This notice explains what happens to personal information when you use RFP Head Start, Arpero's online tool for writing your organisation's own request for information and request for proposal, or ask for an invitation to it.
In short
- What you type into the tool, and any suppliers' answers you load into it, stay in your browser and in the run file you save. Arpero does not receive them or store them.
- Arpero keeps only what it needs to give you access: your name, work e-mail address, organisation and account. If you ask for an invitation, we hold your name, work e-mail address and organisation to answer it, and remove them one month after we have said no, or three months after you sent it if we have not answered it.
- If you ask for a draft long list, a short profile of your organisation with no name and no personal information goes through our server to Anthropic, which writes the draft. Anthropic may not train its models on it.
- You can ask us at any time to show you, correct or delete what we hold about you. You can also complain to the Information Commissioner's Office.
1. Who we are
The tool is provided by Arpero Ltd, a company registered in England and Wales under number 09773011, with its registered office at 26 York Street, Harborne, Birmingham, B17 0HG ("Arpero", "we", "us").
We decide why and how your information is used, so we are its controller under UK data protection law: the UK General Data Protection Regulation and the Data Protection Act 2018.
To ask about your information, to use any of your rights, or to complain to us, e-mail info@arpero.co.uk or write to us at the address above.
2. What we hold, and what we do not
What we hold:
- Your request for an invitation, if you send one: your name, your work e-mail address, your organisation and when you sent it.
- Your account: your name, work e-mail address, organisation, and the parts of the tool switched on for it.
- Our own records: when your account was set up, when you signed in, and when you asked for a draft long list.
- Technical information: your internet (IP) address and details of your browser, which our suppliers handle to deliver the pages, run the sign-in and protect the tool from attacks.
What we do not receive: what you type into the tool, including the names and e-mail addresses of your contacts, your answers, requirements, supplier names and documents, and the suppliers' answers you load into it, with any names or details of their people they contain. They stay in your browser on this computer and in the run file you save, which you keep. We cannot see them.
3. Your browser and your run file
The tool keeps your work in your browser's storage on this computer, so that it is there when you come back, and lets you save it as a run file. This storage is needed for the tool to work and is not used for anything else. It stays until you use "Finish and clear this computer" or clear your browser. The tool uses no advertising or analytics cookies.
If you use a shared computer, use "Finish and clear this computer" when you are done.
4. What we use your information for, and why we may
We use it to:
- answer your request for an invitation, and invite you if we say yes;
- set up your account, and send you the codes to sign in;
- give you the parts of the tool your organisation has;
- run the draft long list when you ask for it;
- keep the tool secure, and improve it.
Our legal basis is our legitimate interests, and your organisation's: ours in providing the tool to your organisation, and your organisation's in using it (UK General Data Protection Regulation, article 6(1)(f)). You can object at any time (section 8).
We do not use your information for marketing, and we do not add you to a mailing list.
5. The draft long list
When you ask for a draft long list, the tool sends a short profile of your organisation through our server to Anthropic, an artificial intelligence company, which writes the draft: what you are choosing, your sector, countries, revenue and staff bands, number of legal entities, the processes in scope, your current systems by type, the areas of your Must requirements, and the names of any parties you asked to leave out. It never sends your organisation's name, your name, your contacts, what you write in your own words, or any document. Our server passes the profile on and keeps nothing of it. It records only that your account asked for a draft, and when, so that it can limit how many drafts are asked for in an hour.
Under Anthropic's terms with us, it may not train its models on what we send, and it processes it only for us. It deletes it within 30 days, unless the law requires it to keep it longer.
6. Who sees your information
- Arpero: only the few Arpero people who run the tool can see the accounts. Only the Arpero people who decide on invitations see your request for an invitation.
- Our suppliers, who may use your information only on our instructions: - Cloudflare, which hosts the tool, runs the server that passes the profile for the draft long list to Anthropic, and protects the tool from attacks; - Supabase, which runs the log-in and holds your account, your organisation and the parts of the tool switched on for it; - Mailjet, part of the Sinch group, which sends the codes to sign in, our e-mails about your invitation, and your request for an invitation to us; - Microsoft, whose Microsoft 365 service holds Arpero's e-mail, where your request for an invitation and our reply arrive; - Anthropic, which writes the draft long list (section 5) and receives no personal information.
- Sinch on its own account: Sinch also uses the e-mail addresses it sends to, for its own purposes, to stop spam and fraud, keep its network secure and meet its legal duties. For that use Sinch is responsible itself; see its privacy policy at mailjet.com/legal/privacy-policy.
- Nobody else, unless the law requires it.
7. Where your information is kept, and for how long
Your account, your log-ins and the record of when you asked for a draft long list are kept by Supabase on servers in Frankfurt, Germany. Mailjet keeps its sending records on servers in the European Union (Germany and Belgium). Your request for an invitation and our reply are kept in Arpero's Microsoft 365 e-mail, open only to Arpero's own people.
Cloudflare, Supabase, Sinch, Microsoft and Anthropic work worldwide and may handle information outside the UK and the European Union, including in the United States, for example when their support staff help us. Anthropic is based in the United States. Where they do, they are bound by the safeguards UK data protection law requires for such transfers, set out in their data protection terms with us. You can ask us for details.
A request for an invitation, and our reply: we delete them from our mailbox one month after we have replied, whether we said yes or no. A request we have not answered: three months after you sent it. A request we say yes to becomes your account.
We keep your account until your organisation's use of the tool ends, and then delete it within 90 days. If you ask us to delete it sooner, we do so within one month. Supabase's daily backups keep a copy for seven days more.
Mailjet keeps a record of each e-mail it sends for us: the address it went to, when it was sent, and its subject line. It keeps each record for 90 days after the e-mail was sent. We remove your address from Mailjet's list of contacts when your account is removed. Your run files and documents are yours and are not affected.
8. Your rights
You have the right to:
- ask for a copy of the information we hold about you;
- have it corrected if it is wrong;
- have it deleted;
- ask us to restrict how we use it;
- object to our using it.
Some of these rights apply only in certain circumstances. To use any of them, write to us (section 1). It is free. We answer within one month, or tell you within that month if we need longer, as the law allows for complex requests. We may ask you to confirm who you are.
Because we never receive what you type into the tool, we cannot show, correct or delete it: it is in your browser and your run file, under your control.
If you are unhappy with how we have handled your information, you can complain to us first (section 1). We will acknowledge your complaint within 30 days, look into it, and tell you the outcome. You also have the right to complain to the Information Commissioner's Office, the UK regulator: ico.org.uk, or 0303 123 1113.
9. Arpero's other privacy policy
Arpero's privacy policy at arperocompany.com covers Arpero's company website and its other work. For this tool, this notice applies. Where the two differ, this notice applies.
10. Changes to this notice
The version and date are below. If we change what we do with information you have already given us, we will tell you before the change applies to it.