill does not do

It checks your company’s readiness, not your bid. It reads the tender pack you upload and checks your company’s records and documents against it. It does not read or judge the bid you submit, and it may miss a requirement: the tender document is the authority.
It does not guarantee compliance. Every pack requires your review before submission. You must still check signatures, pricing and tender-specific instructions.
Your department’s own forms take precedence. Many bid packs ship their own layout of the SBD forms, and SBD 1 asks for bids on the official forms provided, not retyped. If your bid pack includes its own version of a form, fill in theirs; the Field Answer Sheet tells you what to write where.
It fills the standard municipal forms, not a municipality’s own. For a municipal tender the pack is MBD 1, 4, 6.1, 7.2, 8 and 9 as National Treasury publishes them. Many municipalities issue their own versions, especially of MBD 4; fill in theirs from the Field Answer Sheet. It does not fill MBD 7.1 or 7.3, the goods and works contract forms, or any MBD 3 pricing schedule.
It does not prepare a joint venture’s bid as one. Each party to a joint venture or consortium needs its own pack, and the tender will usually want the signed JV agreement too.

What we collect when you have an account

Your email address, to send sign-in links. PayFast emails your payment receipt.

Your company profile: registered name, CIPC, tax, VAT and CSD numbers, addresses and contact details, declarations, B-BBEE and CIDB details, ownership percentages and bank details.

Directors, members and partners: full name, ID number, personal tax reference, role, whether they may sign for the business, and whether and where they are employed by the state.

Supporting documents you upload: the file, what kind of document it is, its issue and expiry dates as you enter them, and who uploaded it. When you ask, the text of a PDF you uploaded is read on our server to suggest details for your profile. The text is not kept, nothing is saved until you save your profile, and no file is sent to any other service.

A record of access: each time a download link for one of your documents is issued, the time, the account and the network address it was issued to, and each time a document is read to suggest profile details.

Each pack: the tender details you enter, the answers for that bid, the generated PDF, and a record of which value came from where.

Payment status: a PayFast reference and the date paid. PayFast handles your card or bank details; we never receive them.

Tender packs you upload for a check: the files, the text of each page, and the findings we produce with the page and words each one cites. A tender pack can contain other people’s details, such as a buyer’s contact officer, so we treat it as personal information too. We do not ask for your own bid and do not read it: the check covers your company’s readiness, not your bid.

Past bids you add to your bid library: the files and the text of each page, used to draft and answer questions only from your own documents.

How AI is used, and what it is sent

Where it is kept, and how

Database and files: Supabase. Hosting: Vercel. Email: Resend. Payments: PayFast. AI model: Anthropic.

Some of these providers process data outside South Africa. We use them under their data processing terms, which bind them to protection comparable to POPIA’s (section 72).

Every row is locked to the members of your organisation by row level security in the database, not just hidden in the interface.

ID numbers, personal tax references and bank account numbers are encrypted in the database, including in the copy kept with each pack, under a key held separately from the data. They are decrypted only on our server, for someone allowed to see that profile.

Documents are in private storage. Every download link issued for one is recorded and expires after 15 minutes.

Pack files are in private storage. A download link is issued per request, after a payment check, and expires after 15 minutes.

Our logs record ids and outcomes only; never a profile, a director, a form value or a payment body.

How long we keep it

Company profile and directors: until you change them or close your account. Removing a director from your profile deletes their row at once.

Packs, pack PDFs and the record of where each value came from: until you close your account, so that you can download a pack again and see what went into it. A pack is regenerated only if its generation failed.

Supporting documents: until you delete them, or 7 years after their expiry date (7 years after upload if they have none), whichever comes first. Then the file is deleted and the record marked deleted. Uploads that were never completed are removed too. These clean-ups run automatically every night, so something may stay for up to a day after it becomes due.

The record of document access: as long as the document record, so we can say who saw it.

Tender packs, their page text, checks, findings, drafts and questions: until you delete them, close your account, or one year after the tender’s closing date (one year after upload if no closing date was given), whichever comes first.

Bid library files and their page text: until you delete them or close your account.

Your email address and sign-in record: until you close your account.

Server logs: ids and outcomes only, never a value you entered. Our host keeps them for no more than a few days.

Database backups: our database provider keeps rolling backups for up to 7 days. Data you delete disappears from the live database immediately and from backups when they roll off.

Payments: PayFast keeps its own transaction records for as long as the law requires it to. We cannot delete those.

The free tool keeps nothing, so there is nothing to delete.

Closing your account

Who processes it for us

These providers process personal information on our behalf, under their data processing terms:

Supabase: database, sign-in and file storage.

Vercel: hosting and page-view counts.

Resend: sign-in emails, tender alerts you opt into, document expiry reminders, and operator alerts carrying ids and reason codes only.

Anthropic: the AI model that reads tender and bid library pages and answers questions about them.

PayFast: card and EFT payments. Your card or bank details go to PayFast, not to us.

What TenderFill does not do

It checks your company’s readiness, not your bid. It reads the tender pack you upload and checks your company’s records and documents against it. It does not read or judge the bid you submit, and it may miss a requirement: the tender document is the authority.

It does not guarantee compliance. Every pack requires your review before submission. You must still check signatures, pricing and tender-specific instructions.

Your department’s own forms take precedence. Many bid packs ship their own layout of the SBD forms, and SBD 1 asks for bids on the official forms provided, not retyped. If your bid pack includes its own version of a form, fill in theirs; the Field Answer Sheet tells you what to write where.

It fills the standard municipal forms, not a municipality’s own. For a municipal tender the pack is MBD 1, 4, 6.1, 7.2, 8 and 9 as National Treasury publishes them. Many municipalities issue their own versions, especially of MBD 4; fill in theirs from the Field Answer Sheet. It does not fill MBD 7.1 or 7.3, the goods and works contract forms, or any MBD 3 pricing schedule.

It does not prepare a joint venture’s bid as one. Each party to a joint venture or consortium needs its own pack, and the tender will usually want the signed JV agreement too.