What happens to your data?

We distinguish between private documents processed on your device, public procurement research, and coarse aggregate product measurements. This page describes the current prototype; it is not a complete legally vetted privacy notice from an established commercial operator.

1. Local PDF review

• Text extraction, keyword matching, category comparisons, annotations and SHA-256 source verification happen within your current browser session. No cloud AI service is invoked for this workflow.
• Source documents and annotations are not saved to our servers, cookies or browser localStorage by the PDF tools. When you close the page, the unsaved working review is lost.
• The tools can generate local CSV, JSON, printed PDF and optional iCalendar downloads when you explicitly request them. A full review-session JSON includes confidential source excerpts, evidence inventory and manual notes. Keep it secure; original PDFs are not embedded in it.
• To reattach originals after restoring a review, the tool computes SHA-256 digests on your device and requires both selected files to match the saved report hashes before local PDF page links are enabled.
• Encrypted, damaged, scanned or image-only PDFs may not be fully readable. Missing keyword matches are not evidence that a legal requirement is absent.

2. Public research and search

In separate public TED search features, your public-company-name or country parameters may be sent to the AwardCove server to query public EU procurement information. Do not enter confidential information into that search. This is different from the locally running PDF review tools.

3. Optional anonymous activity and research surveys

Some page interactions (for example starting a PDF review, opening the public example or requesting an export) are counted as coarse daily event totals: day, event category, page category and broad source channel. These tables do not store PDF contents, user-provided document names, excerpts, free-text review notes or client names. They do not reliably identify unique visitors or actual professional customers.

The optional eight-question research survey accepts only fixed-choice answers. Its server table aggregates combinations of eight categories by day without a name, email address, company or free-text response. This is an unverified self-report, not a transaction, user account or consent to contact. Other German-only research forms similarly record fixed daily categories.

The separate first-party aggregate research-event measurement does not intentionally create tracking cookies, stable visitor identifiers, device fingerprints or send full referrer URLs in recorded event rows.

The workspace also counts a small, fixed set of coarse actions: visit, opening the sign-in dialog, successful guest or signed-in project creation, and opening current or historic TED feeds. The recorded row contains only UTC day, fixed action category, broad acquisition channel and count. No user ID, email, client name, project title, PDF contents, source URL, search text or reviewer notes are transmitted as these measurement events. These are action counts, not unique people, qualified leads or sales.

4. Hosting and connection information

The hosting provider necessarily handles technical HTTP and security information, which can include IP addresses, to serve the site. This infrastructure processing is separate from the aggregate research-event database. Authenticated workspace use additionally requires session cookies and account records. “No private PDF uploads” does not mean that visiting a web page generates no network metadata.

5. Optional workspace, account and session data

The AwardCove workspace supports guest use or optional email-and-password registration with verification by email code, using managed Neon Auth. Account processing includes email address, optional display name, hashed password credentials, verification and authentication records, and required session cookies. This is not anonymous in the way the independent research surveys are.

Signed-in users can save their own tender project names, manually chosen stages, optional source URLs, deadlines and brief notes to an EU-hosted Neon database. Server operations are scoped to the authenticated account identity. These notes may themselves be confidential, so avoid putting sensitive customer materials or detailed confidential requirements in cloud project notes. Actual PDF file bytes, extracted PDF excerpts and local reviewer reports are not uploaded to the account.

Guest project titles, stages, voluntary notes, dates and URLs are kept in this browser's localStorage. Guest projects are not transferred automatically to a later account. They can be cleared in workspace settings. The research beta does not yet offer a fully verified account-level deletion and data-subject request workflow, and the identification of the responsible commercial operator and complete legally compliant notice remain outstanding.

6. No checkout or verified paying customers

There is still no paid checkout or verified subscription revenue. Research pricing remains hypothetical, and survey responses are not consent to direct marketing.

Technical wording reviewed 13 November 2026. Full German-language disclosure includes further feature-level details. This English page is not a certified legal translation.