Privacy Policy
Last updated: July 18, 2026
Who we are
Contractual is a Canadian public procurement workspace operated by Contractual (company details to be confirmed). This policy explains what personal information we collect when you use the marketing site and the Contractual application, how we use it, and the choices you have.
Information we collect
Account & contact information — your name, email, and organization details, provided when you create an account or contact us.
Company & bid profile — the business information you enter for opportunity and existing-package review: trade, certifications, service regions, capacity, and past project details.
Documents you upload — tender documents, certificates, and past bids you provide for eligible package workflows. New package creation is currently unavailable.
Usage information — product analytics events (pages viewed, features used) collected to understand and improve the service. Contractual does not send browser fingerprints or visitor-identification payloads to BetterAuth.
Payment information — handled by our payment processor, Stripe. We do not store full card numbers on our servers.
How we use your information
To provide current-source tender search, account and profile tools, and existing-package review; to operate and secure the platform; to process payments and manage your subscription; to communicate with you about your account; and to improve the product. We do not sell your personal information.
How your documents are handled
Your company profile and uploaded documents are available to eligible package workflows. They are never shared with other customers and are not used to train third-party AI models.
When an eligible package workflow invokes an AI provider, relevant content is sent solely to produce your output; providers process it under agreements that prohibit training on your data. New package creation is currently unavailable.
Sub-processors
We share the minimum personal information necessary with the service providers below, who process it on our behalf under contract.
| Provider | Purpose | Data location |
|---|---|---|
| Supabase | Database & file storage | To be confirmed |
| BetterAuth | Authentication and server-side operational events | To be confirmed |
| Stripe | Payment processing | US / Global |
| PostHog | Product analytics | To be confirmed |
| Vercel | Web analytics and application hosting | US |
| Sentry | Error monitoring | US |
| AI providers (e.g. Anthropic, OpenAI) | AI processing when an eligible workflow is enabled and used | US |
Provider list and data-residency details to be confirmed before launch.
Data retention
We retain your account and profile data while your account is active. Uploaded documents and existing stored package outputs are retained so you can revisit them, and you can delete them from the app. When you close your account, we delete or anonymize your personal data within a reasonable period, except where we must retain it to meet legal or accounting obligations.
Where your data is stored & Canadian context
Contractual serves Canadian contractors. Some sub-processors store or process data in the United States. We handle personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Final data-residency details will be confirmed before launch.
Your rights
You can access, correct, or delete your personal information, and request a copy of the data you've provided. Contact us to exercise these rights.
Security
We use encryption in transit, access controls, and reputable infrastructure providers to protect your data. No system is perfectly secure, but we work to safeguard your information.
Changes to this policy
We'll update this policy as the product and our providers evolve, and post the revised version here with a new date.
Contact
Questions or requests? Email privacy@contractual.ca.