Privacy Policy

1. Who We Are

Bidready ("Bidready", "we", "our") operates the Bidready.ca platform from Canada and is the controller of personal information collected through the Service. Our designated Privacy Officer (the person responsible for the protection of personal information) can be reached at hello@bidready.ca.

Bidready is available worldwide. This Privacy Policy is written with Canadian federal privacy law (PIPEDA), Quebec's Act respecting the protection of personal information in the private sector (Law 25), the EU and UK General Data Protection Regulations (GDPR and UK GDPR), and the California Consumer Privacy Act as amended by the CPRA in mind. Where local law grants you stronger rights, those rights apply.

2. Information We Collect

We collect the following categories of personal information:

• Account information: name, work email address, company name, role, password hash, and authentication metadata.
• Company and proposal content: documents, tender materials, company profile, project history, and draft responses you upload or generate in the Service.
• Billing information: subscription plan, usage counts, and billing status. Payment card details are collected and processed directly by our payment processor (Stripe) and are never stored on Bidready's systems.
• Usage and device data: log records, IP address, user agent, timestamps, pages visited, actions performed, and error telemetry used to operate and secure the Service.
• Communications: support requests, feedback, and correspondence with our team.
• Cookies and similar technologies: strictly necessary cookies for authentication and security. We do not use advertising or cross-site tracking cookies, and we currently run no third-party analytics.

We do not knowingly collect personal information from children. The Service is intended for business use by adults.

3. How We Use Information

We use personal information to:

• Provide, operate, secure, and support the Service.
• Generate AI-assisted drafts and workflow outputs based on your inputs.
• Authenticate users and enforce access controls between organizations.
• Process subscription payments and enforce plan limits.
• Detect, investigate, and prevent fraud, abuse, and security incidents.
• Communicate with you about service updates, security notices, and support.
• Improve reliability, performance, and accuracy of the Service.
• Comply with legal obligations and enforce our Terms.

Under GDPR, our legal bases for processing are: performance of a contract with you (Art. 6(1)(b)), our legitimate interests in operating and securing the Service (Art. 6(1)(f)), compliance with legal obligations (Art. 6(1)(c)), and where required, your consent (Art. 6(1)(a)).

4. AI Processing and Subscriber Content

Documents and prompts you submit are processed by AI model providers acting as our sub-processors, solely to generate outputs for your organization. Which providers are involved depends on your subscription plan and the task:

• All plans: Anthropic (United States) performs AI inference.
• Trial, Core, and Pro plans: selected tasks are routed through OpenRouter (United States) to additional model providers — currently Google's Gemini models and hosted instances of the open-weight DeepSeek and Moonshot Kimi models. If a routed request fails, it falls back to Anthropic.
• Enterprise plan: AI processing uses Anthropic only.

We do not sell your Subscriber Content, and we do not permit our AI sub-processors to use it to train their general-purpose models. Subscriber Content is isolated per organization; no other subscriber can view, access, or download it.

5. When We Share Information

We share personal information only with:

• Service providers and sub-processors who operate infrastructure, hosting, payment processing, authentication, and AI model inference on our behalf, under contractual confidentiality and data protection obligations. The current list is published in Section 6.
• Professional advisors such as legal, accounting, and audit providers where strictly necessary.
• Successors in the event of a merger, acquisition, or sale of assets, subject to continued protection of your information.
• Authorities when required by law, court order, or to defend our legal rights and the safety of users.

We do not sell personal information and we do not share it for cross-context behavioural advertising.

6. Where Your Data Lives: Hosting, Sub-Processors, and International Transfers

Data at rest is hosted in Canada. Your account data, company profile, uploaded documents, and proposal content are stored in the Amazon Web Services Canada (Central) region (ca-central-1, Montréal) via our database and storage provider, Supabase.

Some processing necessarily occurs outside Canada — most notably application hosting and AI inference in the United States. The table below lists our current sub-processors, what they do, and where they process data:

Where personal data is transferred outside Canada, it remains subject to this Privacy Policy, and we require our sub-processors to provide a comparable level of protection through contractual safeguards. Where data is transferred from the EEA, UK, or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. Residents of Quebec should note that the processing described above involves communication of personal information outside Quebec; the assessment required by Law 25 is reflected in this section.

We will update this table when sub-processors change. A signed data processing addendum (DPA) is available on request by writing to hello@bidready.ca.

7. Retention

We retain personal information for as long as your account is active and for a reasonable period thereafter to meet legal, tax, accounting, and legitimate business requirements. Subscriber Content is retained while your organization has an active subscription. On termination, we will delete or anonymize Subscriber Content within a reasonable period, subject to legal retention obligations and backup rotation schedules. You may also request deletion of specific documents or of your account at any time (see Section 9).

8. Security

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information we handle. These include encryption in transit, access controls based on least privilege, tenant isolation, audit logging, and routine vulnerability management. No method of electronic storage or transmission is completely secure; we cannot guarantee absolute security. If we become aware of a security incident affecting your personal information, we will notify you and relevant regulators as required by law (including breach-of-security-safeguards reporting under PIPEDA and, for Quebec residents, Law 25 confidentiality-incident requirements).

9. Your Rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your personal information, subject to legal exceptions.
• Restrict or object to certain processing.
• Port your data to another service in a commonly used format.
• Withdraw consent at any time where processing is based on consent.
• Lodge a complaint with your local data protection authority (for example, the Office of the Privacy Commissioner of Canada, Quebec's Commission d'accès à l'information, a supervisory authority in the EEA or UK, or the California Privacy Protection Agency).

Under CCPA/CPRA, California residents also have the right to know, to delete, to correct, to opt-out of the sale or sharing of personal information (Bidready does not sell or share as defined by CCPA/CPRA), and to limit the use of sensitive personal information. We will not discriminate against you for exercising these rights.

To exercise your rights, contact hello@bidready.ca. We may need to verify your identity before responding. We will respond within the timeframes required by applicable law.

10. Cookies

We use strictly necessary cookies to keep you signed in and to protect the Service against abuse. We do not set third-party advertising or cross-site tracking cookies. If and when we introduce non-essential cookies (for example, for product analytics), we will ask for your consent first where required.

11. Automated Decisions

Bidready generates drafts and recommendations using AI, but it does not make automated decisions that produce legal or similarly significant effects about individuals. The subscriber always reviews, validates, and approves outputs before any submission or decision.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be signalled by updating the "Last updated" date and, where appropriate, by additional notice. Your continued use of the Service after an update takes effect means you accept the revised Policy.

13. Contact

Questions, requests, or complaints about privacy at Bidready can be sent to our Privacy Officer at hello@bidready.ca.