Privacy Policy

01Who is responsible for your data

The data controller is CLEF, operator of ICOpedia, Nouakchott, Mauritania, contact@icopedia.org.

For people residing in the European Union, the General Data Protection Regulation applies to this processing.

For any question about this policy, or to exercise your rights, write to contact@icopedia.org.

No data protection officer is appointed. Requests concerning your data are made to contact@icopedia.org.

02What this policy covers

This policy covers the whole ICOpedia service:

• the icopedia.org website, which presents the service and publishes editorial content
• the app.icopedia.org application, which gives access to the notice catalogue, alerts, the Coco assistant and the submission workspace
• the emails we send you as part of the service

It does not cover third-party sites the service links to, in particular the portals of public buyers and development funders. Those sites apply their own policy.

03Data we process

3.1 Data you give us

• Account: email address and name.
• Password: stored in a one-way encrypted form by our authentication provider. We never have access to it in clear text.
• Monitoring preferences: sectors, countries, contract types, funders, thresholds, languages.
• Saved searches and alerts: the criteria you save and the frequency you choose.
• Favourites: the notices you set aside.
• Submission workspace: the documents you upload, the drafts you write and the associated metadata.
• Conversations with the Coco assistant: the questions you ask and the answers given to you.
• Expert profile or organisation profile: the information you choose to fill in, which may appear in the directory if you publish it.
• Messages: the content of the emails or forms you send us.
• Website newsletter sign-up: the email address and the consent you give.

3.2 Data produced by your use of the service

• Usage events: pages viewed, searches run, filters applied, listings opened, actions performed, with their timestamps.
• Alert logs: the alerts sent to you and the notices they contained.
• Email events: sending, delivery, opening, click, bounce and unsubscribe, reported by our email provider.
• Technical data: IP address, browser type, device type, pages viewed, connection dates and times.
• Error reports: the error message and the technical context of the incident.
• Account information: subscription plan, trial end date, creation and last login dates.

3.3 Payment data

Card payment is handled by Stripe. We neither receive nor store your card details.

Mobile money payment is handled by pawaPay. You choose your operator and enter your phone number on the pawaPay payment page, then approve the payment on your phone with your PIN. We never receive your PIN and do not keep your phone number. We send pawaPay only the amount, the currency, the country, the description of the purchase and an internal identifier of your account, so that the payment can be matched to your account.

We keep the information needed to follow the subscription and issue invoices: subscription identifier, billing period, status, amounts, dates and invoices, and, for mobile money, the payment identifier, the country and the operator.

3.4 Data contained in republished notices

The catalogue republishes notices issued by public buyers, development funders and international organisations. Those notices, and the extracts of official files that accompany them, sometimes contain the professional contact details of public officials or contact points: name, role, email address, telephone number, organisation address. Section 5 is devoted to them.

04Purposes and legal bases

We process your data for the following purposes.

• Creating and managing your account, giving you access to the service. Legal basis: performance of the contract formed by the terms of service.
• Providing the features of the service: search, filters, favourites, daily and real-time alerts, Coco assistant, tender analysis, submission workspace. Legal basis: performance of the contract.
• Handling your subscription, collecting payment, issuing invoices. Legal basis: performance of the contract, and compliance with our accounting and tax obligations.
• Sending you the emails related to the service: confirmation, password reset, onboarding after sign-up, alerts, information about your access and our offers. Legal basis: performance of the contract, and our legitimate interest for onboarding and offer emails, which you can stop through the link in each of them.
• Sending you the website newsletter. Legal basis: your consent, which you may withdraw at any time.
• Measuring audience and understanding use of the service, in order to improve it. Legal basis: your consent for non-essential trackers, and our legitimate interest in improving a service we operate for measurements that do not rely on a tracker.
• Keeping the service secure, preventing fraud and abuse, detecting incidents. Legal basis: our legitimate interest in protecting the service and its users.
• Building and maintaining the catalogue of public notices. Legal basis: our legitimate interest in distributing already public information to the professionals who look for it. See section 5.
• Answering your requests and complaints. Legal basis: our legitimate interest in maintaining the relationship with our users.
• Complying with our legal obligations and responding to requests from authorities. Legal basis: legal obligation.

We do not sell your data or pass it on to data brokers. Measuring Facebook and Instagram campaigns and personalizing advertising through the Meta pixel rely on your consent, which you may withdraw as described in section 11.

05Republished notices and public officials' contact details

The core of the service is the republication of tender notices and expert assignments already published by their authors on sites open to everyone.

Some of these notices, and the extract of the official file shown beneath the description, contain the professional contact details of the procedure’s contact point: name, role, email address, telephone number, organisation address.

We republish these contact details as they appear at source, without masking them. They are useful to whoever is preparing a bid, who often needs to ask a question or obtain the file from that contact.

The legal basis for this processing is our legitimate interest in distributing already public administrative information to the professionals who look for it. We have balanced that interest against the rights of the people concerned: the data processed is professional contact information, published by the organisation itself so that it can be contacted as part of the procedure, and it is neither enriched, nor cross-referenced with other sources, nor used for marketing purposes.

If you are one of those people and no longer wish your contact details to appear in our catalogue, you may object at any time by writing to contact@icopedia.org, stating the address of the listing concerned. We remove the contact details from the listing within a reasonable time, unless there are compelling legitimate grounds to keep them. Removal from our catalogue does not change the original publication, which remains the responsibility of its author.

06Recipients and processors

Your data is accessible to authorised staff of ICOpedia, within the limits of what their role requires.

We use the following providers, acting as processors or as technical suppliers.

Hosting and infrastructure

• Supabase: database hosting, account authentication and file storage.
• Lovable: building, publishing and hosting the app.icopedia.org application, and gateway to some artificial intelligence models.
• Hostinger: hosting of the icopedia.org website.

Payment

• Stripe: collecting subscription payments, managing payment methods and billing.
• pawaPay (Payments Techco OÜ and its local payment providers): collecting mobile money payments. Your mobile money operator (for example Orange Money, MTN MoMo or Moov Money) also processes the payment.

Email

• Resend: sending the service’s emails, in particular alerts and the activity digest, and reporting sending events.

Audience measurement and technical monitoring

• Google: Google Tag Manager and Google Analytics 4, for audience measurement, and Google Fonts for font display.
• Meta Platforms: the Meta pixel for measuring Facebook and Instagram campaigns and personalizing advertising with your consent; see section 11 and the Meta Privacy Policy.
• Sentry: collection of technical errors. The tool is configured to transmit no user identifier, no cookie, no request header and no address parameter.

Mapping

• OpenStreetMap and Esri, through the ArcGIS Online service: supply of base maps. Displaying a map calls these services from your browser, which passes them your IP address.

Artificial intelligence models and document processing

• Anthropic: Claude models, used by the Coco assistant and by internal processing.
• Google, through the Lovable gateway: Gemini models, used by the Coco assistant, tender analysis and bid preparation.
• Groq: open models served by this provider, used as a fallback when the gateway is unavailable or saturated.
• Voyage AI: computation of the vector representations that power semantic search and the assistant.
• Mistral AI: optical character recognition on tender files in PDF format.
• Firecrawl: text extraction from the public notice pages we collect.

Forms

• JotForm: hosting of the survey forms sent to users of the service (European-region account, data hosted in the European Union).

We may also disclose data to an adviser, an auditor or an authority, where the law requires it or to assert our rights.

This list reflects the state of the service as of 23 September 2026, updated on 22 October 2026 for mobile money payments. It is reviewed whenever this policy is changed.

07Transfers outside the European Union

Some of our providers are established outside the European Union, mainly in the United States.

These transfers are framed, depending on the provider, by an adequacy decision of the European Commission or by the standard contractual clauses adopted by the Commission, supplemented where necessary by additional measures.

The countries of establishment and the transfer frameworks are as follows:

• Hostinger: Cyprus, European Union.
• Lovable: Sweden, European Union.
• Supabase: a company established in Singapore, the data being hosted in the European Union, in Ireland.
• Stripe: for European merchants, payment is handled by Stripe Payments Europe Ltd, established in Ireland, European Union.
• pawaPay: Payments Techco OÜ, established in Estonia, European Union. The payment is then processed in your country by pawaPay’s local payment provider and by your mobile money operator.
• Mistral AI: France, European Union.
• Resend, Sentry, Google, Anthropic, Groq, Voyage AI and Firecrawl: United States. These transfers are framed by the European Commission’s standard contractual clauses or by the EU-US Data Privacy Framework.
• Meta Platforms: data collected by the pixel may be processed in several countries, including the United States, under the safeguards and arrangements described in its Privacy Policy.
• OpenStreetMap and Esri: base maps are called directly by your browser, as stated in section 6.

The application database is hosted in the European Union, in Ireland, in an Amazon Web Services data centre in the eu-west-1 region.

You may obtain a copy of the safeguards in place by writing to contact@icopedia.org.

08The Coco assistant and artificial intelligence models

When you ask the Coco assistant a question, run a tender analysis or use the drafting assistance, the content of your request is passed to the model providers named in section 6, in order to produce an answer.

That content may include the text you type, the extracts of notices your question relates to, and the documents you have uploaded to the submission workspace where the feature uses them.

Do not enter any information you do not want passed to a third-party provider, and in particular no sensitive data, no trade secret you are not entitled to share, and no personal data about third parties you are not entitled to disclose.

Answers are generated automatically and may be wrong. They produce no legal effect and form no automated decision concerning you within the meaning of article 22 of the General Data Protection Regulation.

These model providers are used through their professional interfaces, whose terms exclude the reuse of the content passed to them for training their models.

09Retention periods

The retention periods adopted are as follows.

• Account and associated data, including preferences, alerts, favourites and drafts: for the life of the account, then deletion.
• Inactive account: deletion after three years without login, following a reminder email left unanswered.
• Conversations with the Coco assistant: twelve months from the last message in the conversation.
• Documents and drafts in the submission workspace: for the life of the account, then deletion.
• Usage events: twenty-five months.
• Alert logs and email events: thirteen months.
• Technical error reports: twelve months.
• Newsletter sign-up address: until consent is withdrawn or you unsubscribe, then three years from the last contact.
• Billing data and accounting records: ten years from the end of the financial year, in accordance with the applicable accounting obligations.
• Mobile money payment data held by pawaPay: six years from the payment, under its data processing agreement with us.
• Data linked to a complaint or a dispute: until the end of the applicable limitation period.
• Application audience measurement: Google cookies limited to 390 days, without automatic renewal on each visit. The Google Analytics property retains detailed event data for two months and user data for fourteen months; the user retention period resets on new activity. These settings do not limit aggregated report retention.
• Application consent choices: 180 days; Meta advertising cookies: see section 11.

When you delete your account, the associated data is erased within thirty days, except for records the law requires us to keep, in particular accounting records, and for anonymised data, which no longer allows you to be identified.

10Your rights

Under the conditions set out in the General Data Protection Regulation, you have the following rights:

• right of access to your data
• right to rectification of inaccurate data
• right to erasure
• right to restriction of processing
• right to object to processing based on our legitimate interest, including for the republished contact details covered by section 5
• right to portability of the data you have provided to us
• right to withdraw your consent at any time, for the processing that depends on it, without affecting what was done beforehand
• right to give directions on what happens to your data after your death

Two of these rights are exercised directly from your account: the profile page lets you export your data to a file, and delete your account.

For other requests, write to contact@icopedia.org. We reply within one month of receiving the request, a period that may be extended by two months if the request is complex. We may ask you to prove your identity where there is reasonable doubt.

If you consider that your rights are not respected, you may lodge a complaint with the competent data protection authority of your country of residence.

11Cookies, audience measurement and advertising

In app.icopedia.org, essential features, including authentication and remembering your privacy choices, remain available when you decline optional trackers.

You have two independent choices:

• Audience measurement: with your consent, Google Tag Manager loads Google Analytics 4 to measure visits, journeys and registrations confirmed through the application’s email confirmation flow or by creating an account with Google. We do not add your name, email address or account identifier to events sent to this tool; links containing account tokens are excluded from tracking.
• Advertising: with your consent, Google Tag Manager loads the Meta pixel to measure visits and registrations confirmed through the same flow, evaluate Facebook and Instagram campaigns and enable advertising personalization by Meta. The pixel transmits information including visited pages and browser details; Meta may associate this with your use of its services. This choice is independent of Google audience measurement.

No GTM, GA4 or Meta script loads in the application before a positive choice. Declining all is as easy as accepting all and does not prevent access to the service. Your choice lasts 180 days in this browser for the application, before we ask again. You may change or withdraw it under “Cookie settings”; withdrawal stops the relevant transmissions, reloads the page and removes the relevant cookies accessible to the application.

The application’s Google cookies are limited to 390 days and are not automatically renewed on every visit. Meta manages its advertising cookies, and accessible cookies are removed when advertising consent is withdrawn. For Meta’s own processing and retention periods, see its Privacy Policy and Cookies Policy.

The origin of your visit may be kept in memory while you browse: the campaign parameters of your arrival link, where applicable the advertising platform of the click (Meta, LinkedIn or Google, without the click identifier it adds), the site you came from and the first page you opened. By default nothing is written to your device. It is saved with your account when you sign up by email. With “Continue with Google”, and only if you accepted audience measurement, it is kept in your browser’s session storage for the round trip, one hour at most, and then deleted; it is saved only if that return creates your account. It tells us which channels bring sign-ups and it is deleted with your account. Requesting an email does not count as a confirmed registration.

These choices apply to app.icopedia.org. The icopedia.org website has a separate configuration; your application choices are not automatically applied there.

You may also set your browser to refuse cookies. Refusing essential cookies may prevent certain features from working.

12Security

We put in place technical and organisational measures to protect your data: encryption of exchanges, per-account access control to data, separation of administration access, access logging, and hosting with professional providers.

No service is immune to an incident. In the event of a data breach likely to create a high risk to your rights, we inform you under the conditions set out in the General Data Protection Regulation, and we notify the supervisory authority.

13Minors

The service is aimed at professionals and is not intended for minors. We do not knowingly collect data about a minor. If you notice that an account has been created by a minor, report it to contact@icopedia.org and we will delete it.

14Changes to this policy

We may change this policy, in particular to reflect a change in the service, in our providers or in applicable regulation.

The date of the latest update appears at the top of the document. In the event of a substantial change, we inform you by email or in the application before it takes effect.

15Contact

For any question about this policy, about the processing of your data, or to exercise your rights: contact@icopedia.org.