Privacy Policy
Last updated: 2026-11-15
This policy explains what personal data we collect, why, how long we keep it, and what rights you have.
Data controller: Afora.cy, Limassol, Cyprus. Data-protection contact: [email protected].
What we don't do¶
We do not sell or rent data to anyone, and we make no automated decisions that have legal effects for you. We use statistics and ad-measurement cookies only if you accept them; without them we measure how the site is used only anonymously (see "Cookies").
Data we collect¶
- Account: your email address and a cryptographic hash of your password (never the password itself), plus creation and last-sign-in timestamps.
- Sign-in with Google: if you choose it, the provider sends us an account identifier, your email address and, if you share it, your name (Google also your profile picture). We use only the email; the rest stays in the authentication system and is shown nowhere. We never receive your password for that provider.
- Settings: language, plan (and when a free offer or trial ends), alert delivery channel, newsletter opt-in.
- Things you create: saved searches and alerts, organisations you follow, bookmarks, the deadline reminders you ask for, the areas you follow for power cuts, and the stage and private notes of the tenders (Business) and vacancies (Pro and Business) you track.
- For You profile: your questionnaire answers, only if you ask for profile alerts and expressly agree to them being saved.
- Ask Afora: how many questions you asked each day. Not the questions or the answers themselves.
- Invite a friend: which account invited which and what reward was given, to apply the terms. The inviter sees only how many joined, never who. It is deleted with either account.
- Browser notifications: the push subscription endpoint and its encryption keys, only if you turn them on.
- Contact messages: the name and email you choose to give, your message, your browser's user agent, and a salted hash of your IP address, never the address itself.
- Item reports: which entry you reported, the reason, and your comments.
- Newsletter without an account: your email address and a salted hash of your IP address.
- Notice page views (no cookies): when you open a notice page we count the view along with the type of device, browser, operating system, the site you came from and the campaign (UTM) tags in the link, only as totals per day. To count unique visitors we keep, for that day, a code made from your IP address and browser with a random key that changes every day; the code and the key are deleted when the day is over, so your visits on different days are not linked. The IP address itself is not stored.
Why we process it, and on what legal basis¶
| Purpose | Legal basis |
|---|---|
| Running your account and sending the alerts you asked for | Performance of a contract — Art. 6(1)(b) |
| Answering your Ask Afora questions | Performance of a contract — Art. 6(1)(b) |
| A saved For You profile (it may include health or income details) | Explicit consent — Art. 6(1)(a) and Art. 9(2)(a) |
| Weekly newsletter | Consent — Art. 6(1)(a), with double opt-in |
| Browser push notifications | Consent — Art. 6(1)(a) |
| Answering messages and reports | Legitimate interests — Art. 6(1)(f) |
| Preventing abuse and spam submissions (hashed IP) | Legitimate interests — Art. 6(1)(f) |
| Keeping the service secure and available | Legitimate interests — Art. 6(1)(f) |
| Anonymous usage statistics without cookies, to improve the site | Legitimate interests — Art. 6(1)(f) |
| Statistics with cookies, visit recordings and ad measurement (Meta), if you accept them | Consent — Art. 6(1)(a) |
Where we rely on consent you can withdraw it at any time from your account page, the unsubscribe link in any email or, for cookies, "Cookie settings" at the bottom of every page. Withdrawal does not affect the lawfulness of processing before it.
Where the data lives, and who processes it¶
- OVHcloud (OVH SAS, France) — our server, which runs the application, the database and account sign-in. It is in a data centre in France (Gravelines), inside the EU.
- Cloudflare — every visit to afora.cy passes through Cloudflare's network on its way to our server, to protect the site and keep it fast. Cloudflare therefore handles your IP address, browser details and the pages you request, including what you send in forms. Cloudflare is a US company and may process this data outside the EU, including in the United States, under the EU-US Data Privacy Framework and the Standard Contractual Clauses.
- Cloudflare R2 — encrypted backups of the database, stored in the EU. Only we hold the key that reads them. Each backup is deleted after 8 weeks at the latest, so anything you delete stays in older backups until then.
- Amazon Web Services (Amazon SES) — email delivery (alerts, newsletter, password resets), sent from Frankfurt (eu-central-1), inside the EU. Receives your email address and the message content.
- PostHog (EU-hosted) — usage statistics: which pages are viewed and which buttons are pressed. The data passes through our own server without your IP address. Without your consent it is anonymous and nothing is stored on your device. If you accept cookies, it recognises your next visit, records the visit (clicks and scrolling, with every form field hidden) and, if you are signed in, links it to an internal account code and your subscription, never your email. The For you, account and sign-in pages are never recorded. From them we send only the fact that a sign-up or a plan purchase happened (for a purchase, the plan and price), never what you type or view there.
- Meta Platforms Ireland (Facebook, Instagram) — measures our ads, only if you accept cookies. It receives which pages you visited and whether you signed up, saved an alert, joined the newsletter or bought a subscription (with its price), along with your IP address and browser details. We send it no email, phone number or form answers. Meta may transfer data to the US under the EU-US Data Privacy Framework, and is joint controller with us for this measurement.
- Stripe — payments, only if you subscribe to a paid plan. Stripe receives your card details directly; we keep only a customer reference and your plan.
- Browser push services (Google, Mozilla, Apple) — deliver push notifications, if you have enabled them.
- Cloudflare Turnstile — a bot check on the sign-in and sign-up form. It looks at browser signals to tell people from automated sign-ups; it is not used for advertising or tracking.
- Google — confirms who you are, only if you choose "Continue with Google". Your account with it is governed by its own privacy policy.
Some of these providers may process data outside the EEA. Where they do, the transfer is covered by the European Commission's Standard Contractual Clauses.
We use OpenAI's AI language model (ChatGPT) to categorise and summarise the public notices in the catalogue. Only the public text of those notices is sent to it, never your account data, your saved searches or your messages, except what you type yourself into Ask Afora, the tender alert helper or the job and funding finders (below).
Ask Afora (the AI assistant, for signed-in users): what you type, with the last few messages of the same chat and the relevant public notices, is sent to OpenAI to produce the answer, without your name or email. Afora does not store the conversations: they stay in your browser tab and are gone when you close it. We keep only how many questions you asked (for your plan's limits) and anonymous statistics with no text. Don't type personal details such as health, income or ID numbers.
Job finder and funding finder: your answers (for example your field, education and district, or your business's size, sector and needs) are sent to OpenAI to rank the open notices, without your name or email. They are not stored by Afora.
Tender alert helper (Business): the description of your business that you type is sent to OpenAI to suggest CPV codes and search words, without your name or email. It is not stored by Afora. Don't include personal details.
For You uses standard matching by default without sending your questionnaire answers to an AI provider. If you explicitly enable AI suggestions, your answers and public notices are sent to the provider named in the form to suggest ordering and reasons. Afora does not cache AI results by your answers; the provider's own retention policy applies. Your answers are saved only if you separately request profile alerts and consent to saving them, because they can include health or income details; you can delete that saved profile from your account.
Cookies¶
Necessary, always on: the session cookies that keep you signed in, and the afora_consent cookie that remembers your cookie choice (180 days).
Preferences you set, always on: cookies for the site language (1 year), your theme (light or dark), text size, contrast and whether your dashboard shows bookmarks, plus small notes in your browser's local storage (which messages you closed, which notices you picked to compare, your Ask Afora chat until you close the tab). They are sent nowhere and are not used for tracking.
Only with your consent: PostHog's ph_* cookies for statistics and visit recordings (up to 1 year) and Meta's _fbp cookie to measure our ads (90 days). We ask with the banner on your first visit; Reject is as easy as Accept.
If you reject or don't answer, the statistics (PostHog) keep their identifier in the page's memory only: they write no cookie and no local storage, and it is gone as soon as you close or reload the page. Change your choice at any time from "Cookie settings" at the bottom of every page; withdrawing deletes those cookies.
Any sponsor slots shown on the site count clicks in aggregate only. They set no cookies and record nothing about who clicked.
How long we keep it¶
| Data | Retention |
|---|---|
| Your account and everything attached to it | Until you delete your account |
| Contact messages that have been dealt with | 1 year |
| Any contact message, at the latest | 2 years |
| Item reports that have been closed | 1 year |
| An address that unsubscribed from the newsletter | 30 days |
| A newsletter signup that was never confirmed | 7 days |
| An idle push subscription | 180 days |
| Alert delivery log (email / push) | 90 days |
| Which deadline reminders were sent to you | 120 days |
| Which power-cut notifications were sent to you | 90 days |
| Pending notification content | Until delivery completes or is reconciled; deleted 90 days after completion |
| Account erasure request state | Until account erasure completes |
| Private saved-reference history for undoing duplicate merges | 7 days |
| Administrator action log | 2 years |
| Technical error log (no personal data) | 90 days |
| Anonymous search log (search text and result count only) | 180 days |
| Daily code for counting unique visitors | Until the end of the same day |
| How many questions you asked Ask Afora (a count per day only) | 90 days |
| Anonymous AI assistant statistics (no text, no user) | 180 days |
| An email address that cannot receive mail or reported a message as spam (kept only as a hash, not the address itself) | 2 years |
| Usage statistics (PostHog) | 1 year |
| Visit recordings (only with your consent) | 30 days |
Deletion runs automatically as part of a daily scheduled job.
Your rights¶
- Access and portability: download everything we hold about you as JSON from your account page.
- Erasure: permanently delete your account and all associated data from your account page.
- Rectification: change your settings at any time, or contact us about anything you cannot edit yourself.
- Restriction and objection: contact us if you want us to restrict or stop processing that relies on legitimate interests.
- Withdraw consent: turn the newsletter or push notifications off, delete your saved For You profile, or change your cookie choice, whenever you like.
We respond within one month. If you believe we have handled your data badly, you can complain to the Office of the Commissioner for Personal Data Protection, Cyprus — dataprotection.gov.cy.
The catalogue of public notices¶
The catalogue is made up of documents already published by public bodies. It is not personal data about you and is not included in your account export.
Some notices may mention names, usually of public officials acting in their official capacity. We add nothing that is not already in the source and we build no profiles of individuals. If you appear in an entry and want it removed, use the report link on that entry's page or contact us.
Summaries and translations are AI-generated and unofficial. For any legal deadline, the original source text governs, and we always link to it.
Changes¶
If we materially change how we process your data we will update this page and the date at the top, and notify registered users by email.