TenderMatrix / Privacy
Privacy: what happens to the RFP you upload
The file is processed in memory and deleted after conversion. Uploads are not used for training. The companies involved are listed below. Last updated 28 October 2026.
In short
- Files are processed in memory and deleted after conversion.
- Pages that need a second look may be sent to Google's Gemini API. Under Google's terms, Google may retain that data for up to 55 days.
- We do not use uploads to train any model.
- Sub-processors: Modal (compute), Google (vision check), Cloudflare (hosting), and a payment provider to be named when checkout goes live.
- Your owner and status entries stay in your browser. They are never sent to us.
- If you enter a page code, it is saved in your browser and sent with each upload so the service can take pages from it.
Before you upload a confidential RFP
Check your confidentiality terms first. An RFP can carry a non-disclosure clause or an instruction not to pass it to third parties. Uploading sends the file to the companies listed on this page. Upload only documents you are entitled to share with a processor.
If you cannot upload the file, the paste box on the matrix desk builds a matrix from text you paste, entirely in your browser. Nothing is sent to any server.
What is handled, and where it goes
| Data | Where it goes | How long |
|---|---|---|
| The PDF you upload | From your browser through our Cloudflare function to the conversion service on Modal. | Processed in memory and deleted after conversion. |
| Pages that need a second look | May be sent by the conversion service to Google's Gemini API. | Google may retain prompts and outputs for up to 55 days under its terms (Google's description). |
| Converted text and matrix rows | The conversion service returns the text. Our function builds the rows and sends them to your browser. | Our function does not write them to storage. They stay in your browser tab until you close it. |
| Owner and status entries | Nowhere. They exist only in your browser and in files you download. | Lost when you close the tab unless you download them. |
| Pasted text | Nowhere. It is processed in your browser. | Not kept. |
| A random device ID and your IP address | The ID is stored in your browser (local storage, key tm_device). It is sent with each conversion, together with your IP address, so the free allowance can be applied per device. | Kept by the conversion service for as long as it needs to apply the allowance. |
| A page code, only if you enter one | Saved in your browser (local storage, key rfptoexcel_code). It is sent with each upload, through our Cloudflare function, to the conversion service, which uses it to take pages from the code. | In your browser until you press Remove or clear this site's data. The conversion service keeps the code and the pages left on it. |
| Request logs | Our host, Cloudflare, records standard request details such as time, address, path and browser type. | According to Cloudflare's own retention. |
| Emails you send us | Our mailbox at [email protected]. | As long as needed to answer you and keep billing records. |
| Payment details | The payment provider's checkout page. We do not receive card numbers. | The provider's terms apply. It is named on the checkout page once checkout is live. |
Sub-processors
| Company | Role | What it may receive |
|---|---|---|
| Modal | Compute: runs the conversion service | The uploaded file, in memory, and the converted text. |
| Vision check: Gemini API for pages that need a second look | Those pages, as images or text. Retention up to 55 days under Google's terms. | |
| Cloudflare | Hosting: Pages, edge functions and DNS | Requests to this site, including an upload as it passes through the function, and standard request logs. |
| Payment provider | Subscriptions | Named on the checkout page once checkout is live. Until then, subscriptions are handled by email. |
Training
We do not use uploads, converted text or matrix rows to train or fine-tune any model. Google's handling of pages sent to its Gemini API is governed by Google's terms, which we link above.
Cookies, local storage and analytics
This site does not set cookies itself. It stores a random device ID in your browser's local storage and, if you enter one, your page code. Both are described in the table above. You can remove them by clearing this site's data in your browser, and the page code also by pressing Remove next to it.
This site runs no analytics.
Security
Everything is sent over HTTPS. We do not hold a SOC 2 report or any other security certification, and we do not claim one. If your policy requires one, do not upload the file.
Questions and requests
To ask what we hold about you or to ask for something to be deleted, write to [email protected]. That mailbox handles privacy requests until a separate address exists.
This page describes how the service works today in plain language. We will change it when the service changes and update the date at the top.