Privacy Policy

This policy explains what personal data Bidro collects, why we collect it, and the rights you have over it. It applies to the website at bidro.io and the Bidro application at app.bidro.io (together, the "Service").

Who we are

The data controller is Bidro. If you have any question about this policy or your data, contact us at alistair@bidro.io.

The data we collect

Website visitors. If you join the waitlist or contact us, we collect your email address and anything you include in your message.

Application users. If you create a Bidro account, we collect your name, work email address, and the information you enter into the product — opportunities, bid scores, cost and margin figures, and decision records. This business data belongs to you; we process it only to provide the Service.

Technical data. Like most websites we receive standard server logs (IP address, browser type, pages visited) from Vercel.

We do not collect special category data and the Service is not intended for children.

Why we process it (lawful bases)

• Contract — to provide the Service to account holders.
• Legitimate interests — to respond to enquiries, operate the waitlist, secure the Service, and understand how the website is used.
• Consent — where we send product updates to waitlist subscribers, which you can withdraw at any time via the unsubscribe link.
• Legal obligation — where we must retain records for tax or accounting purposes.

Who we share it with

We do not sell personal data. We share it only with the service providers who host and operate the Service on our behalf:

• Vercel — website and application hosting.
• Loops — waitlist and transactional email.
• Stripe — payment processing; we never see full card details.
• Google Analytics

Each provider processes data under a data processing agreement. Where data is transferred outside the UK, we rely on adequacy regulations or the standard contractual clauses.

How long we keep it

• Waitlist emails: until you unsubscribe or 12 months of inactivity.
• Account data: for the life of your account, then deleted within 90 days of closure.
• Server logs: 30 days.
• Billing records: 6 years, as required by UK tax law.

Your rights

Under UK GDPR you can ask us to: access the personal data we hold about you; correct it; delete it; restrict or object to processing; and provide it to you in a portable format. To exercise any right, email alistair@bidro.io — we respond within one month.

You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk, though we would appreciate the chance to resolve any concern first.

Cookies

The website uses strictly necessary cookies to remember your cookie preference, and — only with your consent — Google Analytics cookies to understand how the website is used. Analytics cookies are not set until you accept the cookie banner, and you can withdraw consent at any time via "Cookie preferences" in the footer.

Changes to this policy

We will post any changes on this page and update the date above. Material changes affecting account holders will be notified by email.