Privacy Policy

Account information. When you create an account we collect your name and email address, and — if you sign in with a third-party provider such as Google — the basic profile information that provider shares with us (see Section 4). If you join or create an organization, we also store the organization name and your membership role. Authentication is handled by our identity provider, Clerk.

Documents you upload. The core of the Service is analyzing bid documents (PDFs, Word documents, and images) that you upload. These documents commonly contain vendor names and contact details, pricing and line items, scopes of work, warranty and timeline terms, and property addresses. You control what you upload.

Content we derive from your documents. We store the text and structured fields our AI extracts from each document (vendor, business website, business phone, business city and state, totals, line items, materials, warranty, timeline, deposit terms, and any license or registration numbers the bid states), the market, vendor-reputation, and license-verification research results associated with your comparison, and the generated evaluation reports themselves.

Project metadata. Comparison titles, property names and addresses, service categories, and any notes you add.

Payment information. Payments are processed by Stripe. We receive limited billing details such as your subscription status, plan, billing period, and records of one-time report-credit purchases (including the quantity purchased and your remaining credit balance). We keep an included-report usage record for each free or subscription report started, including the workspace, report identifier, and creation time, so deleting a comparison cannot reset its allowance. We never receive or store full card numbers.

Support communications. Emails you send us and our replies.

Business outreach information. For prospective business customers in the United States, beginning August 15, 2026, we may collect a person’s name, business email address, job title, employer, company website, business location, the public or licensed source and collection date, qualification notes about the company’s fit for BidVisory, and delivery, bounce, reply, complaint, and unsubscribe status. We do not purchase or use consumer email addresses for this outreach.

Outreach attribution.A link in a BidVisory business email may include a campaign, property-management segment, and copy variant. It never includes the recipient’s email address or another lead identifier. If you follow the link, we may keep those allowlisted campaign values in first-party browser storage for up to 30 days and, if you create a new account, store them with the account along with whether you started and completed your first report.

Technical and security data. Authentication and session cookies, IP addresses, browser and device information, application and security logs, rate-limiting counters, and Content-Security-Policy violation reports. These are used for operating, securing, and debugging the Service.

We use the information we collect to:

• Provide the Service — extracting information from your uploaded documents with AI models, researching publicly available market pricing and vendor reputation, and generating evaluation reports.
• Authenticate you and secure your account.
• Process subscriptions and payments.
• Respond to support requests.
• Identify appropriate business customers, send relevant commercial email, answer replies, prevent duplicate outreach, measure whether outreach leads to use of the Service, and honor opt-outs.
• Monitor, debug, secure, and improve the Service.
• Produce de-identified, aggregated statistics about bid pricing and terms — for example, typical pricing for a service category in a metro area — which we may use, publish, and license commercially. These statistics are described in section 8 below.
• Comply with legal obligations.

We do not sell your personal information, we do not share it for cross-context behavioral advertising, and we do not use your content to train AI models.

The de-identified statistics described above are not personal information: they contain no identifier of you, your organization, your properties, or the vendors who bid, and we do not attempt to re-associate them with anyone. Sharing or licensing them is therefore not a “sale” or “sharing” of personal information, and no opt-out is required for it. If that ever changes, we will say so here and provide the opt-out first.

Generating a report involves three AI-processing stages with our provider, OpenAI. The extraction stage runs once per file and the focused reputation lookup runs once per vendor — plus, for a vendor whose bid prints no website, one preliminary lookup that only identifies the vendor’s official website — so the number of calls depends on your comparison. The stages send different data, and we think it is worth being specific about which:

1. Extraction. Each uploaded file is sent to OpenAI in full, along with its file name and type, so the model can read the bid and return structured fields.

2. Market and vendor research. Market research uses web search. It sends the comparison title, service category, the property name and its city and state, any notes you have added, and — for each bid — the vendor name, bid total and currency, materials, up to twenty-five line items, and warranty and timeline terms.

A separate, focused web-search call looks up each vendor’s public reputation and attempts to verify any license or registration numbers the bid states against the issuing authority’s public records. When the vendor’s business website is known — stated in the bid, or identified by the preliminary lookup described above — our system retrieves that public website to collect the review and social profile links it publishes, and includes those links in the lookup. These lookups receive only the vendor name; when known — stated in the bid or identified by the lookups described here — the vendor’s public business website, business city and state, and stated license or registration numbers; the service category; and the project’s city and state (so license requirements can be checked for the right jurisdiction). They do not receive a bid-stated phone number or street address, an email address, a named contact, or a general contact-information field.

Google business-listing lookup.To locate each vendor’s public Google business listing, we send the Google Places API a text query containing the vendor’s business name and the applicable city and state. Bid-stated phone numbers, street addresses, emails, and named contacts are not included in that request. The system may compare the returned public listings against a bid-stated website, phone number, or address inside BidVisory to confirm that a result is the right business, but those comparison fields are not sent back to Google. New reports store only the matched business-listing identifier and code-generated match metadata — never the listing’s rating or review count. Instead, viewing or downloading a report triggers a live lookup of the current Google rating, which is displayed with Google Maps attribution but not stored.

Google Maps Platform content is provided subject to the Google Maps Platform Terms of Service, and Google’s handling of information is described in the Google Privacy Policy.

Deliberate minimizations apply to all of these calls. The market-research call receives no vendor contact details, and the street portion of the property address is dropped so only its city and state establish the regional market. The focused vendor and Google business-listing lookups likewise never receive a property street address or any bid-stated phone or street address. They use only the approved fields listed above.

3. Report composition. This call receives the extracted bid data, the project and property details, and the research results, and writes the final report.

Provider retention.We send every request with OpenAI’s storage of application state disabled, so your prompts and responses are not retained in your API history. OpenAI may still retain API data transiently for abuse monitoring — generally for up to 30 days, or longer where it is legally required to — and does not use data submitted through its API to train its models. Disabling storage reduces retention; it does not eliminate it.

AI output is informational. Reports are generated by AI from your documents and public web sources and may contain errors. They are not a substitute for professional judgment.

If you choose to sign in with Google, we receive only your basic Google profile information: your name, email address, and profile picture. We use this information solely to create and authenticate your BidVisory account. We do not request access to your Gmail, Google Drive, Calendar, Contacts, or any other Google service data.

We do not sell Google user data, do not share it with third parties except the service providers listed in Section 5, and do not use it for advertising. You can revoke BidVisory’s access at any time from your Google Account permissions page. Revoking Google access stops you from signing in with Google; it is not the same as deleting your BidVisory account, and it does not on its own delete the data described in this policy. To delete your account, see Section 7.

BidVisory’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We share account and Service information with the providers that run BidVisory on our behalf:

• Clerk — authentication and account management
• Convex — application database and file storage
• Google Maps Platform — vendor business-listing lookup (Google Places API)
• OpenAI — AI document analysis and report generation
• Stripe — payment processing
• Vercel — website hosting

For business outreach, we also use the following providers. They do not receive uploaded bid documents. Clay does not receive account information from us; Smartlead receives an existing account email only when needed to suppress it from outreach.

• Clay — sourcing, enriching, deduplicating, and qualifying prospective business contacts
• Smartlead — business-email delivery, reply management, campaign attribution, and workspace-wide suppression

Each is contractually bound to protect your information and to process it on our instructions when acting on our behalf. Several of them also process certain data independently under their own terms and privacy policies — for example account, security, fraud-prevention, abuse-monitoring, or operational data — and for payments Stripe acts as an independent controller as well as our processor. Their own policies govern that processing.

Within your organization. If you work in an organization workspace, other members and administrators of that organization can see the comparisons, documents, and reports in it.

We may also disclose information if required by law or valid legal process, to protect our rights or the safety of others, or as part of a merger, acquisition, or sale of assets — in which case this policy continues to apply to your information.

We use only essential authentication, payment, fraud-prevention, and security technologies — principally Clerk’s session cookies and, during checkout, Stripe’s hosted payment page. These are required for the Service to function.

We do not deploy analytics or advertising SDKs, and we do not track you across other websites or over time for advertising.

First-party outreach attribution. When an allowlisted BidVisory campaign link brings you to the Service, we may use local browser storage for up to 30 days to remember only the campaign, property-management segment, and copy variant. This is used to measure our own outreach, not to build a cross-site profile. Our outreach campaigns do not use invisible open-tracking pixels or third-party click redirectors.

Do Not Track and Global Privacy Control. BidVisory does not sell or share personal information for cross-context behavioral advertising, so there is no applicable sale, sharing, or targeted-advertising processing for a browser signal to opt out of. We honor these signals in the sense that the processing they are designed to stop does not occur here.

We keep your content for as long as your account or workspace is active. You have three ways to remove data:

• Delete a single comparison from within the app. This removes its documents, extracted data, and reports.
• Delete your account or organizationfrom the app. This promptly initiates cancellation of any active subscription and starts automated deletion of the workspace’s data. Deleting an organization deletes the shared workspace for every member.
• Email us at support@bidvisory.com and we will process the request for you.

Deletion runs as an automated background process. We commit to completing it within 30 days, and in practice it finishes far sooner. Some records are retained beyond that, as set out below.

Two exceptions are worth calling out plainly. Billing and tax records are retained as the law requires, and the de-identified statistics described in section 8 — which contain no identifier of you, your properties, or the vendors — are retained indefinitely and are not removed by any of the three options above.

Leaving an organization is not deletion.If you leave an organization, you lose access to its workspace but the organization’s data remains under the organization’s control. Only deleting the organization deletes that data.

When we generate a report, we also record a set of de-identified statistical facts about each bid: the service category, the city and state of the job, the month, the bid total, the priced line items, and terms such as warranty length, timeline, deposit and payment terms — plus, if you later mark a winner, which bid was chosen.

What these records deliberately do not contain:your name, your organization, your account, your property’s name or street address, and no identifier of the vendor who submitted the bid — no company name, phone number, website, business address, or licence number. Vendor licence and insurance claims are reduced to simple counts. Free-text fields are filtered to remove names, addresses, phone numbers, email addresses, web addresses and identification numbers before they are stored, and any value that cannot be cleaned is discarded rather than kept.

We may use, publish, and license these statistics commercially — for example, as market pricing benchmarks. Because they identify no one, they are retained indefinitely and are not deleted when you delete a comparison, your account, or your organization. Everything that identifies you is deleted as described in section 7.

Our commitment.We maintain technical measures designed to prevent these records from being re-associated with any individual, household, organization, or vendor; we publicly commit not to attempt to re-identify them; and we contractually prohibit anyone we share or license them to from attempting re-identification. We do not share these statistics in a form that reveals an individual vendor’s pricing, and we withhold recent data from anything we share externally.

This applies only to bids uploaded on or after July 30, 2026. Documents uploaded before that date were collected under our previous terms and are not used this way.

We protect your information using industry-standard measures, including encryption in transit (TLS), encryption at rest with our storage providers, tenant-level access controls that isolate each account’s and organization’s data, authentication on every data access, a Content-Security-Policy, and upload validation and rate limiting. No method of transmission or storage is 100% secure, but we work to protect your information against unauthorized access, alteration, or destruction.

Depending on where you live, you may have rights to access, correct, export, or delete your personal information, or to object to certain processing. You can exercise most of these directly in the app — editing your profile, deleting comparisons, or deleting your account — or by emailing us at support@bidvisory.com. We will respond to verified requests as required by applicable law and will not discriminate against you for exercising these rights.

These rights apply to personal information. The de-identified and aggregated statistics described in section 8 identify no one, so they are outside the scope of access, correction, and deletion requests — we cannot look them up by person because there is nothing in them to look up.

The Service is offered to business users in the United States. We review annually, and whenever our business materially changes, whether additional state privacy laws apply to us and will update this policy if so.

Every commercial outreach email also provides a working unsubscribe link and permits an opt-out by reply. We apply an opt-out across our outreach workspace and stop future campaign messages to that address. We may retain the minimum suppression record needed to make sure the request remains honored.

Bid documents and public research results contain business information about service providers — company names, contact details, pricing, and publicly posted reviews and ratings. This information is processed to evaluate bids for our customers, and it comes from our customers’ own documents and from public sources, including business-listing services such as Google.

If you are a vendor and believe information about your business held in the Service is inaccurate, or you would like it removed, contact us at support@bidvisory.com and we will review the request.

The Service is intended for business use by adults. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.

We may update this Privacy Policy from time to time. If we make material changes we will update the effective date above and give notice through the Service before the changes take effect. We will not treat your continued use as acceptance of a material change without having given you that notice and a reasonable opportunity to review it; if you do not agree with an update, you may stop using the Service and delete your account.

Questions about this policy or your data? Email us at support@bidvisory.com, or write to Rixser LLC d/b/a BidVisory, 3218 E Bell Rd #1432, Phoenix, AZ 85032.