This privacy policy explains how Webzworld (“we”, “us”), the operator of Grovia Tender at groviatender.com and app.groviatender.com (the “Service”), handles personal data and business information. It is written to comply with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 (“DPDP Act”).
1. Who we are
Webzworld is the data fiduciary for personal data processed through the Service. Registered office: [to be added]. Contact for privacy matters: hello@groviatender.com.
2. What we collect
- Account data: name, work email, phone number, password (stored hashed), organisation name and role.
- Company data you provide: company profile (“Company DNA”), financial figures, certifications, project history, personnel details, and documents you upload to your vault (for example GST, Udyam, ISO certificates, work orders, financial statements).
- Tender and bid data: tender documents you upload or import, analyses, proposal drafts, pricing you enter, outcomes you record.
- Usage and technical data: log data, IP address, browser type, device information, pages visited, actions taken, and audit trails of sensitive actions.
- Enquiries: details you submit on our contact form (name, company, email, phone, message).
- Payment data: billing name, address, GSTIN and transaction references. Card and bank details are handled by our payment processor (Razorpay) and are not stored by us.
3. Why we process it
- To provide the Service: matching tenders to your company, checking eligibility, drafting proposals from your documents, assembling bid packages.
- To operate your account: authentication, team invitations, roles, notifications you enable (in-app and email).
- To bill you and issue GST-compliant invoices.
- To keep the Service secure: audit logs, abuse prevention, malware scanning of uploads.
- To improve the Service using aggregated, de-identified usage statistics.
- To respond to your enquiries and provide support.
- To comply with law and enforce our terms.
We process personal data on the basis of your consent given at sign-up, for the performance of our contract with you, and for legitimate uses recognised under the DPDP Act. You may withdraw consent at any time by closing your account; withdrawal does not affect processing already carried out.
4. AI processing
The Service uses third-party AI models to read documents, extract facts, assess eligibility and draft text. Only the content required for the task you request is sent, over encrypted connections, to providers bound by contractual terms that prohibit them from using your data to train their models. We do not use your documents, bids or outcomes to train AI models, and we never expose one customer’s data to another. Every AI call is logged and linked to its output so it can be audited.
5. Where data is stored
Data is stored on infrastructure operated by Webzworld and its hosting providers, with document storage in the Asia-Pacific (Mumbai) region. Data may be processed by AI and email providers outside India solely to deliver the Service, subject to the safeguards above and applicable law.
6. Sharing
We do not sell personal data. We share it only with: members of your own organisation according to their role; service providers who process it on our instructions (hosting, storage, AI models, email delivery, payments); and authorities where required by law. Tender documents you upload are never shared with other customers or with tender sources.
7. Security
Tenant isolation at the database level, encryption in transit and at rest, short-lived signed URLs for documents, role-based access, audit logging, rate limiting, malware scanning and optional multi-factor authentication. See our security page. No system is perfectly secure; if we become aware of a breach affecting your personal data, we will notify you and the Data Protection Board of India as required.
8. Retention
Account and organisation data is kept for as long as your account is active. After closure, we delete or anonymise it within 90 days, except where retention is required by law (for example tax records for invoices, retained for the statutory period) or to resolve disputes. Audit logs are retained for up to two years.
9. Your rights
Under the DPDP Act you may access a summary of your personal data, correct or update it, request erasure, nominate a person to exercise your rights, and raise a grievance. Most of this is available directly in Settings; for anything else write to hello@groviatender.com. We respond within 30 days. If you are not satisfied, you may approach the Data Protection Board of India.
10. Cookies and analytics
The marketing website sets no tracking cookies and loads no third-party scripts. The application uses strictly necessary cookies and local storage for sign-in and preferences. We do not use advertising trackers.
11. Children
The Service is intended for businesses and their staff. We do not knowingly collect data from anyone under 18.
12. Changes
We will post any changes to this policy on this page and, for material changes, notify account holders by email at least 15 days before they take effect.
13. Grievance officer
Name: [to be added]. Email: hello@groviatender.com. Address: [to be added]. Grievances are acknowledged within 48 hours and resolved within 30 days.