Privacy Policy

1. Who handles your information

BidXchange LLC operates BidXchange from Redlands, California 92373, United States. Contact Manuel Rodriguez at mrodriguez@oaisinc.com for privacy questions or requests. This is our business location; contact us by email to arrange postal correspondence.

For account administration, service security and business inquiries, BidXchange determines how information is used. When a company provides workspace records about employees, references or other people, that company also controls the information it enters and the people it authorizes. Contact your organization administrator about those records; you may also contact us for help. The parties’ specific responsibilities may be addressed in a separate written agreement.

2. Information we collect

We collect information you provide, information authorized users enter about others, and technical information needed to operate the service. Categories include:

• Account and contact information: name, work email, organization membership, role and sign-in/session information. The current user-facing sign-in flow uses email links.
• Business inquiries: your name, company, work email, trade, geographic market, agencies of interest, opportunity links, message and correspondence. Email contact links open your email application; a message is sent only when you send it there. If an online request form is enabled, it saves the submitted contact details and permission to respond.
• Workspace records: company identity and contact information, licenses, registrations, certifications, insurance, bonding, project references, personnel, capacity and other evidence your organization enters. These can include business contact information about other people.
• Pursuit records: opportunities, cited requirements, tasks, deadlines, notes, response drafts, approvals, named submitters, submission references, follow-up records and audit history identifying the user and action.
• File references: document names, external storage references and file hashes recorded during a response review. The current final-file hashing process runs in your browser and does not upload those file bytes. Private document uploads are not currently enabled.
• AI information: the question you submit, the generated response, and, in Workspace records mode, selected authorized records used to answer it. General questions mode and the public demo do not automatically attach private company records; information you type into a question is still sent for processing.
• Technical and usage information: browser/device and request information, IP addresses processed by hosting/security providers, session cookies, request identifiers, timestamps, usage counts, model/timing/token metadata, feedback selections and security logs. Some application abuse controls store keyed hashes of identifiers or prompts rather than the original values; those hashes are not described as anonymous.

3. How we use information

We use information to authenticate users, apply organization and role permissions, maintain company and pursuit records, generate requested working drafts and AI assistance, preserve review history, respond to inquiries, troubleshoot failures and protect against abuse. We also use operational information to administer usage limits, understand service reliability, comply with applicable obligations and resolve disputes.

Verification and approval labels describe recorded human actions. They do not establish that a record is correct or that your company legally qualifies for an opportunity. We do not use the assistant to make autonomous bid, pricing or submission decisions.

4. Who receives information

Authorized members of your organization can access workspace information according to their roles and the record’s visibility. Shared pursuit requirements, drafts and approval/submission histories may be available to other active members. Restricted company facts have narrower access. Choosing a visibility setting applies to the record, including its sources and notes.

We use Vercel for application hosting, Supabase for authentication and database services, and OpenAI for enabled AI requests. These providers process the information needed for their service. Business email correspondence is also handled through email providers. Authorized support and operations personnel may access information as needed to operate, support and protect the service.

We may disclose information when reasonably necessary to comply with lawful requests, protect rights and safety, investigate misuse or handle a business transaction such as a merger or transfer, subject to applicable protections. We may also disclose information at your direction, including when you download or share a response package.

The current application has no advertising-pixel, data-sale or cross-site behavioral-advertising integration. This statement does not mean that essential hosting, authentication, security and AI providers receive no information.

Links to procurement portals or external evidence locations lead to services governed by their own practices. Information your team downloads, copies or submits outside BidXchange is also subject to your organization’s handling and the recipient’s policies.

5. AI processing and conversation storage

Optional voice typing uses your browser’s speech-recognition service after you choose Dictate question and allow microphone access. That browser service may process audio online under its own privacy practices. BidXchange does not receive or store microphone audio. The transcript stays in the open page until you add it to your question; submitting the question processes the text like a typed prompt. Review the transcript before sending, and use typing when you do not want speech processing.

When you submit an AI question, it is sent to OpenAI. Workspace records mode can also send selected records permitted by your role and the application’s disclosure rules. General mode and the public demo do not query private company records. Do not put passwords, banking details, full tax identifiers, sensitive personal identifiers or information you are not authorized to disclose into a prompt.

Unsaved conversations are held in the current tab’s memory. For a selected bid, you may explicitly save a private checkpoint containing up to eight recent exchanges and their supporting context. This encrypted database copy is bound to your account, organization, role and bid; it is not a shared team conversation. Saving again replaces the previous checkpoint. Resume access expires after 30 days and requires current record access and freshness checks. You can delete the saved copy; expired encrypted copies may remain until replaced or deleted. Clearing the open conversation does not delete a separately saved copy. Usage metadata, keyed prompt digests, feedback and security/audit records are handled separately.

AI requests disable response storage for later API retrieval. That setting is not a promise of zero provider retention: provider security, abuse-monitoring and other applicable retention controls may still apply. See the linked OpenAI data controls for its current practices. BidXchange does not claim to have provider Zero Data Retention approval.

6. Cookies, local storage and tracking choices

Authentication uses cookies to maintain and refresh your session. The public demo assistant uses a security cookie with a one-day maximum age and abuse controls. The fictional demo saves edits in browser local storage, and workspace guidance stores a dismissal preference on your device. Avoid entering real confidential information into the fictional demo.

You can clear cookies and site storage in your browser, reset the fictional demo or clear the assistant display. Clearing local storage does not delete company records, audit history, messages sent by email or provider logs. Blocking essential cookies can prevent sign-in or AI-demo access.

The current application does not change its behavior in response to browser Do Not Track signals. It does not include cross-site advertising trackers. Hosting, authentication and AI providers still process operational data as described above. Contact us about privacy choices, including any rights that apply to you under local law.

7. Retention and deletion

We retain account, company and pursuit information for the purposes described here, considering the active customer relationship, review and audit needs, security, disputes and applicable legal obligations. Requesting account closure or removing a member does not automatically erase organization-owned records or the history of their actions.

Approval, submission and audit histories are designed to preserve an attributed record and are not editable or deletable through ordinary user controls. We review deletion requests individually, including whether information must be retained or can be removed, restricted or otherwise addressed. A universal automated deletion schedule for all workspace records is not currently enabled.

The public-demo AI usage system removes usage entries older than 14 days during later quota reservations; this is not an immediate scheduled deletion guarantee. Other usage metadata, email, provider logs and backups follow their operational retention arrangements. Clearing the interface does not erase these copies.

8. Your requests and choices

You can ask about access to, correction of or deletion of personal information by emailing mrodriguez@oaisinc.com with “Privacy request” in the subject. Describe your relationship to BidXchange and the request without including sensitive documents or credentials. We may need to verify your identity and authority using proportionate information. An organization administrator may need to participate when the request concerns company-controlled records.

Depending on your location and the laws applicable to our processing, rights may include access, correction, deletion, a portable copy, restriction or objection, withdrawal of consent, an authorized-agent request, and choices about sale, sharing or certain other processing. We will address applicable requests and explain any limitation or denial, including available appeal or complaint options. We will not unlawfully discriminate against you for exercising an applicable privacy right.

California residents can contact us using the same channel. This policy does not represent that every provision of the California Consumer Privacy Act applies to BidXchange; applicability depends on statutory criteria. Nothing here limits rights granted by applicable law.

9. Security and processing locations

The service uses authenticated sessions, organization-scoped database access rules, role restrictions and protected server-side credentials. These controls reduce risk but cannot guarantee absolute security. Protect access to your email account and devices, review workspace membership and report suspected unauthorized access promptly.

Our providers may process information in the United States and other locations where they operate. Do not assume that the service provides a particular national data-residency guarantee or certification. Contact us before using it for information requiring special contractual, regulatory or location controls.

10. Children and sensitive information

BidXchange is a business service intended for adults, not children under 18. We do not knowingly seek children’s personal information. Contact us if you believe a child has provided it.

The current service is not offered as an approved repository for classified information, controlled unclassified information, protected health information or other specially regulated records requiring controls not agreed in writing. Do not enter credentials, full tax identifiers or bank-account details.

11. Policy changes and contact

We will identify the effective date of a published policy and update its date when changes take effect. Material changes will be communicated through the service or another appropriate channel, with additional notice or consent where required. New wording will not override legal restrictions on how previously collected information may be used.

Privacy contact: Manuel Rodriguez, BidXchange LLC, Redlands, California 92373, United States; mrodriguez@oaisinc.com.