Data Retention Policy
Last updated: 8 August 2026
1. Our principle
We keep personal data only for as long as it is needed to run the service you signed up for, or for as long as Singapore law requires us to keep it. We do not sell personal data, and we do not retain it for advertising or profiling, we run no advertising trackers and no third-party analytics. Our visitor statistics come from analytics software we host ourselves, which sets no cookies and identifies nobody (see our Cookie Policy).
2. How long we keep each type of data
| Data | What it includes | Retention period |
|---|---|---|
| Account data | Email address, hashed password, company name, plan and subscription status, optional company profile. | For as long as your account is active. Deleted within 30 days of a verified deletion request. |
| Alert settings | Subscribed categories, keyword and agency filters, delivery channels, Telegram chat ID / WhatsApp number, webhook URL. | For as long as your account is active. Deleted together with your account. |
| Delivery logs | A record that a given tender was sent to you on a given channel. No message content is stored. | Kept for the life of the account, they are what stops you being alerted twice about the same tender. Deleted together with your account. |
| Billing records | Invoices, payment references and subscription history held by us and by our payment processors (Stripe, HitPay). Our own copy is a minimal record: email address, company, plan and the processor's payment reference. | Retained for at least 5 years after the transaction, as required by Singapore tax and accounting law. This survives account deletion, we are not permitted to erase it on request. Only created for accounts that actually made a payment. |
| Session token | The sign-in token stored in your own browser's local storage. | Expires 30 days after issue, or immediately when you sign out or change your password. |
| Tender data | Public GeBIZ tender and award records, including awarded supplier names and contract values. | Retained indefinitely, this is public government procurement information, not your personal data, and its historical value is the basis of Awards Intelligence. |
| Database backups | Encrypted-at-rest daily snapshots of the whole database, used for disaster recovery. | A rolling 14 days. Older snapshots are automatically deleted, so data you asked us to erase disappears from backups within 14 days of the live deletion. |
| Visit statistics | Anonymous page-view records from our self-hosted analytics: page, referrer, browser, device, language and approximate city. No IP address, no cookie, and no link to your account. | Retained indefinitely as aggregate traffic history. It is not personal data, there is no identifier in it that could be traced back to you, so there is nothing to delete on request. Opt out at any time (see Cookie Policy §3). |
| Server logs | Operational application logs used for troubleshooting. We do not store visitor IP addresses in our database. | Rotated daily and automatically deleted after 30 days. They are not used to build any profile of you. |
3. Cancelling versus deleting
These are two different things, and cancelling does not erase anything:
- Cancelling your subscription (from Account settings) ends billing and moves you to the Free plan at the end of the current period. Your account, settings and history remain, so you can resume later.
- Unsubscribing from alert emails (the link at the foot of every alert) stops the emails. It does not cancel a paid plan and does not delete your account.
- Deleting your account removes your personal data as described below.
4. How to delete your account
Deletion is self-service and immediate. Sign in, go to Account → Delete Account, confirm by typing your email address (and your password, unless you sign in with Google or Facebook), and your account is erased straight away, not queued for review. Any active subscription is cancelled first, so no further payment is taken. We send a confirmation email once it is done.
What "erased" covers: your account record, alert settings, delivery history, bid tracking and competitor lists are removed from the live database at that moment. Backup snapshots still containing your data age out within a further 14 days.
The one exception is billing records, as set out in the table above: if you have ever paid us, we keep your email address, plan and payment reference for 5 years because Singapore tax law requires it. We are not permitted to erase those on request. Accounts that never made a payment leave nothing behind at all.
If you would rather we handled it, or you can no longer sign in, email support@gebiz.ai from your registered address and we will verify and delete within 30 days.
5. Your rights under the PDPA
Under Singapore's Personal Data Protection Act, you may request access to the personal data we hold about you, ask us to correct it, or withdraw consent to its use. Most of this is self-service from your Account settings; for anything else, write to support@gebiz.ai and we will respond within 30 days. Withdrawing consent for us to process your alert settings means we can no longer deliver the service, and the account will be closed.
6. Changes to this policy
We may update this policy from time to time. Material changes will be notified by email or an in-app notice before they take effect.
7. Contact
Questions about retention or deletion: support@gebiz.ai
See also our Privacy Policy and Cookie Policy.