How BidAxis handles your data.

This Privacy Policy explains how BidAxis ("we", "us", or "our") collects, uses, stores, and shares personal data and business information when you use the BidAxis platform and related services (the "Service"). It also explains your rights under the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018, and related UK privacy law.

BidAxis is a business-to-business software platform used by procurement teams, bid teams, consultants, and agencies to qualify opportunities, upload tender documents, build knowledge libraries, generate draft responses, review bids, score opportunities, and manage subscription billing.

For your own account and organisation administration data, BidAxis acts as the controller because we decide how those records are used to operate the service. For tender materials, uploaded documents, customer knowledge-base content, and other information your organisation chooses to put into the platform, your organisation is usually the controller and BidAxis acts as processor in order to provide the service to you.

The legal entity and contact details for BidAxis are listed at the end of this policy under "Contact for privacy matters and legal notices".

Account data. When a user signs up, logs in, resets a password, or updates account settings, we process work email address, password credentials handled through Supabase Auth, and basic account metadata such as verification and session state. We do not store plaintext passwords ourselves.

Organisation data. During onboarding and account administration, we process organisation name, industry, website, employee-count band, location, certifications, team role, membership status, and related workspace settings.

Uploaded documents and knowledge-base content. The Service allows users to upload files and text for tender support, including knowledge documents, supporting evidence, case studies, policies, CVs, and other material the customer chooses to store. Those uploads may contain personal data embedded in the documents themselves, such as staff names, buyer contacts, references, or correspondence.

Bid and tender workflow data. We process opportunity records, issuing-body information, tender uploads, extracted text, project titles, qualification data, buyer requirements, draft responses, review notes, compliance findings, prediction inputs and outputs, shortlist and outcome records, export content, and related workspace activity.

Usage, security, and operational data. We record audit logs and internal product events such as sign-up, login, logout, checkout start, webhook processing, uploads, generation actions, and other feature activity. This helps us run the platform, troubleshoot faults, investigate misuse, and understand service usage at an account or organisation level.

Payment and billing data. Subscription billing is handled through Stripe. We receive subscription status, Stripe customer and subscription IDs, invoice-related metadata, selected plan, and billing period information. We do not receive or store full card numbers or card security codes on our own systems.

Session and cookie data. We use server-side session handling with cookies supplied through the Supabase SSR integration and Next.js cookie APIs so users can stay authenticated when moving through the app.

Contract necessity. We rely on Article 6(1)(b) UK GDPR where processing is needed to provide the service you asked for, including account creation, authentication, organisation setup, document storage, bid workspace operation, AI-assisted drafting or review you actively trigger, subscription management, exports, and customer support connected to your subscription.

Legitimate interests. We rely on Article 6(1)(f) UK GDPR for security monitoring, fraud and abuse prevention, audit logging, debugging, internal service analytics stored within our own platform database, service improvement, enforcing our contractual terms, and protecting the platform and our customers. When we rely on legitimate interests, we believe the processing is proportionate and expect it in a business software context, but you still have the right to object in some cases.

Consent. We rely on Article 6(1)(a) UK GDPR where consent is the appropriate basis, for example if we later introduce optional non-essential cookies, optional marketing communications, or another feature that clearly requires opt-in. Where consent is used, you can withdraw it at any time.

Legal obligation. We may also process or retain data where necessary to comply with legal obligations, including tax, accounting, fraud-prevention, regulatory, court-order, or law-enforcement requirements.

Special category and sensitive data. The Service is not designed for special category personal data or criminal-offence data. Customers should not upload that type of material unless they have independently established a valid legal basis and condition for doing so. If sensitive data is uploaded by mistake, contact us promptly so we can help assess and, where appropriate, remove it.

We do not sell customer data. Based on the codebase at the date of this rewrite, the external processors materially involved in handling customer data are Supabase, Stripe, and OpenAI.

Supabase. Supabase is used for database hosting, authentication, object storage, and related platform data processing. That means account records, organisation records, uploaded files, workspace content, audit records, and related operational data are stored or processed through Supabase services.

Stripe. Stripe is used for subscription checkout, recurring billing, billing portal access, subscription status updates, and invoice-related payment administration. Stripe receives payment and billing data needed to collect subscription fees and manage payment events.

OpenAI. OpenAI is used for AI-powered features in the product, including drafting, review, prediction, and other prompt-based generation or analysis features that users actively run. When those features are used, the relevant input text and instructions needed for the request may be sent to OpenAI for processing.

No external analytics or ad-tech processor is currently evident in the application code. We did not find Google Analytics, PostHog, Mixpanel, Segment, Meta Pixel, Hotjar, or similar third-party tracking scripts in the code reviewed for this rewrite.

Some of our processors operate internationally, including from the United States, so personal data may be accessed or processed outside the UK. Where that happens, we aim to use an available lawful transfer mechanism and apply reasonable contractual and technical safeguards.

Supabase. Supabase hosts project infrastructure on AWS, but the specific live region for this BidAxis project is not identified in the codebase and therefore is not stated here as fact. If the selected project region is outside the UK or EEA, or if support or operational access is provided from outside the UK or EEA, we expect transfers to rely on Supabase's data processing terms and applicable transfer clauses. Placeholder still required here: [INSERT LIVE SUPABASE PROJECT REGION BEFORE LAUNCH].

Stripe. Stripe is a global payments provider. Payment and subscription data may be processed in the UK, EEA, United States, and other countries where Stripe or its service providers operate. Stripe publishes transfer safeguards including the UK Extension to the EU-US Data Privacy Framework and contractual transfer terms.

OpenAI. OpenAI is headquartered in the United States. Unless a specific regional processing configuration is enabled for the relevant account, prompts and related inputs submitted through OpenAI-powered features may be processed in the United States or other regions made available by OpenAI. OpenAI states that business and API data is not used to train its models by default and offers contractual data-processing terms and transfer mechanisms for business customers.

If you want more detail about the transfer mechanism we rely on for a particular workflow, contact us at hello@bidaxis.tech.

We keep data for as long as it is needed to run the service, meet our contractual obligations, resolve disputes, enforce our terms, and comply with legal or accounting requirements. The retention periods below are the operational rules this draft is written to reflect.

Account and organisation records. We keep core account, membership, and organisation records while an account is active and for up to 90 days after account closure or deletion request so we can handle recovery requests, service transition issues, fraud checks, and dispute handling. After that, we aim to delete or anonymise them unless a longer period is legally required.

Uploaded documents, knowledge-base material, and bid workspace content. We keep these materials until the customer deletes them or the account closes. After account closure, we aim to remove this content from active systems within 90 days. Residual copies may remain in secure backups for a limited overwrite cycle before they are automatically removed.

Payment and subscription records. We keep subscription, invoice, and accounting records for at least 6 years where needed for UK tax, accounting, audit, fraud-prevention, and legal record-keeping purposes.

Audit, security, and service logs. We keep operational and security logs for as long as reasonably needed to investigate misuse, trace billing and access events, detect incidents, and maintain platform integrity. In normal circumstances, that means up to 12 months unless a longer retention period is required for an active investigation, dispute, or legal hold.

If you want content deleted sooner, contact us at hello@bidaxis.tech. We will assess the request against our legal and contractual obligations.

Subject to the limits and exemptions set by law, you may have the right to ask for access to your personal data, to correct inaccurate data, to delete data, to restrict processing, to receive a portable copy of certain data, and to object to processing based on legitimate interests or direct marketing.

If we rely on consent, you can also withdraw that consent at any time. Withdrawal will not affect processing already carried out before the withdrawal.

BidAxis does not present AI outputs as fully automated decisions with legal or similarly significant effect on individuals. Draft responses, review comments, compliance scoring, and win-probability style outputs are decision-support tools and are meant to be reviewed by a human user before use.

To exercise your rights, email hello@bidaxis.tech with enough information for us to identify your account and understand the request. We may ask for proof of identity before releasing or deleting data. We normally aim to respond within one month, subject to lawful extensions where a request is complex or numerous.

If you are unhappy with how we handle a privacy concern, you also have the right to complain to the UK Information Commissioner's Office (ICO). Details are available at ico.org.uk.

Based on the code reviewed for this rewrite, the Service currently uses cookies that are necessary for authentication and secure session handling. These are used through the Next.js cookie APIs together with the Supabase server-side authentication integration.

We did not find third-party analytics cookies, advertising pixels, or social tracking scripts in the application code. There is no evidence in the reviewed code of Google Analytics, Meta Pixel, Hotjar, PostHog, Mixpanel, or similar tracking tools setting cookies on the site.

Because the cookies currently in use appear to be necessary for login and session continuity, disabling them may prevent you from signing in or using authenticated parts of the service.

If we later add non-essential cookies or third-party analytics tools, we will update this policy and, where required, ask for consent before those technologies are used.

The Service is intended for use by adults acting in a business or professional capacity. It is not directed at children and is not designed for use by anyone under 18.

We do not knowingly collect personal data from children. If you believe a child has provided data to the service or has been included in uploaded content inappropriately, contact hello@bidaxis.tech so we can investigate and take appropriate action.

We may disclose personal data to UK courts, the ICO, HM Revenue & Customs, the police, or other competent UK public authorities when we are legally compelled to do so by a court order, warrant, subpoena, or binding statutory request. Where permitted by law, we will use reasonable efforts to notify you before complying so you have a chance to contest the disclosure.

We may also disclose personal data where we believe in good faith that disclosure is necessary to prevent imminent serious harm to a person, to protect our own rights, property and safety, or to investigate and respond to suspected fraud, cybersecurity incidents, or unlawful use of the Service.

We may update this Privacy Policy from time to time to reflect product changes, new processors, legal developments, or changes in how we handle data.

If a change materially affects how personal data is handled, we will take reasonable steps to notify account holders before or when the change takes effect. That may include email, an in-product notice, or an updated notice on this page.

The current version will always be posted on this page with the latest effective date.

For privacy questions, subject access requests, erasure requests, objections, transfer-mechanism questions, or other data-protection concerns, please contact us using the details below.

Email: hello@bidaxis.tech

Legal entity: BidAxis

Postal address: BidAxis, Unit A, 82 James Carter Road, Mildenhall, IP28 7DE

ICO registration number: [INSERT ICO REGISTRATION NUMBER IF APPLICABLE]