Privacy policy

[not set yet] provides Bidwise to construction companies (our customers).

For the requests, emails, attachments and client contacts a company handles in Bidwise, the company is the data controller and [not set yet] processes the data on its behalf, as a processor, under the agreement with the company.

For the accounts of the people who use Bidwise (name, email address, sign-in data), [not set yet] is the controller.

• Account data: name, email address, role, password hash, sign-in sessions, language.
• Company data: company details, people and their skills, absences, rate card, past jobs, schedules.
• Request data: emails received in the company's connected mailbox (only messages under the company's label and replies in threads it already handles), attachments, values read from them with their sources, questions, summaries, quotes, start dates and notes.
• Technical data: a log of meaningful actions (who did what and when), records of AI runs (model, tokens, cost), error logs.

To provide the service: read and check incoming requests, prepare questions, summaries, quotes and start dates, and send emails the company approved. To keep the history of each request, protect the service from misuse, give support and invoice the company.

We do not sell personal data, do not use it for advertising and do not use the companies' data to train AI models.

In the built-in mode, the text of a request and its files are sent to the AI model provider configured for the service, only to read them and to write questions and summaries. The provider processes them under its API terms. Prices, dates and statuses are calculated by our code, not by AI, and nothing reaches a client without a person's approval.

A user can connect their own AI chat (for example Claude or ChatGPT) to Bidwise. The chat then reads the company's requests, files and rules and saves its results through the tools the user allows, with the same rights as the user.

What the chat reads is processed by the chat's provider under the user's agreement with that provider. The connector receives only what the chat sends to its tools: it does not read the chat history, memory or other conversations. The user can disconnect the chat at any time, and a user removed from the company loses access at once.

When a company connects Gmail, Bidwise reads only the messages under the company's label and the replies in threads it already handles, puts that label on the messages it takes, and sends the emails the company approved, from the company's mailbox.

The use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data is used only to provide these features, is not transferred to others except to provide them (such as the built-in AI above), for security or as required by law, is not used for advertising, and is not read by people except with the company's permission, for security or as required by law.

Disconnecting the mailbox deletes the stored access token and revokes the access at Google.

We use service providers for hosting and storage, email delivery, AI models (built-in mode) and, when a company connects it, Google's Gmail API. They act on our instructions under data processing agreements and only for the purposes above.

Data is stored in the European Union. If a provider processes data outside the European Economic Area, the transfer relies on an adequacy decision or the EU standard contractual clauses.

Request data is kept while the company uses Bidwise. After the company's account is closed, its data is deleted within 30 days, except what the law requires us to keep longer. Backups expire within 35 days. Account data is deleted when the user is removed and no longer needed for the history of the company's requests.

Connections are encrypted (HTTPS). Mailbox access tokens are stored encrypted. Each company's data is separated in the database, access depends on the user's role, and every meaningful action is recorded.

Under the GDPR you can ask for access to your data, its correction or deletion, restriction of processing and a copy in a portable format, and you can object to processing.

If your data reached Bidwise through a company (for example, you sent it a request), contact that company first: it decides about that data, and we help it answer. You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or the authority of your country.

We publish changes on this page with a new date. About important changes we notify the companies' owners in advance.

Questions about this policy or your data: [not set yet].