Privacy Policy

01Who is responsible for your data

The data controller is ICOpedia, Nouakchott, Mauritania, contact@icopedia.org.

For people residing in the European Union, the General Data Protection Regulation applies to this processing.

For any question about this policy, or to exercise your rights, write to contact@icopedia.org.

No data protection officer is appointed. Requests concerning your data are made to contact@icopedia.org.

02What this policy covers

This policy covers the whole ICOpedia service:

• the icopedia.org website, which presents the service and publishes editorial content
• the app.icopedia.org application, which gives access to the notice catalogue, alerts, the Coco assistant and the submission workspace
• the emails we send you as part of the service

It does not cover third-party sites the service links to, in particular the portals of public buyers and development funders. Those sites apply their own policy.

03Data we process

3.1 Data you give us

• Account: email address and name.
• Password: stored in a one-way encrypted form by our authentication provider. We never have access to it in clear text.
• Monitoring preferences: sectors, countries, contract types, funders, thresholds, languages.
• Saved searches and alerts: the criteria you save and the frequency you choose.
• Favourites: the notices you set aside.
• Submission workspace: the documents you upload, the drafts you write and the associated metadata.
• Conversations with the Coco assistant: the questions you ask and the answers given to you.
• Expert profile or organisation profile: the information you choose to fill in, which may appear in the directory if you publish it.
• Messages: the content of the emails or forms you send us.
• Website newsletter sign-up: the email address and the consent you give.

3.2 Data produced by your use of the service

• Usage events: pages viewed, searches run, filters applied, listings opened, actions performed, with their timestamps.
• Alert logs: the alerts sent to you and the notices they contained.
• Email events: sending, delivery, opening, click, bounce and unsubscribe, reported by our email provider.
• Technical data: IP address, browser type, device type, pages viewed, connection dates and times.
• Error reports: the error message and the technical context of the incident.
• Account information: subscription plan, trial end date, creation and last login dates.

3.3 Payment data

Payment is handled by Stripe. We neither receive nor store your card details. We keep the information needed to follow the subscription and issue invoices: subscription identifier, billing period, status, amounts, dates and invoices.

3.4 Data contained in republished notices

The catalogue republishes notices issued by public buyers, development funders and international organisations. Those notices, and the extracts of official files that accompany them, sometimes contain the professional contact details of public officials or contact points: name, role, email address, telephone number, organisation address. Section 5 is devoted to them.

04Purposes and legal bases

We process your data for the following purposes.

• Creating and managing your account, giving you access to the service. Legal basis: performance of the contract formed by the terms of service.
• Providing the features of the service: search, filters, favourites, daily and real-time alerts, Coco assistant, tender analysis, submission workspace. Legal basis: performance of the contract.
• Handling your subscription, collecting payment, issuing invoices. Legal basis: performance of the contract, and compliance with our accounting and tax obligations.
• Sending you the emails related to the service: confirmation, password reset, alerts, subscription information. Legal basis: performance of the contract.
• Sending you the website newsletter. Legal basis: your consent, which you may withdraw at any time.
• Measuring audience and understanding use of the service, in order to improve it. Legal basis: your consent for non-essential trackers, and our legitimate interest in improving a service we operate for measurements that do not rely on a tracker.
• Keeping the service secure, preventing fraud and abuse, detecting incidents. Legal basis: our legitimate interest in protecting the service and its users.
• Building and maintaining the catalogue of public notices. Legal basis: our legitimate interest in distributing already public information to the professionals who look for it. See section 5.
• Answering your requests and complaints. Legal basis: our legitimate interest in maintaining the relationship with our users.
• Complying with our legal obligations and responding to requests from authorities. Legal basis: legal obligation.

We do not sell your data. We do not use it for targeted advertising. We do not pass it on to data brokers.

05Republished notices and public officials' contact details

The core of the service is the republication of tender notices and expert assignments already published by their authors on sites open to everyone.

Some of these notices, and the extract of the official file shown beneath the description, contain the professional contact details of the procedure’s contact point: name, role, email address, telephone number, organisation address.

We republish these contact details as they appear at source, without masking them. They are useful to whoever is preparing a bid, who often needs to ask a question or obtain the file from that contact.

The legal basis for this processing is our legitimate interest in distributing already public administrative information to the professionals who look for it. We have balanced that interest against the rights of the people concerned: the data processed is professional contact information, published by the organisation itself so that it can be contacted as part of the procedure, and it is neither enriched, nor cross-referenced with other sources, nor used for marketing purposes.

If you are one of those people and no longer wish your contact details to appear in our catalogue, you may object at any time by writing to contact@icopedia.org, stating the address of the listing concerned. We remove the contact details from the listing within a reasonable time, unless there are compelling legitimate grounds to keep them. Removal from our catalogue does not change the original publication, which remains the responsibility of its author.

06Recipients and processors

Your data is accessible to authorised staff of ICOpedia, within the limits of what their role requires.

We use the following providers, acting as processors or as technical suppliers.

Hosting and infrastructure

• Supabase: database hosting, account authentication and file storage.
• Lovable: building, publishing and hosting the app.icopedia.org application, and gateway to some artificial intelligence models.
• Hostinger: hosting of the icopedia.org website.

Payment

• Stripe: collecting subscription payments, managing payment methods and billing.

Email

• Resend: sending the service’s emails, in particular alerts and the activity digest, and reporting sending events.

Audience measurement and technical monitoring

• Google: Google Tag Manager and Google Analytics 4, for audience measurement, and Google Fonts for font display.
• Sentry: collection of technical errors. The tool is configured to transmit no user identifier, no cookie, no request header and no address parameter.

Mapping

• OpenStreetMap and Esri, through the ArcGIS Online service: supply of base maps. Displaying a map calls these services from your browser, which passes them your IP address.

Artificial intelligence models and document processing

• Anthropic: Claude models, used by the Coco assistant and by internal processing.
• Google, through the Lovable gateway: Gemini models, used by the Coco assistant, tender analysis and bid preparation.
• Groq: open models served by this provider, used as a fallback when the gateway is unavailable or saturated.
• Voyage AI: computation of the vector representations that power semantic search and the assistant.
• Mistral AI: optical character recognition on tender files in PDF format.
• Firecrawl: text extraction from the public notice pages we collect.

Forms

• JotForm: hosting of the survey forms sent to users of the service (European-region account, data hosted in the European Union).

We may also disclose data to an adviser, an auditor or an authority, where the law requires it or to assert our rights.

This list reflects the state of the service as of 12 September 2026. It is reviewed whenever this policy is changed.

07Transfers outside the European Union

Some of our providers are established outside the European Union, mainly in the United States.

These transfers are framed, depending on the provider, by an adequacy decision of the European Commission or by the standard contractual clauses adopted by the Commission, supplemented where necessary by additional measures.

The countries of establishment and the transfer frameworks are as follows:

• Hostinger: Cyprus, European Union.
• Lovable: Sweden, European Union.
• Supabase: a company established in Singapore, the data being hosted in the European Union, in Ireland.
• Stripe: for European merchants, payment is handled by Stripe Payments Europe Ltd, established in Ireland, European Union.
• Mistral AI: France, European Union.
• Resend, Sentry, Google, Anthropic, Groq, Voyage AI and Firecrawl: United States. These transfers are framed by the European Commission’s standard contractual clauses or by the EU-US Data Privacy Framework.
• OpenStreetMap and Esri: base maps are called directly by your browser, as stated in section 6.

The application database is hosted in the European Union, in Ireland, in an Amazon Web Services data centre in the eu-west-1 region.

You may obtain a copy of the safeguards in place by writing to contact@icopedia.org.

08The Coco assistant and artificial intelligence models

When you ask the Coco assistant a question, run a tender analysis or use the drafting assistance, the content of your request is passed to the model providers named in section 6, in order to produce an answer.

That content may include the text you type, the extracts of notices your question relates to, and the documents you have uploaded to the submission workspace where the feature uses them.

Do not enter any information you do not want passed to a third-party provider, and in particular no sensitive data, no trade secret you are not entitled to share, and no personal data about third parties you are not entitled to disclose.

Answers are generated automatically and may be wrong. They produce no legal effect and form no automated decision concerning you within the meaning of article 22 of the General Data Protection Regulation.

These model providers are used through their professional interfaces, whose terms exclude the reuse of the content passed to them for training their models.

09Retention periods

The retention periods adopted are as follows.

• Account and associated data, including preferences, alerts, favourites and drafts: for the life of the account, then deletion.
• Inactive account: deletion after three years without login, following a reminder email left unanswered.
• Conversations with the Coco assistant: twelve months from the last message in the conversation.
• Documents and drafts in the submission workspace: for the life of the account, then deletion.
• Usage events: twenty-five months.
• Alert logs and email events: thirteen months.
• Technical error reports: twelve months.
• Newsletter sign-up address: until consent is withdrawn or you unsubscribe, then three years from the last contact.
• Billing data and accounting records: ten years from the end of the financial year, in accordance with the applicable accounting obligations.
• Data linked to a complaint or a dispute: until the end of the applicable limitation period.
• Audience measurement trackers: tracker lifetime limited to thirteen months, associated data kept twenty-five months.

When you delete your account, the associated data is erased within thirty days, except for records the law requires us to keep, in particular accounting records, and for anonymised data, which no longer allows you to be identified.

10Your rights

Under the conditions set out in the General Data Protection Regulation, you have the following rights:

• right of access to your data
• right to rectification of inaccurate data
• right to erasure
• right to restriction of processing
• right to object to processing based on our legitimate interest, including for the republished contact details covered by section 5
• right to portability of the data you have provided to us
• right to withdraw your consent at any time, for the processing that depends on it, without affecting what was done beforehand
• right to give directions on what happens to your data after your death

Two of these rights are exercised directly from your account: the profile page lets you export your data to a file, and delete your account.

For other requests, write to contact@icopedia.org. We reply within one month of receiving the request, a period that may be extended by two months if the request is complex. We may ask you to prove your identity where there is reasonable doubt.

If you consider that your rights are not respected, you may lodge a complaint with the competent data protection authority of your country of residence.

11Cookies and audience measurement

A cookie is a small file placed on your device when you visit a site.

We use two categories of tracker:

• trackers strictly necessary for the service to work, in particular those that keep your session logged in and those that secure payment, which do not require your consent
• audience measurement trackers, placed by Google Tag Manager and Google Analytics 4

No advertising tracker is placed.

On the icopedia.org website and in the app.icopedia.org application alike, non-essential trackers and audience measurement are only loaded after you have given consent through the banner, and you may change or withdraw that choice at any time from the cookie settings.

You may also set your browser to refuse cookies. Refusing strictly necessary trackers may prevent the service from working.

12Security

We put in place technical and organisational measures to protect your data: encryption of exchanges, per-account access control to data, separation of administration access, access logging, and hosting with professional providers.

No service is immune to an incident. In the event of a data breach likely to create a high risk to your rights, we inform you under the conditions set out in the General Data Protection Regulation, and we notify the supervisory authority.

13Minors

The service is aimed at professionals and is not intended for minors. We do not knowingly collect data about a minor. If you notice that an account has been created by a minor, report it to contact@icopedia.org and we will delete it.

14Changes to this policy

We may change this policy, in particular to reflect a change in the service, in our providers or in applicable regulation.

The date of the latest update appears at the top of the document. In the event of a substantial change, we inform you by email or in the application before it takes effect.

15Contact

For any question about this policy, about the processing of your data, or to exercise your rights: contact@icopedia.org.