Privacy Policy

The Decision Room helps suppliers prepare bids for sport-sector tenders and helps sports organisations run better procurement. For the personal data described here, The Decision Room is the controller. Our registered company details will be published here before we take payments.

Contact us about anything in this policy at hello@tdr.team.

• Your account: your email address, your name, and the workspace you belong to with your role.
• Your workspace's content: tenders, the buyer's brief and the evaluation criteria, bid documents you upload, assessments and reports, and the outcomes you record.
• Assessments without an account: your brief, proposal, confirmed criteria and report; your email address when you ask for an invitation; and a hashed browser identifier and network address to limit abuse. We also keep an anonymous record of each attempt, and, only if you tick the optional box when uploading, your documents, criteria, report and email address (see section 7).
• Security records: sign-in events, and a log of every time our staff view a workspace's content (see section 6).
• Messages you send us through our forms or by email.
• Usage statistics for our public pages: the page visited, the referring site, country, browser and device type, page loading speed, and steps such as starting a free assessment. Vercel Web Analytics and Speed Insights collect these without cookies or a profile that follows you across sites. Addresses are stripped of identifiers before they are sent, and signed-in pages are not measured.

We do not use advertising or tracking cookies, and we do not sell personal data.

• To provide the service you or your organisation asked for: reading briefs, assessing bids and producing reports (contract).
• To keep the service secure, prevent abuse and investigate problems (legitimate interests).
• To understand how our public pages are used and keep them fast, through anonymous usage statistics (legitimate interests).
• To improve the assessment method, only where your organisation has chosen to take part (consent, see section 5).
• To answer your messages and meet legal obligations.

We use a small number of service providers, each under a data processing agreement:

• Supabase: database, file storage and sign-in, hosted in London.
• Vercel: hosting of the website and application, running in London, and the anonymous usage statistics described in section 2.
• Anthropic: the Claude models that read briefs and assess bids. Documents are sent for processing and are not used to train their models. Processing may take place in the United States.
• TypeSafe, through Vercel's AI Gateway: a classification model that checks excerpts of files uploaded for assessments without an account are a buyer's brief and a supplier's proposal. Excerpts are not used to train its models. Processing may take place outside the United Kingdom.
• Resend: sending sign-in codes and invitations, from the European Union.
• Cloudflare: our domain, checks that protect sign-in and public assessments from automated abuse, and forwarding of email sent to our addresses.

Where personal data leaves the UK or the European Economic Area, we rely on the safeguards the law provides, such as the UK International Data Transfer Addendum and the EU Standard Contractual Clauses.

An organisation's owners and admins can choose to let its recorded outcomes and our scores help calibrate the method. Only outcomes and scores are used, never documents or their text, and nothing is shared outside The Decision Room. The choice can be withdrawn at any time in the Team page, and every change is recorded.

Assessments made without an account are not used to calibrate the method unless you tick the optional box when uploading. If you do, our team may review your documents, criteria and report to improve our assessments. Leaving it unticked changes nothing about your assessment. Requesting your report does not subscribe you to marketing emails.

A small number of our staff can view workspace content to provide support. They can only read, never change it, must sign in with two-factor authentication, and every view is logged. Staff who advise a buying organisation cannot see tenders from that buyer.

The same applies to assessments made without an account that you agreed we may keep: staff can open them only with two-factor authentication, every view and download is logged, and they are hidden from staff who advise the buyer named in the brief.

Assessments made without an account expire after 24 hours unless you ask us to email you an invitation. Requesting an invitation holds the assessment for seven days from that request, so you can sign in with that address and add it to your workspace. At expiry, access ends and the assessment, email address and uploaded files are removed by our daily cleanup, with failed file deletions retried. The invitation is a sign-in email and contains no link to the report itself. Assessments emailed before this change keep their private link until they expire, and anyone you forwarded that email to can open the report until then.

If you tick the optional box when uploading, we keep your documents, the criteria, your report and your email address after that expiry, without time limit, so our team can review them. You can withdraw that consent and ask us to delete them at any time by writing to hello@tdr.team; we then erase them, and their files are removed by our next daily cleanup.

We keep, without time limit, an anonymous record of each assessment made without an account so we can see how the service is used: when it started, the contract type, how many files were uploaded, how far it got, any reason it stopped, the result of our document check and the headline score. On its own it contains no documents, file names, criteria, email address or browser and network identifiers.

We keep your workspace's content while your organisation uses the service. When an organisation or a document is deleted, access is removed straight away. We attempt to delete its stored files immediately and retry unsuccessful deletions daily. Uploads that were never saved to a workspace are eligible for cleanup after 24 hours. Deleting a bid document also deletes assessments and reports for that bid version. Deleting a workspace does not delete your sign-in account; contact us to request account deletion. Copies in provider backups may remain until those backups expire and are not available through the application. We keep security logs for as long as needed to protect the service, and messages for as long as needed to answer them.

We use only the cookies the service needs: to keep you signed in, remember your workspace, protect access to an assessment in the browser that uploaded it, and, for assessments emailed before this change, open a report from its emailed link. Assessment cookies last at most seven days. Our usage statistics set no cookies.

You can ask us for a copy of your personal data, to correct or delete it, to restrict or object to how we use it, or to move it to another provider. Write to hello@tdr.team. You can also complain to the Information Commissioner's Office (ico.org.uk) or your local data protection authority.