Privacy Policy

1. Information We Collect

Account Information

• Name, email address and mobile number
• Password, stored only as a one-way (bcrypt) hash that we cannot read
• Profile photo, if you add one
• Whether your email address and mobile number have been verified
• If you sign in with Google: your Google account identifier, name, email address and profile picture

Company Information

When you fill in your company profile:

• Company name, GSTIN, PAN, company type, registration number and date of incorporation
• Annual turnover, net worth, number of employees and years in business
• MSME registration (number and category), ISO certificates, DPIIT startup recognition, and GeM, EPF and GST registration status
• What your business does: the industries you pick, the tender types you bid for (works, goods, services, consultancy), your own keywords for products and services (specialisations), work categories and the states you operate in
• Past project values and maximum project capacity
• Documents you choose to upload, such as GST or MSME certificates, balance sheets or bank statements

Your Activity on Bidkoo

• Tender alerts you set up: keywords, categories, states, value range, frequency and channels
• Tenders you save and the notes you add to them
• Results of the AI eligibility checks and bid-document analyses you run
• Your searches, saved searches and search history
• Notifications we send you, and your notification preferences, including quiet hours
• Your referral code and referral counts. If you join through someone's referral link, a masked form of your email address appears in their referral history.
• API keys and webhook settings, if you use API access
• Support requests and messages, including anything you send through our contact form

Payment Information

• Plan, billing cycle, amount, GST, payment status and dates
• Razorpay order and payment reference numbers
• The GST tax invoices issued to you, which record your name, company name, email address and GSTIN (if you provided one) as they were when the invoice was issued

Card, UPI and bank details are entered directly in Razorpay's checkout. We do not receive or store them.

Sign-in and Device Information

• When you sign in with your email and password, the IP address and browser details (user agent) of that sign-in
• A device token for push notifications, if you turn push notifications on
• A record of your consent: when you agreed to our Terms of Service and this Privacy Policy (including that you are 18 or older), which version, and how you signed up

2. How We Use Your Information

We use personal data only for the following purposes:

1. Your Account: To create and secure your account, verify your mobile number with a one-time password, and keep you signed in.
2. Finding Tenders: To run your searches, saved tenders, alerts and deadline reminders.
3. Tenders For You: To show, by default, the tenders that match the industries, keywords, tender types and states in your company profile on your dashboard and tender list, and to send the alert that follows your profile. This matching runs on our own servers by fixed rules, not by AI, and you can switch to all tenders at any time.
4. AI Features: To compare your company profile with a tender's requirements in eligibility checks, to analyse tender documents and prepare checklists and bid strategies in the Bid Assistant, and, if you ask for it, to propose company profile details from a description or a document you give us (see section 3 for the AI provider).
5. Notifications: To send the alerts and reminders you ask for by email, WhatsApp, SMS, push and in-app notification, according to your preferences, and to send messages about your account and subscription, such as renewal reminders and payment confirmations.
6. Payments & Invoicing: To take payments, activate your plan, issue GST tax invoices and keep the accounting records the law requires.
7. Support: To answer your questions, requests and complaints.
8. Security: To limit repeated requests, prevent misuse of the Service and keep a record of administrator actions.
9. Improving the Service: Using aggregate statistics, such as popular search terms and the most-viewed tenders, that are not linked to your account.
10. Legal Compliance: To comply with applicable laws, court orders and lawful requests from authorities.

We process your personal data with your consent, which you give when you create an account and when you choose to use a feature such as alerts or AI eligibility checks, and, where the DPDP Act allows it without consent, for legitimate uses such as meeting our legal obligations (for example, keeping tax invoices).

3. Who We Share It With

We share personal data only with the service providers below, who process it on our behalf to run the Service, and where the law requires us to. Authorised Bidkoo staff can see account and support information in our administration tools to operate the Service and answer support requests.

• Hostinger: Hosting. Our servers and database, which hold the data described in section 1, run on a server Hostinger provides in India.
• Razorpay: Payment processing. Razorpay receives the payment amount and the details you enter in its checkout.
• Amazon Web Services (Amazon SES): Email delivery. It receives your email address and the content of each email.
• WATI: WhatsApp messages, if you turn on WhatsApp alerts. It receives your mobile number and the message.
• MSG91: SMS messages and one-time passwords. It receives your mobile number and the message. One-time passwords may instead be sent through Twilio or Fast2SMS if we configure them as an alternative.
• Google Firebase Cloud Messaging: Push notifications, if you turn them on. It receives your device token and the notification.
• Google: Sign-in with Google, if you choose to use it.
• Anthropic, PBC (Claude API), United States: AI eligibility checks, bid-document analysis, document checklists and bid strategies. For these features we send Anthropic the text of the tender and of any tender document you submit for analysis, your company profile (company name, GSTIN, PAN, company type, turnover, net worth, number of employees, years in business, MSME, ISO, DPIIT, GeM, EPF and GST registration details, work categories, specialisations, states, past project values and maximum project capacity), and the names and types of the documents you have uploaded. We do not send your name, email address or mobile number for these features.
  
  AI help with your company profile is separate and optional. If you use it, we send Anthropic the description of your business that you type and the one document you choose to upload for it (for example a GST registration certificate, an Udyam certificate or a company brochure), together with our lists of industries and states for it to choose from. The document goes as you uploaded it, so Anthropic receives whatever it shows, which on a certificate can include the legal name and address of the business, its registration numbers and the name of a proprietor or partner. We do not add your account name, email address or mobile number. We read the document once for this and do not keep a copy; the details the AI proposes are shown to you first and are saved to your profile only if you accept them and save the profile.
• Your AI assistant (Claude by Anthropic, ChatGPT by OpenAI), only if you connect it: MCP access lets you add Bidkoo to an AI assistant with a connector address from your settings. When you or your assistant then ask Bidkoo for something, the answer goes to that assistant's provider: tender information, the links to documents you open, your plan and how much of it you have used, and the result of an eligibility check made on your company profile. Nothing is sent unless the assistant asks through your address, and removing the address in Settings stops it. What the provider does with it is under your agreement with them, not this policy. We keep only a hash of the address, the time it was last used and a count of requests.
• The people on the same plan, only if you join or invite a team: a plan can cover several users. The person who bought the plan sees the name of each person who joined it, their email address if the account has one, and the date they joined; a person who joins sees the name and company name of the plan's owner. The plan's monthly counts of documents and AI checks are shared, so a document one of you opened shows as opened for the others. Nobody on the team sees another person's alerts, saved tenders, company profile or eligibility results. We send nothing to someone you invite: you pass the invitation link on yourself, and we keep only a hash of its secret. Leaving the team, or being removed, ends the sharing.

Transfer Outside India

Your data is stored in India. Anthropic processes the data above in the United States, so using the AI features transfers your company profile, the tender documents you submit and anything you give to AI help with your profile outside India. Anthropic handles it under its own terms and privacy policy. If you do not want this data sent, do not use the AI eligibility check, the Bid Assistant or AI help with your company profile; the rest of the Service works without them, and you can fill in your profile yourself.

4. Cookies & Browser Storage

To keep you signed in, our API sets one strictly necessary cookie: an HttpOnly sign-in cookie that page scripts cannot read, valid for up to 7 days and removed when you sign out. We also keep a copy of your basic profile (name, email address and role) and display preferences such as your theme in your browser's local storage. Signing out removes the sign-in cookie and the profile copy. The full list is on our Cookie Policy page.

When you pay, Razorpay's checkout runs in your browser, and when you sign in with Google, Google's sign-in script does. These may use their own cookies under their own policies. The fonts on this website are served from our own servers, so loading a page sends nothing to a font provider.

The KML and KMZ viewer on our free tools page draws its background map from OpenStreetMap. While that background is switched on, your browser asks OpenStreetMap's servers for the map pictures of the area you are looking at, which tells them your IP address and that area. The file you open is not sent to them or to us, and the background can be switched off.

5. Data Security

We protect your personal data with measures that include:

• Passwords stored only as salted bcrypt hashes, never in readable form.
• Administration tools that only staff accounts with an administrator role can use.
• Limits on repeated sign-in attempts and other requests, to slow down abuse.

No method of storing or transmitting data is completely secure. If a personal data breach affects you, we will inform you and the Data Protection Board of India as the DPDP Act requires.

6. Your Rights

Under the DPDP Act, you have the following rights:

1. Right to Access: You can get a summary of the personal data we process about you, what we do with it, and who we have shared it with. Use Download my data in Settings → Privacy & data for a copy of your data; section 3 lists who we share it with.
2. Right to Correction: You can correct, complete or update your personal data. Most of it can be edited in Settings under Profile and Company Profile; for anything you cannot change there, such as your email address, contact us.
3. Right to Erasure: You can delete your account and personal data with Delete my account in Settings → Privacy & data. We keep only what the law requires us to keep (see section 7).
4. Right to Withdraw Consent: You can withdraw consent at any time, as easily as you gave it. Turn off notification channels in Settings → Notifications, use the unsubscribe link in our notification emails, or stop using a feature. Because the Service cannot work without your account data, withdrawing consent to that processing means deleting your account. Withdrawal does not affect processing that took place before it.
5. Right of Grievance Redressal: You can raise a grievance about how we handle your personal data with our Grievance Officer at support@bidkoo.com or through our contact page. We acknowledge it within 24 hours and resolve it within 15 days (see our Grievance Redressal page).
6. Right to Nominate: You can nominate another person to exercise these rights on your behalf if you die or become unable to do so. Send us your nominee's name and contact details through the same channel as a grievance.

If you are not satisfied with our response to your grievance, you can complain to the Data Protection Board of India. The DPDP Act asks you to use our grievance process first. When you exercise these rights, the DPDP Act also asks you not to give false information or file frivolous complaints. We may ask you to confirm your identity before acting on a request about your account.

7. Data Retention

We keep your personal data while your account is open, so the Service can work for you, with these limits even while it is open:

• Your search history and in-app notifications: 12 months, then deleted.
• Sign-in records (the IP address and browser of each session): 12 months after the session ends, as Indian rules require logs to be kept for security investigations.
• Server and access logs, which include IP addresses: 1 year, stored in India.
• Support tickets and their messages: 2 years after they are resolved.
• An account created from the free alerts form whose email address is never confirmed: 30 days, then deleted with everything in it.
• Payment records and GST tax invoices: 8 years, as Indian tax law requires (see below).

When you delete your account:

• We immediately delete your company profile and uploaded documents, alerts, saved tenders, saved and recent searches, search history, eligibility results, notifications, notification preferences, support tickets, subscription, referral details, API keys and sign-in sessions.
• We replace your name, email address, mobile number and profile photo with placeholders and remove your password and Google sign-in link, so the account can no longer be used.
• We keep your payment records and the GST tax invoices issued to you, including the buyer details printed on them, for as long as Indian tax and accounting law requires. They stay linked to the anonymised account record.
• We keep a record that the account was deleted and when, and the record of your consent (date, policy version and sign-up method), without your personal details, so that we can show we had your consent while the account was open.

Messages you sent through our contact form while signed out are not linked to your account. They are deleted 2 years after they are resolved, or sooner if you ask us.

8. Children's Privacy

Bidkoo is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 18, we will take steps to delete such information promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. For significant changes, we will send a notification via email or in-app alert.

10. Grievance Officer & Contact

Questions about this Privacy Policy, requests about your personal data and grievances can be sent to our Grievance Officer:

• Grievance Officer: Parth Savajadiya (Director)
• Email: support@bidkoo.com
• Address: C-3053, TRP Mall, Bopal, Ahmedabad, Gujarat 380058, India

You can also reach us through our contact page.