Privacy policy

• Your email address, to send the confirmation link, your digests and account messages. This is the only personal detail we require.
• Your profile settings: the markets, keywords, excluded words, category, minimum value and the short description you may write. Used only to match tenders for you.
• Billing references, if you subscribe: the customer and subscription identifiers that Dodo Payments gives us, plus your subscription status and period dates. We never see or store card numbers; payment details are entered on Dodo's pages.
• Usage events: anonymous counters such as page views, searches and digest link clicks, keyed to a random session id. We do not record your IP address or browser fingerprint in these events.
• A hashed IP address for 24 hours, to limit abuse of the free search and signup (rate limiting). The hash is salted daily and cannot be turned back into an address.

We do not collect names, phone numbers or company details, we run no advertising or tracking cookies, and we do not buy or sell data. Tender notices themselves are public-sector information republished from official portals with contact-person fields removed.

One cookie, bh_session, keeps you signed in for 30 days after you click a login link. It is strictly necessary, HTTP-only and not used for tracking. Links in emails carry a signed token so you can manage or unsubscribe a profile without logging in.

For Pro subscribers, and for summaries shown on notice pages, we send the public text of tender notices together with a profile's keywords and description to an AI model to produce a plain-English summary and a fit score. At present the model is Google's Gemini, accessed through Google's API. Google may use content sent on its free API tier to improve its services. We never send your email address or billing details to any AI provider, and you can keep your profile description empty if you prefer to share only keywords.

• Google Cloud (United States, Iowa region) hosts the website and runs our scheduled jobs.
• Turso hosts our database (notices, accounts, profiles, events).
• Resend sends our emails; it processes your address and the email content.
• Dodo Payments is the merchant of record for subscriptions: it takes payment, issues invoices and handles tax. Its own privacy policy governs the payment details you give it.
• Google also provides the AI model behind summaries and fit scores (see above).
• Cloudflare provides DNS and forwards email sent to our support address.

Some of these companies are outside India, the UK and the EU (mainly in the United States). They act on our instructions under their standard data-processing terms.

• Unconfirmed sign-ups: deleted after 7 days if the confirmation link is never clicked.
• Free accounts: deleted after 12 months with no login or digest click, after a warning email.
• Paid accounts: kept while the subscription is active; billing references are removed 90 days after the account is closed.
• Usage events: 13 months.
• Hashed IP addresses for rate limiting: 24 hours.
• Login-link tokens: 15 minutes, single use.
• Tender notices: removed 90 days after their deadline (or 180 days after publication if no deadline was given).

Wherever you are, you can ask us to show you, correct or delete the data we hold about you, or to export it, by emailing support@bidheron.com from the address on your account. We respond within 30 days. You can unsubscribe from any digest with the link in its footer, pause or edit profiles from your dashboard, and delete your account by asking us. If you are in the EU or UK, you also have the right to complain to your data-protection authority; in India, this address is also our grievance contact under the Digital Personal Data Protection Act.

We process your email and profile to perform the service you asked for (contract), rate-limiting and security data to protect the service (legitimate interest), and billing references to meet legal and accounting duties. Digests are part of the service you signed up for, not marketing; we send no marketing email.

BidHeron is a business tool for adults. We do not knowingly collect data from anyone under 18.

If we change this policy in a way that matters, we say so in the digest footer and on this page before it takes effect. Questions: support@bidheron.com.