Privacy Policy

This policy explains how Andrea Bonizzato processes personal data when you visit or use BidPilot. The operator is the controller for account, billing and website data. For documents uploaded by an organisation, the respective roles may also be governed by the customer agreement.

Data we process

We process account and workspace details, authentication and security records, subscription and transaction references, support messages, basic service usage, company-profile content, and tender or RFP files and outputs that you choose to upload or generate.

Why we process it

We use this information to provide and secure the service, authenticate users, analyse documents at your request, save workspace results, administer subscriptions, provide support, prevent abuse, and meet legal obligations. Our legal bases may include performance of a contract, legitimate interests in operating a secure service, consent where requested, and compliance with law.

AI-assisted processing

When you request an analysis or response draft, relevant document text and approved company context are sent to the configured AI provider to produce that result. Provider processing, retention and product-improvement terms depend on the configured account and service tier. Do not upload special-category, classified, export-controlled, or third-party confidential data unless your organisation has authorised that processing.

Service providers and transfers

We use vetted providers for hosting, authentication, database and file storage, AI processing, billing, and operational email. Depending on deployment, these may include Supabase, Google Gemini or OpenAI, Stripe, Vercel, and an email provider. Their processing locations and transfer safeguards depend on the operator's configured accounts and contracts.

Retention and security

Workspace data is retained while the account is active and as reasonably necessary to provide the service, resolve disputes, enforce agreements, or comply with law. Billing providers retain their own records under their policies. We use access controls, row-level workspace isolation, server-only credentials, transport encryption, and restricted file storage, but no service can guarantee absolute security.

Your choices and rights

Depending on applicable law, you may request access, correction, deletion, restriction, portability, or object to certain processing. You may also complain to your competent data protection authority. We may need to verify your identity before fulfilling a request.

Contact

The data controller is Andrea Bonizzato. For privacy questions or requests, contact andreabonizz1995@virgilio.it.