Privacy Policy

BidCertain, LLC (“BidCertain,” “we,” “us”) provides a design-assist and estimating tool for specialty geotechnical contractors. We take the privacy of your project data, cost database, and pipeline information seriously. Each customer's data is row-level isolated; your analyses, rate database, and cost structure are never visible to other customers, and we do not train AI models on your data. This policy explains what we collect, how we use it, who we share it with, and your choices.

Information we collect

Account data (name, email, company, and billing details, which are processed by our payment processor — we do not store full card numbers); project data you create or upload (documents, analyses, estimates, schedules, pay applications); and usage data (cookie-less, privacy-friendly analytics — we do not store your IP address with these events) plus operational logs needed to run and secure the Service.

How we use your information

We use personal information to:

• provide, operate, maintain, and secure the Service (to perform our contract with you);
• process payments and manage your subscription (contract + legal obligation);
• send transactional and service messages, and respond to support requests (contract + legitimate interest);
• improve reliability and prevent abuse, fraud, and security incidents (legitimate interest);
• comply with legal obligations (e.g. tax, recordkeeping).

Where the EU/UK GDPR applies, the legal bases are noted above. We do not use your project content to train AI models, and we do not use your data for third-party advertising.

Data about third parties

To provide bid management, BidCertain processes business-contact information about people who are not our customers — for example general contractors, their estimators, and project contacts that appear in the bid invitations, leads, and documents you provide. We process this on the basis of our legitimate interest in operating a B2B bid-management service, use it only to deliver the service to you, and do not sell it. If you are such a contact and want your information removed, email us at the address below and we will action it.

Sub-processors

We share data with these vendors only as needed to run the service, under agreements that restrict their use of it:

• Supabase — database, authentication, and file storage
• Vercel — application hosting and serverless compute
• Anthropic (Claude) — AI analysis of your project documents (prompts sent under zero-retention settings)
• OpenAI — voice-note transcription, only when you use dictation
• Stripe — subscription billing and payment processing
• Resend — transactional email delivery
• Plausible Analytics — cookie-less usage analytics (no IP stored)
• Microsoft & Google — calendar/email sync, only if you connect those integrations
• Intuit (QuickBooks) — accounting sync, only if you connect it
• Calendly — demo scheduling on our marketing site
• Crisp — in-app support chat (receives your name, email, and workspace context when enabled)
• Sentry — error monitoring (receives account identifiers and error context when enabled)

Cookies & tracking

We use essential cookies required to sign you in and keep your session secure — without them the Service won't work. We do not use advertising or cross-site tracking cookies, and our usage analytics (Plausible) are cookie-less and do not store your IP address. We honor “Do Not Track” and Global Privacy Control signals where required.

Retention, export & deletion

You control how long records are kept from Settings → Data retention, where you can also request a full export of your workspace data — we generate a downloadable archive and email you a secure, time-limited link. You can delete your account and its data at any time from your account settings; deletion removes your database records and the associated files in storage, and propagates to backups within our standard backup-rotation window. Some records may be retained where required by law (e.g. certified-payroll or lien-related records subject to statutory retention) or to resolve disputes and enforce our agreements.

Security

Data is encrypted in transit (TLS) and at rest. The documents storage bucket is private and access is row-level isolated per workspace, so one customer's files and data are never reachable by another. We restrict internal access to what's needed to operate the Service. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security.

Data breach

If we become aware of a security breach that compromises your personal information, we will notify affected users and any relevant authorities as, and within the timeframes, required by applicable law.

Your rights & choices

You can access, correct, export, or delete your account data from your account settings, or by emailing us. Depending on where you live, you may have additional rights and we will honor them:

• California (CCPA/CPRA): the right to know, access, correct, and delete your personal information, and to opt out of its “sale” or “sharing.” We do not sell or share your personal information for cross-context behavioral advertising. You may use an authorized agent, and we will not discriminate against you for exercising these rights.
• EU / UK (GDPR): the rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with a supervisory authority.

To make a request, contact us at the address below; we may need to verify your identity first and will respond within the period required by law.

Children's privacy

The Service is a business tool intended for use by companies and their authorized personnel. It is not directed to children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us personal information, contact us and we will delete it.

International users

BidCertain is operated from the United States, and our sub-processors may process data in the U.S. and other countries. If you access the Service from outside the U.S., you understand your information will be processed in the U.S., which may have different data-protection laws than your jurisdiction. Where required for transfers of data from the EU/UK, we rely on appropriate safeguards such as Standard Contractual Clauses.

Changes to this policy

We may update this policy as the Service evolves. Material changes will be reflected in the “Last updated” date above and, where appropriate, communicated to you. Continued use of the Service after an update means you accept the revised policy.

Contact

Questions, or to exercise a privacy right: support@bidcertain.com.