Privacy notice

Who operates this service

MB Evelaina, established in Lithuania, operates ContractLookout and is the controller of the personal data described here. Contact support@contractlookout.com for support or privacy requests.

Information we use

• Accounts: your email, optional name, password hash, verification/reset records and session information. Session records can include IP address and browser user agent. We process the password you submit to authenticate you; the stored credential is a hash.
• Your workspace: saved searches and filters, supplier preferences, match starting points, shortlist decisions and notes. Please do not put sensitive personal information, confidential bid documents or another person’s private data into notes.
• Operation and security: request, connection, rate-limit, error and email-delivery information processed by the service and its providers.
• Support: your contact details and the information you choose to send us.
• Public notices: information published in the source procurement services. A notice can contain a buyer’s contact details. These are kept with their source and observation dates, separately from your private account.

Why we use it

We use account and workspace data to provide the free service you request, including sign-in, account recovery and saved work. The basis is performance of that service agreement. We use necessary security, abuse-prevention, support and public-notice processing for our legitimate interests in operating a reliable tender discovery service and helping users assess published opportunities. We consider the effect on individuals and handle correction or removal concerns through support.

Account emails are transactional, not marketing. The beta has no payments or subscriptions. We do not sell private saved work or send search text and notes to advertising or product-analytics tools.

Providers and processing locations

Cloudflare provides hosting, D1 account/inventory databases, R2 evidence storage and encrypted backup storage. A dedicated Linux collector runs with Hetzner infrastructure. Resend handles verification and password-reset emails, including the recipient, message and delivery information. Support mail is forwarded through Cloudflare Email Routing to an operator-managed Gmail inbox, provided by Google.

We select European infrastructure where available, but this is not a promise that all processing stays in the UK or EEA. Provider operations and subprocessors can involve other countries. Applicable provider data-processing and transfer terms govern those services.

Cloudflare privacy · Resend privacy · Google privacy · Hetzner privacy

Cookies and browser storage

Account sessions use necessary HttpOnly cookies with SameSite protection and secure transport on the hosted service. Private beta access can also require a separate access credential. Browser storage may contain locally saved work or an explicit account import. Account data is not silently copied into browser storage if an account write fails. Clearing browser storage does not delete a hosted account.

This beta does not include advertising pixels or optional analytics cookies. Infrastructure providers still receive the connection and security information needed to deliver the service.

Retention and deletion

Account and saved-work data remain while you keep the account. Your account page lets you delete the account from the active database, including its credentials, sessions and private workspace. Link expiry and session expiry prevent use; they do not by themselves prove that every expired database record has been erased. Operational, abuse-prevention and provider delivery records have separate retention and may remain after deletion where needed for security or handling a request.

Daily encrypted application backups retain up to seven successful scheduled archives. This is a count of successful backups, not a guaranteed seven-day erasure period. Missed captures, earlier inspection/recovery copies and provider recovery facilities can retain older data for longer. Those copies are for recovery and are not used as the active workspace. Contact us about a deletion request affecting retained copies or a recovery.

Public procurement evidence has a separate purpose and retention from your account. Deleting your account does not remove a buyer’s public notice. Report personal-data concerns using the official notice link; we can review our copy and direct you to the publisher for a source correction.

Your choices and rights

You can ask for access, correction, erasure, restriction, portability or object to processing, subject to the applicable conditions. Write to support@contractlookout.com. We may need to verify your identity. Never send a password or an account email link. You can also complain to your relevant supervisory authority, including the UK Information Commissioner’s Office or Lithuania’s State Data Protection Inspectorate.

Recommendations and official sources

Matching uses your filters and published notice fields to suggest candidates. It does not decide eligibility, submit a bid or make a legally significant decision about you. You choose what to pursue or dismiss. Read the coverage and source-status limits.

Changes to this notice

We update this page when the service or its data use changes and show the updated date above. Material changes will be explained before introducing the new use.