Privacy notice

What we collect

When you request pilot access, we collect the contact and practice information you submit. When an approved pilot user uses the application, we process account details, project settings, uploaded tender documents, review decisions, generated reports, audit events and essential service logs.

Why we use it

We use this information to assess pilot requests, provide and secure BOQView, structure and compare tender submissions, generate user-controlled outputs, answer support requests, prevent misuse and meet legal obligations. We do not sell personal information or use customer tender documents to train a shared BOQView model.

AI processing and subprocessors

BOQView uses OpenAI for bounded OCR and ambiguous document analysis only when deterministic processing is not enough. Provider requests are configured with storage disabled. Supabase provides authentication, database and private file storage; Vercel hosts the application and workflow; Resend delivers transactional email.

• Pilot application and workflow: United States region
• Database and private storage: Supabase us-east-1
• Email metadata and account records: Resend infrastructure
• This pilot does not claim UAE-only data residency

Retention and deletion

Completed project data is retained for up to 365 days during the pilot unless a different legal obligation applies. An approved deletion request archives the project immediately and enters a 30-day recovery period before permanent deletion. Report links can expire or be revoked separately.

Sharing and client reports

We disclose information only to service providers acting for BOQView, when directed by an authorised customer user, or where required by law. Anyone holding an active client-report link can view that report until the link expires or is revoked, so users should share links deliberately.

Your choices

You may ask for access, correction or deletion of personal information, withdraw a pilot request or raise a privacy concern by emailing the contact below. We may need to verify your identity and authority before acting on a request.