Privacy Policy

1 · Who we are

Bid Reasoner is operated by Bid Reasoner, Inc. ("Bid Reasoner", "we", "us"). For any privacy question or request, contact us at legal@bidreasoner.com. For our customers (GCs), Bid Reasoner acts as a service provider / processor of the bid information you and your invited subcontractors submit; you remain the controller of that information.

2 · Scope

Bid Reasoner is a business-to-business tool. Two kinds of people use it:

• GC team members — your company's estimators, precon managers, and admins who manage projects, packages, and awards.
• Invited subcontractors — companies a GC invites to bid, who use the sub portal to view a package and submit a quote.

This policy covers the Service itself; third-party sites we link to have their own privacy policies.

3 · Information we collect

• Account & contact data. Name, work email, company name, and role, plus your hashed password (GC accounts). Subcontractors sign in through a secure link and don't set a password.
• Documents & bid content you upload. Owner documents (drawings, specs, addenda, contracts), subcontractor proposals, scope sheets, and required compliance documents. These may contain pricing, schedules, exclusions, and the names and contact details of the people who prepared them.
• Communications. Clarification questions and answers, invitation emails, and bids you forward to us by email so we can match and file them.
• Email engagement. For the transactional email we send (like bid invitations and clarification notices), we record delivery status and whether the message was opened, so GCs can see that an invitation reached its recipient.
• Usage & log data. Standard server logs (IP address, timestamps, pages and actions, browser type) used to operate, secure, and debug the service, plus aggregate product-usage telemetry when our analytics provider is enabled.

4 · How we use information

We use the information above to:

• Provide the service — read and normalize bids against your scope, surface risk, and produce comparisons, recommendations, and award documents.
• Send transactional email — invitations, sign-in links, clarification and award notifications, and security alerts.
• Keep the service secure and reliable — authentication, rate limiting, abuse and error monitoring, and backups.
• Provide support and comply with legal obligations.

We do not sell personal information, and we do not use your documents or bid content to advertise to you.

5 · Legal bases for processing

Where laws such as the EU/UK GDPR apply, we process personal information on these bases: performance of a contract (providing the Service under our Terms), legitimate interests (operating, securing, and improving the Service and preventing fraud and abuse), consent where we ask for it, and legal obligation (tax, accounting, and responding to lawful requests).

6 · AI processing

To read documents and analyze bids, Bid Reasoner sends the relevant content to our AI provider through its API. A few points about how that works:

• Content sent to our AI provider is not used to train its models.
• AI output is decision-support: every extracted field and recommendation is labeled and reviewable by a human, and an optional approval gate can require sign-off before extraction.
• Deterministic, rule-based checks run locally and are not sent to the AI provider.

7 · Subprocessors

We rely on a small set of vetted third-party service providers to run the service. Each receives only the data needed for its function:

The current list of providers is available on request — contact us at the address below. We'll keep this section current as our infrastructure changes.

8 · How we share information

• Tenant isolation. Each GC's data is siloed. Other GCs cannot see your projects, documents, or individual bids. A subcontractor only sees the invitations sent to them — never another sub's pricing or another GC's documents.
• Anonymized benchmarking (opt-in, off by default). We never share an individual bid. Only if you explicitly turn on research sharing in Settings do your line items contribute to aggregate market statistics — combined across many separate contributors and never traceable to you or to a single bid. You can turn it off at any time.
• With your direction. When you award a package or send notifications, we deliver the messages and documents you choose to the recipients you choose.
• Subprocessors as listed above, and legal compliance where required by law or to protect rights and safety.
• Business transfers. If we're involved in a merger, acquisition, or sale of assets, your information may transfer as part of that transaction under the same protections.
• We do not sell or rent personal information, and we do not share it for cross-context behavioral advertising.

9 · Cookies & tracking

Bid Reasoner uses only essential cookies — a signed session cookie to keep you logged in and a token that protects forms against cross-site request forgery (CSRF). We do not use advertising or third-party tracking cookies, so there is no tracking to opt out of. Your browser also stores a small preference for light/dark theme. If we enable a CAPTCHA on signup, its provider may set its own functional cookie. As noted in Section 3, our transactional emails include standard delivery and open tracking.

10 · How we protect information

• Encryption in transit (HTTPS) and passwords stored only as salted hashes, never in plain text.
• Strict tenant isolation, access controls, and audit logging of administrative actions.
• Account-lockout on repeated failed logins, optional two-factor authentication for administrators, and rate limiting.
• Files are stored in private storage and served only through authenticated, tenant-scoped routes; uploads can be scanned for malware.

No system is perfectly secure, but we work to protect your information using industry-standard safeguards, and we will notify affected users and regulators of a breach as applicable law requires.

11 · Retention & deletion

We keep account and project information for as long as your account is active and as needed to provide the service. You can ask us to delete your data, and we will do so unless we're required to retain it for legal or legitimate business reasons. For customers, we honor data-handling and deletion terms in your agreement with us.

Self-service deletion. A workspace admin can delete the account from Settings › Account. We use a 30-day grace period: the workspace is marked for deletion and can be restored at any time during those 30 days, after which it and all associated data — projects, bid packages, uploaded documents, submitted bids, and AI/usage records — are permanently and irreversibly deleted, including the underlying files in our storage. If your workspace has multiple members, deleting your own account removes only your access; the shared workspace remains for your teammates.

We retain a minimal administrative audit log of security-relevant actions (including the deletion itself) where required for legal, security, or compliance reasons; this log does not contain your project content.

12 · Your rights & choices

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, or to object to certain processing. To make a request, email legal@bidreasoner.com from the email address on your account; we may need to verify your identity. If your data was provided to us by a GC (for example, as part of a bid invitation), we may direct your request to that GC, who controls that information.

13 · California privacy rights

In the last 12 months we collected the categories described in Section 3: identifiers (name, email, company, IP address), professional information (role and company details), commercial information (bid and project documents you submit), and internet activity (usage logs). We collect them from you, your company, or the GC that invited you, for the purposes in Section 4, and disclose them only as described in Section 8.

• We do not sell personal information and do not share it for cross-context behavioral advertising.
• California residents may request to know, correct, or delete their personal information, and we will not discriminate against you for exercising these rights.
• We do not disclose personal information to third parties for their own direct marketing (California "Shine the Light").

Exercise these rights by emailing legal@bidreasoner.com; an authorized agent may submit a request with written authorization.

14 · EU/UK rights & international transfers

If you are in the EEA, UK, or Switzerland, you additionally have the rights to confirm whether we process your data, receive a portable copy, withdraw consent at any time (without affecting prior processing), object to or restrict processing based on legitimate interests, and lodge a complaint with your supervisory authority. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects — AI output in the Service is always subject to human review.

Bid Reasoner is operated from the United States and our subprocessors are US-based, so if you use the Service from outside the US, your information is transferred to and processed in the US, where data-protection laws may differ from those in your jurisdiction.

15 · Children, Do Not Track & third-party links

Bid Reasoner is a workplace tool intended for businesses and is not directed to children under 16; we do not knowingly collect information from them. Because there is no industry standard for "Do Not Track" signals, the Service does not respond to them — though as noted above, we don't track you across other sites in the first place. Links to third-party sites are governed by those sites' own privacy policies.

16 · Changes & contact

We may update this policy as the product evolves. Material changes will be announced by email or a prominent notice before they take effect, and every update is reflected by a new "last updated" date. Questions or requests: legal@bidreasoner.com (Bid Reasoner, Inc.).

See also our Terms of Service.