Trust & data protection

What we do

• Hosted in the EU — your core data lives on servers in Germany (Hetzner).
• Governed by Swiss data protection law (revFADP) and built to align with the EU GDPR.
• Cookie-less analytics — no third-party advertising or tracking cookies.
• Encrypted in transit (TLS) and at rest.
• Delete your account yourself any time; request a copy of your data whenever you need it.
• Official SIMAP procurement data, reused under SIMAP's terms and never altered.

What we never do

• We never sell your data.
• We don't use third-party advertising or cross-site tracking cookies.
• We don't let our AI providers train their models on your data — our API contracts prohibit it.
• We don't claim certifications we don't hold.

Your core data (database and application) is hosted by Hetzner in Germany (EU). Edge delivery and security run on Cloudflare, which may process limited data in the US; Cloudflare is certified under the Swiss–US Data Privacy Framework, the basis for those transfers. Some processing runs on our own hardware in Switzerland. We don't claim data never leaves the EU — every transfer rests on a recognised legal safeguard.

You can access, correct, export, or delete your personal data, and object to processing, under Swiss revFADP (and the GDPR where it applies). Account deletion is self-service in your settings. For a copy of your data, or any other request, write to privacy@tenderlift.ch — we respond within 30 days, usually much sooner.

Sub-processors

We use a small set of vetted sub-processors (hosting, email, analytics, payments). Ask for the current list at privacy@tenderlift.ch.

Frequently asked questions

Where is my data stored?

Your account and application data are hosted in the EU (Germany). See data residency above.

Do you use my data to train AI?

No. We use AI services (such as OpenAI's API) to power features you use, under contracts that prohibit those providers from training their models on your data.

Can I get a copy of, or delete, my data?

Account deletion is self-service in your settings. For a copy of your data, request it at privacy@tenderlift.ch — we fulfil requests within 30 days, usually sooner.

Are you GDPR / revFADP certified?

There is no official "certification" for revFADP or the GDPR. We are governed by Swiss revFADP and built to align with the GDPR; we don't display seals we don't hold.