Privacy Policy

1. Introduction

BidPropel (“we,” “us,” “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, disclose, and safeguard your personal data when you use our platform — including our AI proposal writer, context generator, email writer, TOS Firewall, client CRM, and related features (the “Service”).

By using BidPropel, you consent to the data practices described in this policy. If you do not agree, please discontinue use of the Service.

2. Data We Collect

2.1 Information You Provide

• Account data: Name, email address, and authentication credentials (managed by Clerk, our identity provider).
• Profile data: Profession, preferences, and any details you add to your account.
• Client data: Names, email addresses, company names, relationship notes, and payment history that you enter for your clients.
• Invoice data: Invoice numbers, amounts, due dates, and payment statuses.
• Job post data: Text from job posts you paste for analysis, proposal generation, or context generation.
• Message data: Email drafts and sequences generated through the Service, including edits you make.
• Communications: Messages you send to us via the Contact page, support email, or feedback forms.

2.2 Information Collected Automatically

• Usage data: Feature usage (proposals generated, context generations run, emails drafted), credit balance, and interaction patterns within the Service.
• Technical data: Browser type, device information, IP address, referring URLs, and timestamps — collected via standard server logs and Vercel Analytics.
• Performance data: AI model latency, generation success rates, and error logs for service reliability monitoring.

2.3 Information We Do NOT Collect

• Payment details (credit card numbers, bank details) — these are handled entirely by Paddle, our Merchant of Record.
• Sensitive personal information (government IDs, race, religion, health data, biometric data).
• Gmail account credentials — OAuth tokens are stored encrypted and you can disconnect at any time.

3. How We Use Your Data

We use your data for the following purposes:

• Service delivery: Generating AI proposals, context analyses, email drafts, TOS scans, and follow-up sequences.
• Account management: Authentication, subscription management, usage tracking, and monthly limit enforcement.
• Service improvement: Aggregated, anonymized usage data helps us understand which features are most valuable and where to optimize.
• Communication: Sending transactional emails (password resets, subscription receipts, usage notifications), product updates, and weekly digests (for users who enable them).
• Support: Responding to your inquiries, bug reports, and feedback submissions.
• Security & compliance: Monitoring for abuse, enforcing our Terms of Service, and complying with legal obligations.

We do NOT use your inputs or AI outputs to train AI models. Our AI providers (OpenAI, DeepSeek, Groq) have policies that prohibit using API-submitted data for model training.

5. Third-Party Services & Data Processors

We use the following third-party services to operate BidPropel. Each is a data processor bound by its own privacy policy and data processing agreements:

6. Data Storage & Security

6.1 Storage

Your data is stored on Supabase servers (US East region via AWS). Clerk stores authentication data on their infrastructure. AI processing happens on OpenAI / DeepSeek / Groq servers. All data transmission is encrypted via TLS 1.2+.

6.2 Security Measures

We implement reasonable technical and organizational security measures including: encryption in transit (TLS) and at rest (AES-256), row-level security (RLS) on all database tables so users can only access their own data, JWT-based API authentication via Clerk, and regular dependency updates for security patches.

6.3 No Method is 100% Secure

While we take security seriously, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security. In the event of a data breach, we will notify affected users within 72 hours as required by applicable law.

7. Data Retention

We retain your data as long as your account is active. You may delete individual items (clients, invoices, messages, saved proposals) from within the Service at any time. When you delete an item, it is permanently removed from our database.

Upon account closure, we delete all your personal data and associated records (clients, invoices, messages, proposals, sequences, templates) within 30 days. Aggregated, anonymized data that cannot be linked back to you may be retained for analytics purposes.

8. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Correct inaccurate or incomplete data (most data can be edited directly in the Service).
• Erasure: Request deletion of your data (“right to be forgotten”).
• Portability: Receive your data in a structured, machine-readable format.
• Objection: Object to certain processing activities where we rely on legitimate interest.
• Non-discrimination: Exercising your rights will not result in denial of service or different pricing.

To exercise any of these rights, email us at hello@bidpropel.com. We will respond within 30 days. We may need to verify your identity before processing your request.

If you are located in the European Economic Area (EEA), we act as the data controller for your personal data. The legal bases for processing are: contractual necessity (providing the Service), legitimate interest (improving the Service, preventing abuse), and your consent (optional communications like the weekly digest).

9. Cookies & Tracking

BidPropel uses minimal cookies: Clerk sets authentication-related cookies (required for the Service to function). We do not use third-party advertising cookies, tracking pixels, or cross-site trackers. Our analytics (Vercel Analytics) are privacy-first — no cookies, no fingerprinting, no personal data collection.

10. Children's Privacy

BidPropel is not intended for children under 18. We do not knowingly collect data from children. If we become aware that a child under 18 has provided personal data, we will delete it immediately.

11. International Data Transfers

Your data is stored in the United States. By using BidPropel, you acknowledge that your data will be processed in the US, which may have different data protection laws than your country of residence. We ensure that our third-party processors provide adequate safeguards (Standard Contractual Clauses or equivalent) for international data transfers where applicable.

12. Changes to This Policy

We will notify you of material changes to this Privacy Policy via email (to the address associated with your account) and/or through the Service. The “Last updated” date at the top of this page indicates when this policy was last revised. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

13. Contact

Questions, concerns, or want to exercise your data rights? Contact us:

• Email: hello@bidpropel.com
• Contact page