Draft pending legal review. This policy is not yet in effect.
Subprocessors
A subprocessor is a company we use to run BidNotes that may process personal information or Customer Content on our behalf. Each one is bound by a written agreement with confidentiality and data protection terms, and gets only the data it needs for its job. This list is part of our Privacy Policy and Terms of Service.
Subprocessors that handle Customer Content and account data
These providers are involved in running the BidNotes application and billing for it.
| Company | What it does for us | Data it processes | Location |
|---|---|---|---|
| Cloudflare, Inc. | Hosting for the website and APIs, database, network security, bot protection (Turnstile) and staff sign-in (Access) | Account and contact details, support messages, billing status, request data such as IP addresses | United States, plus Cloudflare’s global network |
| Amazon Web Services, Inc. | Servers for the BidNotes application | Uploaded bid documents, notes and exports, account details | United States |
| DigitalOcean, LLC | Former servers for the BidNotes application. Holds a powered-off copy until it is retired. | Uploaded bid documents, notes and exports, account details | United States |
| Anthropic, PBC | AI model (Claude) used to read documents and draft notes | Text from uploaded documents and the drafts produced from it | United States |
| OpenAI, L.L.C. | AI model (ChatGPT API) used to read documents and draft notes | Text from uploaded documents and the drafts produced from it | United States |
| Stripe, Inc. | Payments, subscriptions, invoices and sales tax | Billing contact, billing address, tax ID if provided, payment details (held by Stripe, not by us) | United States |
| Google LLC (Google Workspace) | Email, including support replies and account notices | Names, email addresses and message contents | United States |
The AI providers receive document text only to produce your notes. They use it under business API terms that do not allow training their models on it, and keep it only for a limited time to detect abuse.
Website providers
These providers support the public website, not the application.
| Company | What it does for us | Data it processes | Location |
|---|---|---|---|
| Ahrefs Pte. Ltd. | Website analytics that use no cookies. Loads only if you allow analytics in cookie settings. | Page viewed, referring site, browser and device type, approximate country | Singapore |
Changes to this list
Before a new subprocessor starts processing Customer Content, we update this page and change the date above. We also email the account owner of every active subscription at least 30 days ahead.
- Get notified. Ask through the support form or at support@bidnotes.ai to receive these notices, even if you are not an account owner.
- Objecting. If you have a reasonable data protection concern about a new subprocessor, tell us within that 30-day window. We will try to address it. If we cannot, you may cancel the affected subscription and we will refund the unused part of any prepaid fees.
- Urgent changes. If we must replace a provider quickly for security or availability reasons, we will notify you as soon as we can, after the change if necessary.
Data processing agreement
Business customers can request a data processing agreement (DPA) at support@bidnotes.ai.