BIDFLOW LTD — Privacy Policy

This notice explains how BIDFLOW LTD (“BidFlow”, “we”, “us” or “our”) handles personal data in connection with bidflow.uk, the BidFlow Platform, customer relationships, support, security, billing and marketing. BidFlow is registered with the Information Commissioner’s Office under reference ZC113580. Registration and payment of the data-protection fee are not an ICO endorsement of BidFlow or proof that every processing activity complies with law.

1. Our roles

BidFlow is a controller when it decides why and how to process personal data for account administration, billing, direct customer and prospect relationships, website operation, security, fraud prevention, support, service analytics, legal compliance and appropriate marketing.

BidFlow is generally a processor where a Customer uploads or generates Customer Data containing personal data and instructs BidFlow to process it to provide the Platform. The Customer is normally the controller of that Customer Personal Data and is responsible for its instructions, notices and lawful basis. Our Data Processing Agreementapplies automatically to that processor relationship.

2. Personal data we collect

Depending on how you interact with BidFlow, we may collect:

• Account and identity data: name, business email address, user identifier, organisation, role, authentication and account status information;
• Commercial and billing data: Plan, checkout selection, subscription and invoice identifiers, billing status, billing contact and limited payment-method metadata supplied by Stripe. BidFlow does not store full payment-card numbers or CVC data;
• Customer Data: tender documents, bid material, knowledge-base content, case studies, references, certifications, team and CV information, Generated Content and instructions, which may contain personal data selected by the Customer;
• Support and relationship data: messages, meeting notes, product feedback, security questionnaires and other correspondence;
• Technical and security data: IP address, device or browser information, timestamps, authentication events, request and error logs, security events and legal-acceptance records; and
• Usage data: page paths, feature events, counts, pseudonymous account or organisation identifiers and service-performance information. BidFlow configures product analytics to avoid tender documents, Generated Content, full URLs containing query strings and user email addresses.

Please do not place special-category data, criminal-offence data or unnecessary personal data in the Platform unless it is genuinely needed for the Customer’s tender purpose, the Customer has a valid legal basis, and appropriate safeguards are in place.

3. Where data comes from

We obtain data directly from users and Customer administrators; through use of the website and Platform; from Customer-selected documents and public websites imported at the Customer’s request; from service providers such as Supabase, Vercel and Stripe; and, for legitimate business-development activity, from public business sources, referrals and professional contact providers. A Customer may give us information about its personnel, referees, clients or proposed tender team; the Customer must provide any required notice to those people.

4. How and why we use controller data

Where we rely on legitimate interests, we consider necessity, proportionality and the effect on individuals. We do not sell personal data.

5. Customer instructions and AI processing

When BidFlow acts as processor, it processes Customer Personal Data only to provide, support and secure the Platform, comply with documented Customer instructions and law, and as further described in the DPA.

AI features send the prompt, relevant Customer-selected source excerpts and resulting output through Vercel AI Gateway to the provider selected for the relevant feature or route. Current approved providers include OpenAI and Anthropic; different features may use different providers or models and these may change subject to the Terms and DPA.

BidFlow configures AI requests to disallow routes that use prompts for provider model training and, for OpenAI routes, disables provider response storage where supported. BidFlow does not use Customer Data to train or fine-tune general or shared AI models unless the Customer expressly agrees in writing. This is not a claim that every provider retains no data: unless a verified Zero Data Retention route is enabled and eligible, a provider may retain limited input and output data under its applicable commercial/API abuse-monitoring and legal-retention rules. Standard periods and exceptions differ by provider and can change.

BidFlow is designed as a human-in-the-loop decision-support platform. Under the Terms, Customers are responsible for reviewing and approving Generated Content before relying on or submitting it. BidFlow does not control whether an individual user actually performs that review.

6. Recipients and service providers

We disclose only the data reasonably needed for the relevant service. Current categories include:

• Supabase: database, authentication and object storage for Platform and account data;
• Vercel: website and application hosting, serverless processing, delivery and AI Gateway;
• OpenAI and Anthropic: AI inference when the relevant provider is selected for a feature or route;
• Stripe: checkout, payment and subscription administration. Stripe receives payment information but is not sent tender content for this purpose;
• Resend: transactional email, including recipient details and necessary notification context;
• Firecrawl (Mendable): retrieval of a public website only when a user requests that import;
• PostHog: minimised product-usage analytics and performance information; our configuration is intended not to send tender documents or Generated Content; and
• professional advisers, insurers, auditors, regulators, courts, law enforcement, a corporate transaction counterparty or another recipient where reasonably necessary and lawful.

Where a provider processes Customer Personal Data for BidFlow as processor, the DPA and its subprocessor schedule apply. Some providers, particularly payment processors, may also act as independent controllers for parts of their service under their own notices.

7. International transfers

BidFlow uses UK, EEA and international technology providers. Customer Personal Data or controller data may therefore be accessed or processed outside the United Kingdom. Where a restricted transfer is not covered by UK adequacy regulations, we use an appropriate safeguard such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful mechanism, and complete a transfer risk assessment where required. Contact us for information about the safeguard relevant to your data.

8. Security

We use technical and organisational measures designed to protect data in a manner appropriate to risk. These include authenticated access, organisation-scoped authorisation and database controls, HTTPS/TLS for supported service connections, service-role restrictions, logging and incident-response procedures. No internet service can promise complete security. Customers are responsible for their own devices, account permissions, source-document handling and credentials. Further current information is in our Trust Centre and the DPA security schedule.

9. Retention and deletion

We retain controller data only for as long as reasonably needed for the purposes above, taking account of the account or customer relationship, legal and tax requirements, security, dispute limitation periods and deletion requests. In general:

• active account and subscription data is kept while the account or relationship is active;
• core contract, acceptance, invoice and transaction records may be kept for up to six years after the relevant relationship or financial period where needed for tax, accounting or legal claims;
• security and technical logs are kept for limited operational periods appropriate to their purpose;
• support records are reviewed and deleted or anonymised when no longer needed for support or legal claims; and
• marketing suppression records may be kept so that we continue to respect an opt-out.

Customer Personal Data is returned or deleted under the Terms and DPA. Deletion from active systems is followed by expiry from access-restricted backups and provider systems under normal backup and deletion cycles, subject to legal retention and documented provider exceptions. We therefore do not promise that every copy becomes permanently irrecoverable on an exact day.

10. Cookies, storage and analytics

BidFlow uses storage needed for authentication, security, account preferences and requested Platform functions. Product analytics is configured to respect browser Do Not Track signals, disable automatic interaction capture and session recording, avoid query strings, and use in-memory rather than persistent browser analytics identifiers. If we introduce non-essential cookies or comparable device storage that requires consent, we will request it before use. Browser settings may block storage, although essential Platform functions may then fail.

11. Your rights

Depending on the circumstances, UK data-protection law may give you rights to access, correct, erase or restrict personal data; object to processing; receive portable data; withdraw consent; and seek safeguards in relation to a significant decision based solely on automated processing. These rights are not absolute.

For Customer Personal Data, please first contact the Customer that controls the data. We will assist that Customer as required by the DPA. For data controlled by BidFlow, email hello@bidflow.uk. We may need proportionate information to verify identity and scope. Withdrawing consent does not affect earlier lawful processing.

BidFlow’s tender scores and recommendations are decision support. BidFlow does not itself make a procurement award, employment or other decision producing legal or similarly significant effects about an individual solely by automated means.

12. Marketing choices

You can unsubscribe using a message link or by emailing us. Service, security, billing and legal messages are not marketing and may still be sent where needed. We do not publish a Customer logo, quote, case study, performance figure or tender win without express permission.

13. Business service and children

BidFlow is a business service and is not directed to children. We do not knowingly create accounts for anyone under 18. Tender material may incidentally contain information about younger people; the Customer remains responsible for deciding whether it is necessary and lawful to upload it.

14. Changes to this notice

We may update this notice to reflect product, provider or legal changes. We will show a new version and effective date and give an appropriate notice for a material change. An archived copy may be requested from us.

15. Contact and complaints

Questions and requests should be sent to hello@bidflow.uk or to our registered office below. We aim to respond without undue delay and within the period required by applicable law.

You may complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint, although we would welcome the opportunity to address the concern first.