Privacy Policy

This policy explains what BidPaid collects, why, and what we do with it. BidPaid is operated from Romania and serves contractors in the United States.

What we collect

• Account information — your name, email address, company name, business address, phone number and logo, plus your password (stored only as a salted hash, never in readable form).
• Content you create — projects, bids and proposals, change orders, invoices, saved line items, and the contact details of the clients and general contractors you enter.
• Payment information — handled by Stripe. Card and bank details are entered on Stripe’s systems and never reach our servers. We store only the identifiers Stripe gives us (customer, subscription and payment references) and the amount, status and date of each payment.
• Usage data — pages visited, features used, device and browser type, and approximate location derived from your IP address. We also record session replays of activity inside the app to diagnose bugs and improve the product. Replay is disabled on public proposal, invoice and payment pages so your clients are not recorded.

Why we use it

• To provide the service — building, sending and tracking your documents.
• To take payment for your subscription and to let your clients pay you.
• To send transactional email (proposals, invoices, password resets, receipts).
• To support you when you ask for help, and to fix problems.
• To understand which features are used so we know what to improve.

We do not sell your data, we do not share it with advertisers, and we do not use your project or client data to market to your clients.

Who we share it with

Only the providers needed to run the service:

• Supabase — database, authentication and file storage.
• Vercel — application hosting.
• Stripe — subscription billing and your clients’ online payments.
• Postmark — transactional email delivery.
• PostHog — product analytics and session replay.

We may also disclose information if the law requires it, or to protect our rights, our users or the public. If BidPaid is ever acquired, your data would transfer with the business, and we would tell you before that happened.

Your clients’ information

When you add a client or a general contractor, you are the one deciding what to store. We process that information on your behalf and only to deliver your documents. You are responsible for having a lawful basis to enter it.

How long we keep it

We keep your account and content for as long as your account is open. If you close your account, we delete your content within 90 days, except records we are required to keep for tax and accounting purposes (typically payment records, for up to seven years). Backups are purged on a rolling basis.

Security

Data is encrypted in transit (TLS) and at rest. Access to production data is limited to people who need it to operate or support the service. No system is perfectly secure, but if a breach ever affects your data we will tell you promptly.

Your rights

You can access, correct, export or delete your data. Most of it you can change yourself in Settings; for anything else, email us and we will action it. Depending on where you live you may also have the right to object to processing or to complain to a data protection authority.

Cookies

We use cookies and similar storage to keep you signed in and to measure product usage. We do not run advertising cookies. Blocking cookies will stop you from staying logged in.

Children

BidPaid is a business tool and is not intended for anyone under 18.

Changes

If we make a material change to this policy we will update the date at the top and notify you in the app or by email before it takes effect.

Contact

Questions or requests: support@getbidpaid.com.