Privacy Policy

This policy explains how bidnotes.ai LLC (“BidNotes”, “we”, “us”) handles information when you visit bidnotes.ai, contact us, subscribe, or use the BidNotes application (the “Service”).

Information we collect

When you visit the website

Analytics, only if you allow it. With your permission, we use Ahrefs Web Analytics to count visits. It does not use cookies and does not build a profile of you. It records the page viewed, the referring website, your browser and device type, and your approximate country, derived from your IP address. We see this only as totals.
First visit source, only if you allow analytics. Your browser stores a short note of how you first arrived (for example, the referring website or the campaign tag in the link), the first page you saw and the date. It is kept in your browser’s local storage, not in a cookie. It is sent to us only if you subscribe, when it is attached to your subscription so we can tell which channels bring in customers. Rejecting analytics deletes it, and you can also clear it by clearing your browser’s site data. See our Cookie Policy.
Server logs. Our hosting provider, Cloudflare, processes IP addresses and request details to deliver the site and protect it from abuse.

When you contact support

The support form collects your name, email address, subject, category and message. We also store the IP address and browser user agent of the submission to help prevent spam. Cloudflare Turnstile checks that the form is being submitted by a person.

Payments are handled by Stripe. We never receive or store your full card number. Stripe shares the following with us: your name, email address, billing address, business tax ID if you provide one, your plan and billing status, and invoice history.

When you use the BidNotes application

Account information: the names and email addresses of the people on your account, and sign-in activity.
Customer Content: the bid documents you upload, and the notes, edits, approvals and exports created from them.
Usage information: for example, packages processed and features used, so we can operate the Service, enforce plan limits and fix problems.

How we use information

We use information to do the following. For people in the EU and UK, the legal basis for each is shown in brackets:

provide, secure and support the Service [performance of our contract with you, and our legitimate interest in keeping it secure];
process payments and send receipts, invoices and account notices [contract, and legal obligations for tax records];
answer support requests [legitimate interest in helping you];
understand how the site is used and which channels bring in customers [your consent, given in cookie settings];
comply with legal obligations and enforce our Terms of Service [legal obligation and legitimate interest].

We do not sell personal information, and we do not use it for third-party advertising.

Customer Content is used only to provide the Service to you. Your documents are not used to train AI models. We send document text to our AI providers, Anthropic (Claude) and OpenAI (ChatGPT), only to produce your notes, under their business API terms, which prohibit using it for model training. These providers may keep inputs and outputs for a limited time to detect abuse, then delete them under their own retention policies.

We do not use automated decision-making that has legal or similarly significant effects on you. BidNotes drafts notes for a person on your team to review.

Service providers

We share information only with providers that process it for us under contract. The full list, with locations and how we announce changes, is on our Subprocessors page:

Provider	Purpose
Cloudflare	Website and application hosting, database, security and bot protection (Turnstile)
Stripe	Payments, subscriptions, invoices and tax calculation
Ahrefs	Cookieless website analytics, only if you allow it
Google Workspace	Email
Anthropic (Claude) and OpenAI (ChatGPT)	Processing documents to produce notes; not used for model training
Amazon Web Services	Servers for the BidNotes application, including uploaded documents and notes
DigitalOcean	Former servers for the BidNotes application; holds a powered-off copy until it is retired

We may also disclose information if required by law, to protect the rights and safety of BidNotes or others, or as part of a merger or sale of our business. In that case, this policy continues to apply to it.

Cookies

Our own pages set no cookies, and we use no advertising cookies or pixels. Analytics loads only if you allow it, and you can change that at any time with Cookie settings in the site footer. We honor Global Privacy Control signals as a refusal. Cloudflare may set strictly necessary security cookies, and Stripe sets its own cookies on its checkout and billing pages. Our Cookie Policy lists each item.

How long we keep information

Support tickets: 36 months after the ticket is submitted, then deleted.
Billing records: as long as required for tax and accounting, typically 7 years.
Customer Content: for the life of your subscription. After your subscription ends you have 30 days to request an export. We then delete it from live systems within the following 30 days, and from backups within 90 days, unless the law requires us to keep it. You can ask us to delete it sooner.
Analytics: aggregated totals with no personal profile, kept by Ahrefs under its own retention settings.

Security

Data is encrypted in transit. Access to customer data and admin tools is limited to authorized BidNotes staff, who sign in through Cloudflare Access. No system is perfectly secure, but we work to protect your information. If a security breach affects your personal information or Customer Content, we will notify the affected account owners without undue delay, and within any deadline the law sets.

Your choices and rights

You can ask us to access, correct, export or delete your personal information by emailing support@bidnotes.ai. Depending on where you live, you may have additional rights under local law:

EU and UK: you can also object to or restrict some processing, withdraw consent at any time (for analytics, through Cookie settings), and complain to your local data protection authority.
California and other US states with privacy laws: you can ask what we collect and why, and ask us to correct or delete it. We do not sell personal information or share it for targeted advertising, and we do not use sensitive personal information to infer anything about you. If we decline your request, you can appeal by replying to our decision, and we will review it again.

We will not discriminate against you for exercising these rights. We may need to verify your identity before acting on a request.

When we process personal information in Customer Content on your behalf, such as names in your bid documents, your organization controls that information and we act as its processor. We will pass requests about that information to your organization. Business customers can request a data processing agreement (DPA).

Children

The Service is for businesses and is not directed to children under 16. We do not knowingly collect their information.

International transfers

We are based in the United States, and we and our providers store and process information mainly in the United States. If you are in the EU or UK, your information is transferred to the United States. Where required, we rely on appropriate safeguards, such as the European Commission’s standard contractual clauses and the UK Addendum.

Changes to this policy

We will post updates here and change the “Last updated” date. If a change is material, we will notify subscribers by email before it takes effect, and ask for consent where the law requires it.

Contact

bidnotes.ai LLC, [MAILING ADDRESS]. Email support@bidnotes.ai, or use our support form.