Effective date: 14 July 2026
Who controls your data
VJ Consulting is the controller for account data processed by this service. Contact email: [email protected].
Data, purposes and legal basis
Public procurement records come from public Latvian procurement sources. When you sign in, we receive your verified email address from Google and store it with your role, account creation and last-login times. We also record analyses you request, favorites you save, notifications generated when a saved procurement, buyer or supplier changes, and credit purchases including amount, currency, status and Stripe transaction references.
We process account and security data because it is necessary to provide the requested authenticated service and protect it (GDPR Article 6(1)(b) and 6(1)(f)). Optional email notifications are sent only when you enable them in your account and can be disabled at any time. We do not use account data for advertising, sell it, or make decisions producing legal or similarly significant effects.
Recipients and international transfers
Hosting and database infrastructure is provided by Railway. Google provides sign-in. Stripe processes checkout, payment and fraud-prevention data; EIS Monitor does not receive or store full card details. Resend processes the recipient address and notification email when optional email delivery is enabled. OpenAI may process procurement document content and, for Supplier assessments, the participation preferences saved in the account when AI quality analysis is requested; account email is not intentionally included in model input. These providers may process data outside the EEA under their applicable contractual transfer safeguards. Access is limited to authorised administrators and service providers that need it.
Retention
The signed session cookie expires after 7 days and the OAuth state cookie after 10 minutes. Account data, favorites and notifications remain while the account is active. Payment and credit records are retained as required for accounting, fraud prevention and legal obligations. On account deletion, favorites and notifications are deleted with the account, while email identifiers in retained operational, payment and credit records are replaced with a random anonymous identifier. Backups and provider logs are retained according to the documented operational schedule and provider agreements.
Your rights
You may request access, correction, erasure, restriction, portability or object to processing. Signed-in users can download their account data and delete their account from My account. For other requests, email the contact above. We respond without undue delay and normally within one month. You may complain to the Latvian Data State Inspectorate or another competent supervisory authority.
Cookies
We use only strictly necessary first-party cookies: eis_google_oauth_state protects the Google sign-in flow, and eis_admin_session keeps you signed in. Both are HttpOnly, SameSite=Lax and Secure on HTTPS. There are no advertising or analytics cookies, so no cookie-consent banner is shown. If optional cookies are added later, they must remain disabled until valid consent is obtained.
Security and changes
We use access controls, signed cookies, HTTPS in production, least-privilege administration, dependency scanning and monitoring. No internet service is risk-free. Material changes to this notice will be dated and highlighted here.