Privacy Policy
In short: we collect what we need to run BidderOps, we don’t track you across the web or sell your data, and we never train AI on it. AI features use the provider your organization picks. You can download or delete your data from your profile at any time.
1. Who we are and our role
BidderOps is operated by Bidderist. This policy explains how we handle personal data in two different roles:
- As controller for account data about the people who sign up and use BidderOps, and for data about visitors to our website. This policy is the notice for that processing.
- As processor for personal data your organization puts into its workspace, such as expert CVs, contacts at contracting authorities, JV partner staff or people named in intelligence reports. Your organization is the controller and decides why that data is processed; our commitments are in the Data Processing Addendum.
Contact us about privacy at privacy@bidderops.com.
2. Personal data we collect
Account data
Your name, email address, password (stored only as a salted hash by our authentication provider), optional profile photo, timezone, the organizations you belong to and your role in each. If you sign in with Google we receive your name, email address and profile picture from Google.
Workspace content
Anything you and your colleagues enter or upload: opportunities, notes, documents and links, outcomes, competitor records, company references, personnel CVs and assignment history, AI-generated reports and chat conversations with the assistant.
Usage and technical data
An activity log of actions on each opportunity (who changed what, and when), counts of AI feature use for daily limits, background job status, notification preferences and delivery status, connected MCP clients, and standard server logs from our hosting providers (IP address, browser type, request time).
What we do not collect
We do not use advertising or cross-site tracking, third-party analytics cookies, or buy personal data from data brokers.
3. Why we use it and our legal bases
Under Article 6 GDPR we rely on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Creating your account and providing the Service | Performance of a contract (Art. 6(1)(b)) |
| Sending sign-in, invite and security emails, and the deadline and activity notifications you configure | Performance of a contract (Art. 6(1)(b)) |
| Keeping the Service secure: authentication, rate limiting, audit logs, abuse prevention | Legitimate interests in protecting the Service and our customers (Art. 6(1)(f)) |
| Improving the Service with aggregated, de-identified usage statistics | Legitimate interests in developing the product (Art. 6(1)(f)) |
| Keeping records we are legally required to keep, responding to lawful requests | Legal obligation (Art. 6(1)(c)) |
| Product news or marketing emails, if we ever send them | Consent (Art. 6(1)(a)), which you can withdraw at any time |
Where we rely on legitimate interests you can object at any time (see Your rights). Workspace content is processed on your organization’s instructions and its legal basis is determined by your organization.
4. AI features and automated decisions
AI features send only the data needed for the task (for example, an opportunity’s details and relevant references when you request Go/No-Go advice) to the model provider your organization has configured, using your organization’s own API key. That provider’s handling of the data is governed by your organization’s agreement with it. Organizations that need data to stay in-house can point features at a local model instead.
To power organizational memory, short text summaries of outcomes, notes, references and CVs are sent to our embedding provider (see Subprocessors) to create search vectors. We never use your data to train AI models.
BidderOps does not make decisions with legal or similarly significant effects about individuals solely by automated means (Article 22 GDPR). Win probabilities, Go/No-Go advice and bid-tailored CV summaries are advisory and are reviewed by people in your organization.
5. Public tender data and bid intelligence
Discovery imports public procurement notices, which can include the names and contact details of procurement officers. Bid Intelligence searches the public web and may summarize publicly available information about people connected to a tender, such as officials, consultants or competitor staff. The organization that runs the report is the controller for that information. If you believe a workspace holds information about you, contact privacy@bidderops.com and we will pass your request to the organization concerned and help it respond.
7. International transfers
Some subprocessors are located outside the European Economic Area and the United Kingdom, including in the United States. Where personal data is transferred to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses (Decision 2021/914), the UK International Data Transfer Addendum, or the EU-U.S. Data Privacy Framework where the recipient is certified, together with supplementary measures such as encryption in transit and at rest.
8. How long we keep it
| Data | Retention |
|---|---|
| Account data | Until you delete your account, then removed immediately |
| Workspace content | Until your organization deletes it or deletes the organization |
| Your chat conversations | Until you delete them or your account |
| Activity log entries you created | Kept with the organization's records; your name is removed when your account is deleted |
| AI usage counts and notification delivery records | Kept while the organization exists, removed with your account |
| Server logs at our hosting providers | Short rolling windows set by those providers |
| Encrypted backups | Overwritten within 30 days |
9. Security
Each organization’s data is isolated at the database level with row-level security, so one organization cannot read another’s records. Access inside an organization is role-based. Data is encrypted in transit with TLS and at rest by our hosting provider; AI provider keys are additionally encrypted with AES-256-GCM using a key held outside the database. Server credentials never reach the browser. If a personal data breach affects you, we will notify the relevant supervisory authority and you as required by law.
10. Your rights
Under the GDPR and UK GDPR you have the right to access your personal data, to have it corrected, to have it erased, to restrict or object to processing, to data portability, and to withdraw consent where we rely on it.
You can exercise the most common rights yourself, without asking us:
- Access and portability: Profile, then Privacy & data, then Download my data, gives you a machine-readable JSON copy of your personal data.
- Correction: edit your name, email and photo in your Profile.
- Erasure: Profile, then Privacy & data, then Delete my account.
- Notifications: turn email categories off in your notification settings.
For anything else, email privacy@bidderops.com. We respond within one month. If a request concerns workspace content controlled by an organization, we will refer it to that organization and help it respond. You also have the right to complain to your local data protection authority.
11. Children
BidderOps is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children.
12. Changes to this policy
We will post any update here and change the effective date. If a change materially affects how we use your personal data, we will tell you by email or in the app before it takes effect.