Privacy Policy

Account: your email address and password credentials (passwords are hashed; we never see them). Company profile: business details you enter — name, industry, services, markets, deal sizes, certifications, and your business description used for tender matching. Work product: clients, opportunities, proposals, quotations, and knowledge-base entries you create. Tender activity: saved tenders, match views, and alert preferences.

AI generation: when you generate a proposal or extract your profile, the relevant project details and company context are sent to our AI provider (OpenRouter, serving models including Google Gemini) solely to produce your output. Your content is not used to train models.

Payments: handled by Stripe. We receive subscription status and invoice records — never your card numbers.

Emails: sign-in links and tender digest alerts you opt into are delivered via Resend.

Public tender data: tender content comes from public sources (EU TED and US SAM.gov, including CC BY 4.0 open data) and is not personal data we hold about you.

We use a secure session cookie to keep you signed in, local storage for demo data and UI preferences (theme, onboarding progress), and Cloudflare Turnstile (a privacy-preserving human check) on sign-in and the public demo. No advertising trackers.

We share data only with the processors above (hosting on Convex, payments via Stripe, email via Resend, AI via OpenRouter, bot protection via Cloudflare), each limited to operating the service. We do not sell personal data or share it for marketing.

Your data is kept while your account is active. Delete individual clients, proposals, and opportunities anytime from the dashboard. To delete your entire account and workspace, email support@getapearl.com — we confirm and remove it within 30 days, except records we must retain for billing or legal compliance.

You may request access, correction, export, or deletion of your personal data at any time via the email above. EU/EEA users hold these rights under the GDPR; Malaysian users under the PDPA 2010. We respond within 30 days.

Data is encrypted in transit (TLS) and at rest on our hosting platform, with scoped access controls per workspace. No system is perfectly secure — tell us promptly of any suspected breach. Apearl is a business tool and is not directed at children under 13.

Material changes will be announced in-app or by email before taking effect. Continued use after the effective date constitutes acceptance.