Privacy policy.

1. Who is responsible for your data

Fractional Quest Ltd (company number 17322105), registered office 71–75 Shelton Street, London WC2H 9JQ, is the data controller for personal data processed through rfp.quest. We are committed to protecting your privacy and handling your data in line with UK GDPR and the Data Protection Act 2018.

2. What we collect

Account data: your name, your email address and the password you sign in with, handled by Better Auth, the sign-in software we run ourselves, and stored in our database.
Company profile: the statements about your company that you record in your workspace’s company profile, each with its authority.
Workspace content: the deals, tasks, requirements and evidence, bid decisions and reasons, and records of whether a bid was submitted that you and your colleagues enter in your company’s workspace.
Usage data: the tenders you view and search, and feature usage, used to provide and improve the Service.
Assistance and research: when enabled, your saved questions, source snapshots, answers, proposed statements and report drafts. Assistance history is private to your account within the workspace; confirmed company statements are visible to its members.
Unfinished saves: while you are signed in, your browser keeps a copy of a change you have started to save, in its local storage, so that it can be recovered if the page reloads or the connection drops. It stays in your browser and is removed once the save is settled.

3. How we use it

We use your data to operate your account, provide the workspace features you use, show you the tenders and changes that need your attention, improve the Service, and communicate with you about your account. We process this data on the basis of performing our contract with you and our legitimate interest in running and improving the Service.

4. Who we share it with

We do not sell your personal data. We share it only with the processors that run the Service on our behalf — our database provider (Neon, which hosts our PostgreSQL database), our web hosting provider (Vercel), the provider that runs our application service (Railway) and AI providers used for enabled features (TypeSafe for judgments; Vercel AI Gateway and its selected model provider for conversation), subject to their applicable processing terms. Snitcher acts as our processor for visitor identification on public pages (section 5). When the Service produces an AI judgment, the workspace content needed to answer the question is sent to our AI provider. Public tender data shown in the Service is already public information under the Open Government Licence.

Exa web research sends your question to Exa only when you approve a lookup. Results may include professional details of named individuals. Saved assistance runs retain the retrieved sources; they do not automatically confirm company facts. Conversation sends the relevant confirmed company statements and research evidence to the selected model provider. The composer explains this before you send a question.

Voice conversation, when you start it, sends your microphone audio to ElevenLabs, which transcribes it, turns replies into speech and manages the call. In research conversations each spoken turn is answered by the Service from your workspace and saved like a typed message. In the onboarding interview the replies come from a model hosted by ElevenLabs, which is given your name, role, company name, confirmed company statements, open topics, buyers you have named or watched and a summary of your last call for the duration of the call. During the interview, each thing you say (your side of the call, as the transcription hears it) is sent by your browser to the Service as you say it and kept with your workspace; what is about your company becomes suggestions on screen for you to confirm, and when you name a buyer the Service looks it up in its notice library and shows it to you and to the interviewer. After the call the Service fetches the call transcript, its summary and cost and keeps them with your workspace. While private memory is in use for the Service (it can be paused, as it is while the memory store is being set up), onboarding interviews always try to remember what you tell us: each thing you say in the interview (not the interviewer’s replies) is sent to your private memory, held by Zep for you alone, as you say it, and what Zep holds is given to the interviewer during this call and read at the start of your next interview, so the interviewer can pick up where you left off. You are not asked each time. Sending or reading can fail, and nothing is retried after an attempt that may have reached Zep, so something you said may not be remembered. Asking for erasure in your workspace settings stops this from then on and requests deletion of what was sent to Zep; it is checked again before anything is sent. Erasure in Zep does not delete the call transcripts, summaries and suggestions kept with your workspace in our own database (see Retention). Research voice conversations use no private memory. If you ask the interviewer to watch a buyer or start a pursuit, that is saved only as a proposal until you confirm it on screen. ElevenLabs keeps no audio recording; it keeps a text transcript on its systems for 30 days, after which it is deleted. Voice is not required to use the Service.

5. Cookies, analytics and visitor identification

We use strictly necessary cookies to keep you signed in and secure your session. We do not use advertising cookies. Apart from cookies, your browser’s local storage holds the unfinished saves described above and your cookie choices.

Snitcher (snitcher.com) runs on our public pages, not inside the signed-in app. On every visit, Snitcher looks up your IP address to identify the organisation it belongs to (for example company name, website, industry, size and location) and records the pages viewed, time on site, how you arrived, and clicks on booking or contact buttons. It does not tell us who you are personally. If you accept cookies it also stores an identifier in your browser so return visits are linked. We use this to understand which organisations are interested in our services and we may contact those organisations through normal business channels. Snitcher acts as our processor.

Lawful basis: legitimate interests (understanding and developing business interest in our services) for IP-based organisation identification; your consent for analytics cookies.

Your choices: Accept or Reject in the banner, and change it any time with Cookie settings at the bottom of any page. To object to organisation identification or ask us to delete data, contact privacy@rfp.quest.

The optional Cal.com meeting calendar loads only after you allow it. You can decline it, use the link to visit Cal.com separately, or change your choice with Cookie settings at the bottom of any page. Turning it off removes the calendar and reloads the page if its script has loaded; this does not erase information already given to Cal.com.

6. Retention

We keep your account and workspace data for as long as your account is active. Account deletion is not available inside the app: to have your account and associated data deleted, email privacy@rfp.quest to request deletion. The operator handles requests; automated deletion and a verified response timetable are not yet available. Necessary security, billing and legal records may require separate handling. Voice call transcripts held by ElevenLabs are deleted by that provider after 30 days (section 4).

7. Your rights

Under UK GDPR you have the right to access, correct, delete, or port your personal data, and to object to or restrict certain processing. You can contact us to exercise any right, including to have your account deleted, which is not yet available inside the app. You may also complain to the Information Commissioner’s Office (ico.org.uk).

8. Contact

For any privacy question or request, contact privacy@rfp.quest.