Your data at Holdfast

Who we are

Holdfast (holdfastcontracts.com) is responsible for your data (the "controller"). Write to support@holdfastcontracts.com about anything on this page.

What we keep, and why

• Your account (to provide the service you signed up for): company name, your name, work email, phone if you give it, country, your login (the password only as a one-way hash), your plan and billing status, and the Stripe customer reference.
• Your profile and tools (same reason): trades, areas, minimum value, your goal and answers to our onboarding questions, the evidence you write for bids, contracts you add, compliance document names and expiry dates, price checks, tenders you mark won or lost, your Contract Readiness answers, and your 0-10 scores and comments.
• Tender documents you upload to Explain This Tender: read once and not stored. We keep the file names and sizes, and the explanation and bid draft made from them.
• Done for you orders: your firm and contact details, the tender link and the documents you upload, which we keep to write and review your bid.
• The free weekly email (with your consent): your email address, the trade and area you chose, and when you agreed and confirmed. When you unsubscribe we keep a note of it so we never email you again.
• Free Contracts Report requests: your email and firm name, to send the report you asked for.
• Subcontract matching (only if you switch it on): other opted-in firms see your company name, trades, area and the note you write. Nothing else. Your email is shared only if you reply to an introduction.
• Security (our legitimate interest in keeping accounts safe): the IP address of login, sign-up and password-reset attempts, deleted after 2 days. Page request counts per visitor are kept in memory for one minute only.
• Business outreach (our legitimate interest): when we write to a firm about its own public contracts, we keep the business email address we used and what happened (replied, not interested). If you ask us to stop, we keep your address on a do-not-contact list so it never happens again. A person sends every outreach email; nothing is sent automatically.
• Public contract data: award and tender notices are published by public buyers. They name the firms that won contracts. We show these business details as published.

Who helps us (processors)

• Render hosts the website and the database (in Frankfurt, Germany (EU)).
• Stripe takes payments. We never see your card number.
• Resend sends our emails.
• Anthropic (Claude) reads tender documents you upload and drafts answers for you. Your documents are sent to it for that task only.
• Google Workspace holds our email inbox, so emails you send us are stored there.

Some of these companies are based in the United States. Where your data leaves the EU or UK, we rely on the safeguards each one offers (standard contractual clauses or the EU-US Data Privacy Framework).

Our web pages load nothing from other companies' servers: fonts and scripts come from our own site, so your browser doesn't contact Google or anyone else when you visit.

How long we keep it

• Account, profile and tool data: while your account is open. When you close your account and ask us to, we delete it, except records the law makes us keep (for example invoices, for tax).
• The weekly email: until you unsubscribe (then only the do-not-email note).
• Security records of login and reset attempts: 2 days.

Your rights

You can ask to see your data, correct it, delete it, take a copy, or object to how we use it; and you can withdraw consent (for example, unsubscribe) at any time. Email support@holdfastcontracts.com; we answer within one month. You can also complain to the Data Protection Commission in Ireland (dataprotection.ie), or the ICO in the UK (ico.org.uk).

Data you give us about other people

Some tools hold details about people other than you: staff named in your evidence or bid drafts, contacts at your buyers. For that data you are the controller and we process it only to run Holdfast for you: we don't use it for anything else, we keep it secure, we use only the processors listed above, and we delete it when you ask or close your account. Please only add what a bid needs.

Cookies

One essential cookie keeps you logged in and protects forms. No advertising or tracking cookies. More about cookies.