Centures / Legal
Privacy policy
Last updated 4 November 2026
This policy explains what personal data Centures handles, why, and what you can ask of us. It covers the website at centures.io, the Centures application, its API and MCP server, and the public procurement records the service is built on.
1. Who is responsible
The controller of your personal data is Centures. Write to lukas@centures.io with any question or request about your data.
2. What we handle and why
Early-access requests
When you ask for early access we store your work email and, if you give them, your company, industry and country. We use them to answer your request, set up your company and tell you about Centures. Legal basis: steps you asked for before a contract, and our legitimate interest in reaching companies that asked to hear from us (Article 6(1)(b) and (f) GDPR).
Your account
To sign in you give your name and email address. We send a one-time code by email instead of using passwords; the code expires after five minutes. Each session records the IP address and browser it was started from, to keep accounts secure. Legal basis: performing our contract with you or your company (Article 6(1)(b)) and security (Article 6(1)(f)).
What your workspace contains
Everything your team enters is kept for your workspace: the company profile (such as company ID, turnover, staff numbers, insurance, certifications, regions and a description of what you do), tenders you follow, pipeline stages, offers and notes, saved searches, watchlists and your feedback on matches. We use it to provide the service. Your feedback on matches also helps us improve how tenders are ranked. The company description is turned into a numerical representation (an embedding) so similar tenders can be found. Legal basis: contract (Article 6(1)(b)) and, for improving the ranking, our legitimate interest (Article 6(1)(f)).
API and MCP keys
For each key we count requests and errors per hour, to apply limits and show you your usage.
Technical logs
Our hosting provider records technical data about requests, such as IP address, time and the address requested. We use these logs to keep the service running and secure, and they are kept for a short period (currently up to seven days). Legal basis: legitimate interest (Article 6(1)(f)).
Public procurement records
Centures reads public procurement and company records: the Czech national bulletin (Věstník veřejných zakázek), NEN, ISVZ open data, buyer profiles, TED, the contract register (smlouvy.gov.cz), ARES and the trade licence register, and SÚKL. These records can name natural persons, for example sole traders who bid for or win contracts, contact persons in notices and people who sign contracts. We process them to make public spending searchable and comparable, which is our legitimate interest and the purpose for which the records are published (Article 6(1)(f)). We do not use them to contact those people for marketing. If you appear in these records you have the rights described below, including the right to object.
3. Cookies and similar storage
The website sets no cookies and has no analytics or advertising trackers. The application uses one strictly necessary cookie to keep you signed in (for up to 30 days) and remembers your light or dark theme in your browser's storage. Neither is used for tracking.
4. Who processes data for us
- Cloudflare: hosting of the website, application and API, file storage in the EU, request logs, the embeddings described above, and access control for our internal tools.
- Microsoft Azure: our database and supporting services, hosted in the EU.
- Resend: delivery of sign-in codes and invitations by email.
Each acts on our instructions under a data processing agreement. We do not sell personal data and do not share it with advertisers.
5. Where data is kept
Our database and stored files are in the European Union. Cloudflare serves requests from the data centre nearest to you, and Resend is based in the United States. Where data leaves the European Economic Area, the transfer relies on the European Commission's standard contractual clauses or the EU–US Data Privacy Framework.
6. How long we keep it
- Sign-in codes: five minutes.
- Sessions: 30 days from the last renewal, or until you sign out.
- Technical logs: currently up to seven days.
- Account and workspace data: while your account or your company's workspace is active, then deleted within 30 days of closure unless the law requires us to keep something longer.
- Early-access requests: while early access runs, or until you ask us to remove them.
- Public records: as part of our copy of the public record, updated when the source changes.
7. Your rights
You can ask to see the personal data we hold about you, to correct it, to delete it, to restrict how we use it, to receive it in a portable format and to object to processing based on our legitimate interest. Write to lukas@centures.io; we answer within one month. You can also complain to the Czech data protection authority, Úřad pro ochranu osobních údajů (uoou.gov.cz), or the authority where you live.
8. Security
We take the security of your data seriously. We protect personal data with appropriate technical and organisational measures and review them as the service grows.
9. Who the service is for
Centures is a service for businesses. It is not intended for children and we do not knowingly collect their data.
10. Changes
We update this policy when what we do changes. The date at the top shows the latest version, and we tell account holders about material changes by email.