Oppora
Privacy policy
Version 2026-10-03 · Effective from 2026-10-03 · Last updated 2026-10-03
1. Who is responsible
The controller of the personal data described in this policy is Soufian El Hajouji El Hayadi, trading as Oppora. Privacy contact: contact@oppora.eu.
2. In short
We use your data to run your account and the service you asked for: signing you in, matching opportunities to your company profile, sending the alert emails you set up, and answering you when you write to us.
We do not sell personal data, we do not show advertising, and we do not use analytics or tracking tools. Oppora's Score ranks opportunities for you; it does not make decisions about you.
3. What data we process, why, and on what legal basis
We assign a specific legal basis to each activity rather than relying on one basis for everything. “Contract” means it is necessary to provide the service you signed up for (Article 6(1)(b) GDPR).
| Activity | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Account and sign-in | Email address, user ID, password (kept only as a cryptographic hash by our authentication provider), session records including IP address and browser/device information, account creation and last sign-in times | Create and secure your account, keep you signed in, send confirmation and password-reset emails, block disposable email domains at sign-up | Contract; legitimate interest in keeping the service secure | While the account exists |
| Company profile and preferences | Company name, countries, sectors, plan; optionally website, description, products and services, employee and revenue ranges, keywords, CPV codes, contract-value range and currency | Filter opportunities and compute the Score for your company | Contract | While the account exists |
| Saved opportunities, searches and Score | Opportunities you save, Score results, temporary search snapshots | Provide the saved list, Best Match and fast navigation | Contract | While the account exists; search snapshots are temporary and removed automatically |
| Alerts | Alert criteria, notification email addresses you enter, matches, delivery records (recipient, status, provider message ID) | Match new opportunities to your criteria and email you a digest | Contract (you ask for the alert) | While the alert or account exists |
| Alert recipients (people added to an alert) | Email address supplied by the Oppora user who set up the alert; delivery records (status, provider message ID); whether the address has opted out of that alert | Deliver the alert emails that user asked for, and honour the recipient's opt-out | Legitimate interest in delivering the alert the account holder requested (the recipient is not a party to the Terms) | While the address is configured on the alert; the opt-out record is kept while the alert exists so that it is respected |
| Communication preferences | Your choices for alert emails, product updates and marketing; interface language; history of changes (category, on/off, source, notice version, time) | Respect your choices and keep proof of them | Consent for product updates and marketing; contract for alert emails and language; legitimate interest in keeping proof of your choices | While the account exists |
| Reviews | Rating, title, comment, language, company name (not published), your permission to publish, moderation status | Collect, moderate and, with your permission, publish reviews anonymously | Consent (your permission to publish) | Until you ask for removal or the account is deleted |
| Contact form and privacy requests | Name (optional), email, company (optional), subject, message | Answer your enquiry or request | Pre-contract measures, contract or legitimate interest, depending on the enquiry (see §6) | In our mailbox as long as needed to handle it; no automatic deletion |
| Billing (when paid plans open) | Stripe customer and subscription identifiers, subscription status, plan; payment data is handled by Stripe | Manage subscriptions and entitlement to paid features | Contract; legal obligations | Identifiers while the account exists; Stripe's own records as the law requires |
| Security and abuse prevention | IP address, request data in hosting and authentication logs, in-memory rate-limit counters | Protect the service and public forms from abuse | Legitimate interest | Rate-limit counters are not stored; logs follow each provider's retention |
| Administration and support | Account, profile, plan, preference and activity data visible to authorised administrators; an audit log of administrative actions | Support you, keep the service secure, moderate reviews, operate email delivery, show accountability | Contract; legitimate interest | Audit entries are kept and refer to accounts only by internal ID |
| Public procurement contacts (see §7) | Buyer contact email and phone, and a name where the source notice publishes one | Reproduce the official notice | Legitimate interest | While the related opportunity is shown |
Where we rely on legitimate interest we have weighed it against your rights: the data involved is limited, the use is expected by people who use the service or write to us, and you can object (see §11).
4. Where your data comes from
Most data comes from you, when you register, complete your profile, create alerts, write reviews or contact us. Some is generated by using the service (Score results, saved items, delivery records) or by your browser and network when you connect (IP address, browser information). Buyer contact points come from public procurement notices (see §7).
5. Emails and communication preferences
We distinguish four kinds of email:
- Essential account emails (confirm sign-up, reset password, security and billing notices). They are necessary for your account and cannot be turned off.
- Alert emails. We send them only if you have alerts and alert emails are on. Each one has an unsubscribe link, and you can also change this in Settings.
- Product updates. Off by default; sent only if you opt in.
- Marketing. Off by default; the sign-up checkbox is unticked; sent only if you opt in.
You can withdraw an opt-in at any time in Settings or with the link in the email; withdrawing one category does not affect the others. At the date of this version Oppora does not send product-update or marketing emails; if that changes we will send them only to people who opted in.
If you add email addresses other than your own as alert recipients, you must have the right to do so. We receive those addresses from you and use them only to deliver that alert. Every alert email tells the recipient why they receive it, links to this policy and includes a link to stop emails from that alert at that address; opting out affects only that alert and that address, not your account or your other alerts. Anyone who receives an alert can also write to us at contact@oppora.eu.
6. The Contact form
The form sends your name, email, company, subject and message by API call to Resend, which delivers them to our mailbox; none of this is written to a database. Your IP address is checked in memory against a rate limit (5 submissions per 10 minutes) and is not stored by Oppora. If email delivery is not configured, the message is not sent and you are shown an error.
Next to the form we show a short privacy notice — who is responsible, why we use your details and how to exercise your rights — with a link to this policy. You do not have to tick anything to send a message; the legal basis for handling it depends on what you ask.
The substance of what you write falls into different categories:
- A commercial enquiry before you have an account or contract (for example about plans or features): measures taken at your request before entering into a contract.
- Support about an existing account or plan: necessary to perform that contract.
- Any other enquiry (for example press or partnerships): our legitimate interest in answering messages sent to us, which we consider proportionate and expected by anyone who writes to a support address.
7. Personal data in public procurement notices
Oppora ingests notices that public bodies have already published under EU and UK procurement law. Every contact record we store from these notices is a buyer-side contact point (a contracting authority, never a bidder or economic operator) — we checked this directly against our database.
Most of these records are organisational: an email address and usually a phone number for a department or office, with no named person. A minority include a name published in the source notice; we show it exactly as published and do not enrich, cross-reference or reuse it beyond reproducing the official notice.
That the data was already published by a public body does not take it outside the GDPR. It is kept for as long as the related opportunity is shown. Because it comes from a public source and arrives through automated, large-scale ingestion, informing each person individually may involve disproportionate effort; if you are such a person, contact us and we will deal with your request.
8. Who receives your data
These providers process data on our behalf (processors) or receive it to provide their own service. We rely on each provider's published terms and have not audited them independently:
- Supabase — database, authentication and scheduled background jobs. Our project is hosted in the European Union (Ireland).
- Vercel — application hosting and delivery. Our application servers run in the United States (US East), and pages are delivered through Vercel's global network, which processes request data such as IP addresses.
- Resend — sending of emails: account emails, alert digests and delivery of Contact-form messages. Resend is based in the United States.
- Google (Google Workspace) — handles incoming mail for contact@oppora.eu, the mailbox that receives Contact-form messages and privacy requests.
- Stripe — payments, when paid plans open. Stripe handles the payment, tax and fraud-prevention data it processes under its own privacy notices, which apply to that data. Oppora never receives or stores card numbers.
We do not sell personal data or share it with advertisers. We may disclose data to public authorities when the law requires it.
9. International transfers
Our database is in the European Union, but some processing happens outside the EEA, mainly in the United States. According to their published documents: Vercel is certified under the EU-U.S. Data Privacy Framework and also relies on Standard Contractual Clauses; Resend's Data Processing Addendum covers both the EU-U.S. Data Privacy Framework and Standard Contractual Clauses (Module Two, controller to processor); Supabase relies on Standard Contractual Clauses approved by the European Commission or the UK ICO for transfers to the United States or Singapore; Stripe describes Standard Contractual Clauses and the EU-U.S. Data Privacy Framework in its legal centre. Google's data processing terms for Google Workspace, which hosts the mailbox, rely on Standard Contractual Clauses.
You can ask us at contact@oppora.eu how to obtain information about these safeguards.
10. How long we keep data, and closing your account
We do not run an automatic purge of inactive accounts, so the main rule is: we keep your data while your account exists and delete it when you ask us to close it. Specifically:
- Account, profile, preferences, saved items, Score results, alerts and their delivery records, and reviews: kept while the account exists.
- Search snapshots: temporary, removed automatically.
- Contact-form messages: in our mailbox, with no automatic deletion; we delete them on request.
- Public procurement contacts: tied to the lifecycle of the related opportunity.
- Provider logs (hosting, authentication, email delivery): kept according to each provider's own settings.
- Administrative audit log: kept to show accountability; it refers to accounts only by internal ID.
You can delete your account yourself in Settings, or write to contact@oppora.eu from the email address you registered with. If you have an active subscription, it is cancelled first so that no further charges are made. We then delete your authentication record and, with it, your profile, company details, saved items, alerts and their history, Score results, preferences and their history, and your reviews, including published ones. Records we must keep by law (such as payment records held by Stripe once paid plans exist) and copies in provider backups, which expire on the provider's schedule, are not deleted immediately.
11. Your rights
Subject to applicable law you can ask us for access to your data, rectification, erasure, restriction of processing, portability (in a structured, commonly used, machine-readable format) and you can object to processing based on legitimate interest. Where processing is based on consent you can withdraw it at any time, without affecting what happened before.
Write to contact@oppora.eu or use the Contact form. We may need to verify your identity. We answer without undue delay and within one month; the law allows an extension in complex cases, and we will tell you if that happens. Exercising your rights is free of charge unless a request is manifestly unfounded or excessive.
You also have the right to lodge a complaint with a data-protection authority — in Spain, the Agencia Española de Protección de Datos (AEPD), or the authority of the EU country where you live or work or where you believe an infringement took place.
12. Opportunity Score and automated processing
Opportunity Score and Best Match compare your profile (countries, sectors, keywords, products and services, CPV codes, contract-value range) with each opportunity using fixed rules written by us. They use no artificial intelligence or machine learning, and they do not learn from your behaviour. They only change the order and highlighting of opportunities you can already see; they do not submit a bid, award a contract or stop you from viewing anything you are otherwise allowed to see.
We therefore do not consider this a decision based solely on automated processing that produces legal or similarly significant effects on you (Article 22 GDPR).
13. Security and personal-data breaches
We apply reasonable technical and organisational measures: connections use HTTPS, passwords are stored only as hashes by our authentication provider, database access is restricted by account-level rules, and administrative access is limited to authorised accounts and recorded in an audit log. No system is completely secure.
If a personal-data breach occurs that is likely to put your rights at risk, we will notify the supervisory authority as the law requires (in general within 72 hours of becoming aware of it) and, where the risk is high, we will inform the people affected without undue delay.
14. Cookies and similar technologies
Our use of cookies and browser storage is described in the Cookie policy.
15. Changes to this policy
We update this policy when the service or the law changes, and show the version and dates at the top of this page. For material changes to how we use personal data we will notify registered users by email or in the product before the change takes effect where reasonably possible; we will not send an email for minor corrections.