Privacy Policy

Airprose is a product operated by Intelligent Outputs Ltd, a company registered in England and Wales (company number 17288610), whose registered office is at 71–75 Shelton Street, Covent Garden, London WC2H 9JQ (referred to as "Airprose", "we", "us" or "our" throughout this policy). We are the "data controller" for the personal data described below.

Contact: privacy@airprose.com

This policy applies to personal data we process when you visit our website, create an account, upload tender content, use the drafting and library features, or contact us.

It does not cover the privacy practices of third-party sites we link to (such as your own website that we crawl on signup, or the government tender portals our Discover feature surfaces).

We collect personal data in three buckets:

(a) Account data you give us: name, email address, organisation name, sector, business summary, password (stored hashed by Supabase Auth, never visible to us in plaintext), and optional website URL.

(b) Content you upload: tender documents (ITTs, specifications, schedules, forms), library assets (case studies, certifications, policies), and any text you type or paste into the platform when drafting responses. This content may incidentally contain personal data about your employees or referees.

(c) Technical and usage data: IP address, browser type, pages viewed, features used, timestamps, error logs. Collected automatically when you use the service.

We use your personal data to:

• Provide the service (create your account, run the AI drafting features, store your library)
• Send service emails (signup confirmation, password reset, tender-ready notifications)
• Improve the product (anonymised analytics, debugging errors)
• Comply with legal obligations (record-keeping, responding to lawful requests)
• Investigate misuse (suspected fraud, abuse, breach of our Terms)

We do not use your tender content or library assets to train AI models, sell to third parties, or share with other Airprose customers.

UK GDPR requires us to have a lawful basis for each use of your personal data. Ours are:

• Contract performance — most of what we do (running your account, drafting features, storage of your content) is necessary to deliver the service you signed up for.
• Legitimate interest — service emails, error logging, anti-abuse monitoring, and aggregate (non-identifying) analytics.
• Consent — non-essential cookies and optional analytics (PostHog). You can withdraw consent at any time via the cookie banner or in your browser settings.
• Legal obligation — keeping records we must keep (e.g. for tax or to respond to a regulator).

We use a small number of cookies and similar technologies:

Strictly necessary cookies— keep you signed in, remember your bid-threshold preference, and let the workspace remember which view you last opened. These can't be turned off without breaking the service.

Analytics (PostHog)— measures how the product is used so we can improve it. Only loaded if you accept the cookie banner. We don't enable PostHog session recording on this account. PostHog data is processed in the United States (see section 8).

You can decline analytics on the banner that appears on your first visit, and change your mind later via the "Cookie preferences" link at the bottom of any page.

We share data only with the processors that run our infrastructure. They process personal data on our instructions and to our standards. Our current sub-processors are:

• Supabase — hosts your account, library, and tender data on UK infrastructure (London region). Provides authentication, database, and file storage.
• Vercel — hosts the web application and runs the serverless functions that power features. Static assets served from a global CDN; compute typically runs in the United States.
• Anthropic — provides the AI models that draft tender responses. Receives the specific tender extracts and library snippets needed to generate a draft. US-based. See section 11 for our AI processing disclosure.
• PostHog — product analytics. Receives anonymised usage events if you opt in via the cookie banner. US-based.
• DigitalOcean — hosts the document editor and analyse worker services on a London-region droplet.

We do not sell personal data to anyone. If we ever change processors, we'll update this page; material changes will be communicated to active users via in-app notice.

Some of our processors (Anthropic, PostHog, parts of Vercel) process personal data in the United States. The UK Government's adequacy decision in October 2023 designated the US under the EU-US Data Privacy Framework as an adequate destination for personal data, provided the receiving organisation is certified to the DPF.

Anthropic, PostHog, and Vercel are DPF-certified. We rely on the DPF adequacy decision combined with Standard Contractual Clauses (SCCs) as additional safeguards where required.

We keep different types of data for different periods:

• Account data — for as long as your account exists, plus 90 days after deletion for backup and audit purposes.
• Tender content and library assets — for as long as your account exists. You can delete individual items at any time.
• Email signup logs — 12 months.
• Error and security logs — 90 days, longer if necessary to investigate an active incident.
• Audit logs (admin actions, impersonation events) — 12 months.

When the retention period ends, we delete the data or anonymise it so it can no longer identify you.

Under UK GDPR you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate personal data
• Erasure — ask us to delete your personal data (subject to obligations to retain certain records)
• Restriction — ask us to limit how we use your personal data
• Portability — ask for your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interest
• Withdraw consent — for anything we do based on consent (e.g. analytics)

To exercise any of these rights, email privacy@airprose.com. We'll respond within one calendar month.

If you're not satisfied with our response, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk.

Airprose uses large language models (LLMs) from Anthropic to help you draft tender responses. We want to be transparent about how this works:

What gets sent to Anthropic:when you ask for a draft, we send the specific tender question, the relevant extracts from the tender document, and the relevant snippets from your library. We don't send your entire library or all your tenders — only what's needed for the immediate request.

What Anthropic does with it: Anthropic processes the input to generate a draft response and returns it to us. Under our agreement with Anthropic, your content is not used to train their models.

What we keep:we store the draft so you can edit it. We log the request for debugging and abuse-prevention. We don't log the full content of every prompt by default.

Important: declaring AI use in your bids.UK public-sector buyers are increasingly required to ask about AI use in responses (see Procurement Policy Note 02/24). When you submit a tender drafted with Airprose's help, you should check the buyer's declaration requirements and disclose appropriately. We'll surface a reminder at submission time, but you remain responsible for accurate disclosure.

We use technical and organisational measures appropriate to the risk of harm to your data:

• Encryption in transit (TLS 1.2+) for all connections
• Encryption at rest for stored content (Supabase, Vercel Blob)
• Per-organisation data isolation via row-level security policies
• Admin access protected by allowlist plus mandatory two-lock checks
• Regular security reviews and prompt patching of dependencies

No system is perfectly secure. If we ever discover a personal data breach that affects you, we'll notify you and the ICO within the 72-hour window required by law.

Airprose is a B2B tool for tender bidders. We don't knowingly collect data from anyone under 18. If you believe a minor has signed up, contact us and we'll delete the account.

We'll update this page when our practices change. The "Last updated" date at the top reflects the most recent change. Material changes (new processors, expanded data collection) will trigger an in-app notice to active users.

For any privacy question, request, or complaint:

Email: privacy@airprose.com

You can also read our Terms of Service which explains the contract between you and us.