Privacy
What data we process, what for, who we share it with and how you can control it.
Controller
The controller of the data of people who have a Tendr account and of people who visit this website is Marc Granell Beltrán, NIF 54020243M, Calle Linares 21, 4.º, puerta 7, 46018 Valencia, España. Contact: [email protected].
For the data of visitors who use a store’s chat, the store is the controller and Tendr acts as its processor (see the data processing agreement).
Data of Tendr customers
| Data | Purpose | Legal basis |
|---|---|---|
| Account: name, company, email and password (stored only as a hash with scrypt, never in plain text). If you sign in with Google: name, email and Google ID. | Giving you access to the dashboard, managing your licences and sending you necessary service notices. | Performance of the contract. |
| Billing: name or company name, billing address, tax ID or VAT number, email, plan, period, status, and invoice and refund history. Card details go directly to Stripe, which also stores the billing details. | Charging the subscription and complying with tax obligations. | Contract and legal obligation. |
| Proof of acceptance: date and version of the terms accepted, and withdrawal requests. | Being able to prove what was agreed and dealing with complaints. | Legal obligation and legitimate interest. |
| Sessions: device, browser and IP address of each open session. | Account security and showing you your sessions. | Legitimate interest. |
| Team: when you invite someone to answer the chat, their email and, if you provide it, their name. When they answer chats: their availability, what they reply and their first name, which the store’s visitors and the account holder can see. | Live support by people, and letting the account holder know who handled each conversation. | Performance of the contract and the account holder’s legitimate interest. |
| Your store’s data: catalogue, policies, shipping rates, documents you upload, domain and plugin version. | So the assistant knows your store and answers with real information. | Performance of the contract. |
| Connected calendars (Google Calendar, Outlook/Microsoft): the connected account, its access tokens (stored encrypted) and busy times, without titles. We create events in your calendar with a generic title (“Booking #N · service”). iCal links you connect (Airbnb, Booking.com…) only receive that generic title. | Blocking busy slots and recording bookings. | Performance of the contract. |
| Emails with tips, news, plan offers and requests for feedback. | Commercial information about Tendr, sent to customers and only about similar services. You can object when you sign up, from any email or in My account. | Legitimate interest (Art. 21.2 of the Spanish LSSI). |
| Reviews and testimonials: rating, text, name, job title and store. | Improving the service and, if you authorise it by ticking the box, publishing your testimonial. | Consent, which you can withdraw at any time. |
| Internal management: team notes on your account, suspensions and a log of actions by the Tendr team. | Support, abuse prevention and keeping track of who does what. | Legitimate interest. |
Counting how many times the chat loads on each website is aggregate data: it doesn’t identify anyone.
Store visitors
If you use a store’s chat, that store is the controller of your data: contact the store to exercise your rights. Tendr processes the following on the store’s behalf:
- Conversation: what you write, the replies, products shown and cart. It is sent to an AI provider to generate each reply (see below). Don’t type sensitive or health data, or card details, into the chat.
- Visitor code: a random code stored in your browser when you use the chat.
- Contact: if you fill in the contact form or ask for a ticket, your name, email, phone number, message, the page and the language. The store’s team receives them by email, in its dashboard and, if it has set this up, in its forms system or by webhook. This data isn’t sent to the AI provider, which only receives a note that the form was sent, without the details.
- Attributed order: if you buy after using the chat, the order number and amount.
- Human support: the store’s team can read the conversation and reply to you. You’ll see the first name of the person helping you. Internal notes the team adds to the conversation are also sent to the AI provider.
The shipping details in the chat’s payment form go directly to the store’s cart and Tendr does not store them. But if you type them as a normal message, they become part of the conversation.
The chat is an artificial-intelligence assistant, always tells you so, and can make mistakes. It does not make decisions that have legal effects on you: the price and conditions that apply are those of the store.
Bookings: if you book from the chat, the business, which is the controller, receives your name, email, phone, notes and booking details through Tendr. This data isn’t sent to the AI provider, which only receives what you write in the chat. The business may also keep it in its own systems (for example, its calendar or management software). You’ll get an email confirmation and a reminder, with a link to change or cancel.
Who we share it with
| Provider | Purpose | Where |
|---|---|---|
| DeepSeek (default AI provider) | Receives the conversation text and catalogue data to generate each reply. | China |
| Mistral AI (Mistral AI SAS; only if the store chooses the included AI in the EU) | Same as above. | France (EU) |
| OpenAI (only if the store uses its own key) | Same as above. | USA and others |
| Cloudflare, Inc. | Network and security in front of the website and the API: it handles connections, including your IP address, and the forwarding of email to our addresses. | Global network, USA |
| Resend (Resend, Inc.) | Sending emails: sign-in, notices and billing. | USA |
| Stripe (Stripe Payments Europe, Ltd.) | Payments, invoices and tax calculation. | Ireland, USA |
| Google (Google Ireland Ltd.) | If you choose “Continue with Google”, to identify you; if you connect Google Calendar, for your bookings; and Gmail, where we receive the emails you send to info@, support@ or privacidad@ (Cloudflare forwards them to that mailbox). | Ireland, USA |
| Microsoft | Only if you connect Outlook, for your bookings. | USA and others |
| Public authorities | When required by law, for example the Spanish Tax Agency. | Spain |
The API and the database are on a server managed by the owner in Spain. This website and the dashboard use their own fonts and libraries: your browser only contacts tendr.cc, except Stripe (js.stripe.com) when you pay and Google Analytics if you accept it. We don’t sell data or use it for advertising.
Tendr’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Data outside the EU
China (DeepSeek). We want to be clear: China does not have an adequacy decision from the European Commission, and DeepSeek’s current terms do not include standard contractual clauses or a data processing agreement. For that reason we cannot guarantee that the level of protection is equivalent to that of the EU, and European authorities have questioned its data transfers. To reduce the risk, before sending anything we automatically mask the emails and phone numbers we detect. Names, addresses and other free text are sent. Each store can instead choose, from the dashboard, the included AI in the EU (Mistral AI, in France), which processes the data in the EU under a data processing agreement, or its own OpenAI key.
United States and other countries. Transfers to the other providers rely on the EU-US Data Privacy Framework, if the provider participates in it, or on the European Commission’s standard contractual clauses included in their terms. You can ask us for a copy at [email protected].
How long we keep it
| Data | Period |
|---|---|
| Account and its data | For as long as it is active. When you delete it, the subscription is cancelled and everything is deleted immediately, except as indicated below. |
| Data of a disconnected store | Deleted 30 days after disconnecting it. |
| Conversations, contacts, tickets and events | A maximum of 24 months from the last activity, unless deleted earlier. |
| Sessions | Deleted when they expire, after 30 days without use. |
| Log of emails sent and of team actions | 24 months. |
| Technical server logs | No IP addresses. Rotated automatically by size. |
| Withdrawal requests | 5 years, to deal with any complaints. |
| Invoices | Up to 6 years, the period required by tax and commercial law, including after the account is deleted; then they are deleted. Stripe also retains them. When you delete your account, we delete your customer record in Stripe. |
| Bookings | Up to 24 months from the booking date, unless deleted earlier. |
| Website and dashboard usage analytics | 13 months, then deleted. |
| Unaccepted team invitations | 30 days. |
| Backups | A daily database backup, kept for 7 days, and a weekly one, kept for 4 weeks. Deleted data disappears from the backups within 28 days at most. We only use them to restore the service and, if we ever had to restore one, we would delete again whatever had already been deleted. They can be stored encrypted with AES-256. |
Cookies and storage
This website and the dashboard use our own cookie-free analytics: we record the page visited, where you came from (referring site or campaign), country, language, device type and browser, where you click (never what you type), how far you scroll and how long the page is visible. We don’t store your IP address: each day an anonymous identifier is calculated that changes the next day, so you can’t be followed from one day to the next. In the dashboard, we use your dashboard session to link this activity to your account, so we know which features are used and can improve them. The legal basis is our legitimate interest in running and improving the service.
Google Analytics only loads if you accept it in the cookie notice, and you can change your mind at any time using the “Cookies” link in the footer. It is provided by Google Ireland Ltd., which may transfer data to the US under the EU-US Data Privacy Framework. We don’t use advertising cookies.
| Name | Where | Purpose | Duration |
|---|---|---|---|
tendr_session | Dashboard | Technical cookie to keep you signed in. | 30 days |
| Google sign-in cookie | Dashboard | Protects signing in with Google. | 10 minutes |
tendr_mode, tendr_lang_choice | This website | Local storage: remembers your language and reading mode. | Until you delete it |
tendr_vid, tendr_conv, tendr_history and similar | Stores with the chat | Local storage: your visitor code and the conversation. Only saved once you interact with the chat. | Until you delete it |
tendr_conv (cookie) | Stores with the chat | Created when you press “Go to checkout” and used to attribute the order to the conversation. The store can set it so that it is only created with your consent. | 7 days |
_ga, _ga_* | This website, only if you accept | Google Analytics: tells visits apart to measure how the site is used. | 13 months |
tendr_consent | This website | Local storage: remembers whether you accepted or rejected Google Analytics. If you reject it, we delete its cookies. | 12 months; then we ask again |
__stripe_mid, __stripe_sid | Dashboard, when paying | Stripe: technical cookies to prevent payment fraud. | 1 year and 30 minutes |
Cloudflare may set its own technical security cookies. On each store, the store itself must provide information about these elements and ask for consent where applicable.
Your rights
You can access, rectify and erase your data, object to or restrict its processing, and request its portability by writing to [email protected]. We reply within one month at most. If we process data on the basis of your consent, you can withdraw it without affecting prior processing. From My account you can download a copy of your data, change your email preferences and delete your account.
If you believe we haven’t handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es) or with the authority in your country. Wherever you live, we handle these requests in the same way; if the law of your country gives you additional rights, those apply too.
Minors and changes
You must be of legal age to create a Tendr account. Children under 14 must not use a store’s chat without permission from their parents or guardians (in other countries, the age set by their law). If we detect a minor’s data without that permission, we delete it.
If we make material changes to this policy, we will notify you by email or in the dashboard before they apply.