1. Scope and responsible operator
This policy covers www.esnadai.com and app.esnadai.com. “Esnad AI,” “we,” and “us” refer to the project currently operating under the Esnad AI name on a pre-incorporation basis. No incorporated legal name, company registration number or registered office is claimed. If a legal entity is formed, this policy will be updated to identify it.
Privacy contact: info@esnadai.com. We do not state that a Data Protection Officer, EU representative or UK representative has been appointed.
2. Our roles
We generally act as a controller for corporate enquiries, account administration, security, commercial contacts and our own operational records. When a customer organization uses BidIQ to process tenders, proposals, personnel, supplier or evaluator information on its instructions, the customer is generally the controller and Esnad AI is generally its processor or service provider. We may remain an independent controller for security, fraud prevention, legal compliance and service administration.
3. Information we process
- Corporate enquiries: sender details, organization, message content and attachments voluntarily sent through the visitor's email application.
- Accounts and organizations: name, corporate email, password hash, membership, role, permissions and account events.
- Customer content: tenders, proposals, company profiles, Resources & Capabilities, certificates, licenses, project references, criteria, evaluations and released or supplementary documents.
- Derived service records: extracted pages and requirements, citations, confidence and currentness, compliance, Bid Readiness, risks and gaps, recommendations, human decisions, document fingerprints and rule/model versions.
- Security and communications: session and authentication events, audit records, operational metadata, support messages and transactional email delivery.
The audited product does not contain billing or payment processing. The corporate site has no web form, newsletter, analytics, advertising pixel or marketing tracker.
4. Purposes and bases
We process information to provide and secure the service, administer accounts and organizations, answer enquiries, deliver service communications, support users, investigate reliability and security issues, comply with law, and establish or defend claims. Depending on the context and applicable law, the basis may include contract, steps before contract, legal obligation, legitimate or permitted business purposes, customer instructions, or consent where specifically required. We do not use consent as the default basis for ordinary B2B service delivery.
5. AI-assisted processing and human decisions
BidIQ uses AI to extract, classify, retrieve, match, explain and recommend. Deterministic rules control scoring, weighting, thresholds and overrides where defined. Authorized humans make final Bid/No-Bid/Hold and procurement-award decisions. AI output can be incomplete or incorrect; users should review material evidence, citations and currentness. BidIQ does not guarantee eligibility, compliance, tender award or business results. Unknown or missing information is not automatically negative evidence.
The audited implementation uses Microsoft-hosted Azure AI model services. Microsoft states that prompts and outputs are not made available to OpenAI or other customers and are not used to train generative foundation models without permission or instruction. Service processing, filtering and potential abuse monitoring can still occur. Account-specific configuration, retention and human-review settings remain under review. The audited product does not fine-tune models on customer content.
6. Providers, sharing and international processing
Verified providers include Microsoft Azure for hosting, PostgreSQL, private object storage and AI processing, and Fastmail for transactional and corporate email. We may share information with service providers, authorized customer users and administrators, or authorities where law requires. We do not sell personal information and detected no advertising or cross-site tracking.
Provider systems or personnel may process information outside the user's country. Current production resource locations have not been independently verified, so we do not claim Qatar-only or GCC-only storage or processing. This policy does not claim a specific international-transfer mechanism where it has not been verified.
7. Security
Verified measures include organization-level tenant scoping, server-side role checks, private document storage, HTTPS in production, hashed passwords and session tokens, secure HTTP-only authentication cookies, malware scanning, document hashes and audit/version records. No system can be guaranteed completely secure. Do not send confidential tender, proposal or personal documents in an initial email unless an approved secure channel has been arranged.
8. Retention and deletion
Information is retained only for justified service, security, contractual, audit and legal purposes. Exact periods for enquiries, accounts, customer documents, analysis, audit, logs, backups and terminated accounts are not yet approved. A request to delete an individual account does not automatically erase organization-owned tenders, proposals, evidence, evaluations, released artifacts or audit records. Requests to info@esnadai.com will be assessed under applicable law and customer instructions.
9. Your rights
Depending on applicable law and our role, individuals may have rights to request access, correction, deletion, restriction, objection, portability, withdrawal of consent, or to complain to a competent authority. Rights differ by jurisdiction and may be limited by other rights and obligations. We may verify identity and authority and, for customer-controlled data, coordinate with the relevant customer organization.
10. Cookies, children, changes and contact
The corporate site sets no application cookies. BidIQ uses one strictly necessary first-party authentication cookie with a maximum 12-hour lifetime and earlier revocation on sign-out or security events. See our Cookie Policy.
BidIQ is a B2B service and is not directed to children. TalentIQ remains concept development and is not part of the audited BidIQ service.
We will identify material policy changes with a version and last-updated date. Questions, rights requests and complaints may be sent to info@esnadai.com.