Privacy notice

Effective 2026-09-16.

This notice describes what Victano does with personal data. It is written from the system rather than from intention: every category below corresponds to something the service actually stores, and if we stop storing it we will change this notice rather than leave it here.

Who we are

The operator of victano.com is the controller of the personal data described here. You can reach us at [email protected] or [email protected]. When the registered legal entity is published, this notice will name it, its registration number and its address; the categories below do not change with the name.

What Victano is, in data-protection terms

Victano searches PUBLIC procurement notices published by contracting authorities across the EU. Those notices are public records; we do not treat them as your personal data and you do not need an account to be affected by them.

What we hold about YOU is the small amount needed to run an account, and capability information about your COMPANY that your assistant assembles so we can match it against those notices. We do not build profiles of individuals and we do not sell data.

What we collect, and why

Your account. An email address, an optional company name, and a note of where you came from. Used to create and authenticate the account. Lawful basis: performance of a contract, Art 6(1)(b).

Sign-in codes. A one-time code sent to your email address, held until it is used or expires. Lawful basis: Art 6(1)(b).

API keys. Stored as a SHA-256 hash. We never hold the key itself, so we cannot tell you what it is and cannot leak it. Lawful basis: Art 6(1)(b).

Sessions. A session identifier binding your AI assistant's connection to your account. Lawful basis: Art 6(1)(b).

Usage records. Which tools were called and when, so tier limits can be applied and so we can tell whether the product is used. Lawful basis: legitimate interest, Art 6(1)(f), in operating and improving a service you asked for.

Company capability profiles. What your company does, where, with what certifications. Assembled by your own assistant from information you give it. This is information about a COMPANY, but where you are a sole trader or a one-person company it may identify you, and we treat it as personal data in that case. Lawful basis: Art 6(1)(b).

Decisions and preferences. Bid and no-bid outcomes you asked us to remember, and working preferences such as language. Preferences hold no free text by design. Lawful basis: Art 6(1)(b).

Feedback. If you send feedback, we store what you wrote and which account sent it. This is free text you composed, and it is the most personal thing the service holds. Lawful basis: Art 6(1)(f), in knowing whether the product works.

Newsletter. If you subscribe, your email address, until you unsubscribe. Lawful basis: consent, Art 6(1)(a).

Website analytics. See the cookie policy. In short: a cookie-free counter that records no personal data runs by default, and Google Analytics runs only if you opt in.

What we do not do

We do not sell personal data, we do not use it to train models, we do not build advertising profiles, and we do not enrich it from third-party sources. Victano is a product about organisations and public records, and that boundary is deliberate.

How long we keep it

Account data lives as long as the account does. Sign-in codes expire within minutes. Deletion links expire after 24 hours. Usage records are kept while the account exists because they are what the tier limits are computed from.

Deleting everything

Ask your assistant to delete your account, or write to [email protected]. We send a confirmation link to your email address, because an instruction typed into a chat window is not proof that the account holder wants it gone. Confirming erases the account and every record attached to it, in one operation. There is no soft delete and no recovery.

We are telling you plainly that it is irreversible because it is.

Who else processes it

We use a small number of providers. Each is listed publicly, with what it does and where it runs, at https://victano.com/legal/subprocessors. That list is dated, so a change to it is visible rather than announced.

Some of those providers are outside the EEA. Where that is so, transfers rely on the European Commission's standard contractual clauses, and the sub-processor list says which.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form. Where we rely on consent you can withdraw it at any time without affecting what came before.

Write to [email protected]. We will answer within one month.

If you think we have handled your data wrongly you can complain to Valstybine duomenu apsaugos inspekcija (VDAI), L. Sapiegos g. 17, 10312 Vilnius, Lithuania, [email protected], or to the authority where you live.

Changes

If this notice changes materially we will say so on the changelog at https://victano.com/changelog with the date, rather than quietly replacing the page.