Privacy Policy

We collect the minimum we need to run the Service: your email address to sign you in, billing details handled by our payment processor, your plan and coverage settings, and basic usage analytics. We do not sell your personal data. The government contract and vendor records you browse in the product are public business records, not personal data we have collected about you.

• Account data. Your email address, used for passwordless sign-in and account management.
• Subscription and billing data. Your plan, selected state coverage, and billing status. Payments are processed by Stripe; we do not store your full card number — Stripe handles card data as an independent controller under its own terms.
• Preferences. Your alert settings (such as categories, value thresholds, and states you have chosen to follow) and interface preferences such as light/dark theme.
• Usage and device data. Aggregate, privacy-friendly analytics about how the Service is used (for example pages viewed and performance metrics), collected via our hosting and analytics providers without cookies.
• Support correspondence. Messages you send us and our replies.

We do not knowingly collect special category data, and the Service is not directed at children. WasteContractWatch is a tool for vendors and professionals; where it serves the K-12 or public-sector market, it processes public procurement records about agencies and their suppliers — it does not collect or process student records, resident data, or any data about the end-users of those public bodies.

The contract listings, agency information, and vendor names shown in the Service are compiled from publicly available government procurement records and open-data sources. This is primarily information about organisations and public bodies. Where a public record happens to identify an individual (for example a sole-trader supplier named in an award), we process it on the basis of our legitimate interest in providing procurement intelligence from public sources. If you are named in such a record and wish to exercise your rights, contact us at support@wastecontractwatch.com.

• To provide the Service — sign-in, your subscription, alerts, and account features. Legal basis: performance of a contract.
• To take payment — processing subscriptions and preventing fraud. Legal basis: performance of a contract and legitimate interests.
• To operate, secure, and improve the Service — analytics, debugging, and security. Legal basis: legitimate interests in running a safe, functional product.
• To communicate with you — service and transactional emails (such as sign-in links and the alerts you request). Legal basis: performance of a contract. Any marketing emails are sent only where permitted, and you can opt out at any time.
• To meet legal obligations — for example accounting and tax records. Legal basis: legal obligation.

We keep this simple and use only what the Service needs to function:

• a strictly necessary cookie that keeps you signed in after you use your magic link; and
• a theme preference(light/dark) stored in your browser’s local storage, not sent to us.

Our analytics (provided by Vercel) are cookieless and do not track you across sites. Because we do not set advertising or other non-essential cookies, we do not show a cookie-consent banner; you can clear the items above at any time through your browser. If we introduce non-essential cookies in future, we will ask for your consent first.

If you use the AI bid-assessment feature, the procurement text you submit is sent to our AI provider (OpenAI) to generate an assessment, and a short excerpt of your input together with the result is saved to your account so you can revisit it. Assessments are informational only: they are generated by an automated model to support your own judgement and are not a solely automated decision producing legal or similarly significant effects about any individual. Please do not paste personal or confidential information into the assessment field.

We share personal data with trusted providers who process it on our behalf, or (in Stripe’s case) as an independent controller, to run the Service:

• Supabase — database hosting and authentication;
• Vercel — application hosting and cookieless, privacy-friendly analytics;
• Stripe — payment processing. Stripe acts as an independent controller for card and payment data under its own terms;
• Resend — delivery of sign-in links, alerts, and transactional email;
• Inngest — background job orchestration for the scheduled alert digests;
• OpenAI — processing the procurement text you submit to the AI bid-assessment feature.

Some of these providers are based in, or process data in, the United States or other countries outside the UK. Where personal data is transferred internationally, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or transfers to jurisdictions covered by UK adequacy regulations. You can request a copy of the relevant safeguards by emailing support@wastecontractwatch.com. We do not sell your personal data or share it for third-party advertising.

We keep your account and preference data for as long as your account is active and for up to 12 months after you close it, to handle queries and meet our obligations, after which we delete or anonymise it. We keep billing and tax records for as long as required by law (typically six years).

Subject to UK data protection law, you have the right to:

• access the personal data we hold about you;
• ask us to correct inaccurate or incomplete data;
• ask us to erase your data, or restrict or object to our processing of it;
• request portability of data you provided to us; and
• withdraw consent at any time where we rely on consent.

To exercise any of these rights, email support@wastecontractwatch.com. You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk, though we’d appreciate the chance to resolve concerns first.

We use technical and organisational measures appropriate to the risk — including encryption in transit, access controls, and reputable infrastructure providers — to protect personal data. No system is perfectly secure, but we work to protect your information and will notify you and the relevant authority of a personal data breach where required by law.

We may update this Privacy Policy from time to time. We will update the “last updated” date above and, for material changes, take reasonable steps to notify you.

The data controller for the Service is:

For any privacy question or to exercise your rights, contact us at the email above.