Privacy Policy

1. What we collect

This policy is issued by GigaTech Niugini Limited (company no. 1-148489106), trading as Bidligence, Section 267, Allotment 09, Debona St, Gerehu, Moresby Northwest District, Port Moresby, National Capital District 121, Papua New Guinea, which is responsible for the personal data Bidligence processes. Contact us about it at privacy@bidligence.com.

Account details (name, e-mail, workspace), documents and data you upload, generated content, usage metrics and billing information handled by our payment processor.

To keep the free trial to one per customer, we keep a record of each trial started: the workspace and account it was started from, the payment processor's customer reference, and keyed one-way hashes of the e-mail address and of the payment card's type, last four digits and expiry — never the address or the card themselves. The record outlives the workspace and the account, since deleting either must not make a new trial available.

2. How we use it

To provide and improve the Service, to send transactional e-mail (invitations, deadline reminders, receipts) and, if you opt in, product updates. We do not sell personal data.

3. Processors

If you sign in with Google, GitHub or Apple, that provider gives us your name, your verified e-mail address, your profile picture where you have one, an account identifier, and the access tokens of that sign-in, which we keep with your account and use for nothing else. We never see your password there. Apple may give us a private relay address instead of your own.

Cloud hosting and database (Vercel, Supabase), machine-learning model provider behind Bidligence Super Intelligence (Anthropic), e-mail (Resend), billing (Paddle) and Autodesk, for CAD file conversion and the drawing viewer, when enabled — the drawing files of a design-drawings run are then uploaded to Autodesk to be converted. Each processes data only on our instructions and under contractual safeguards.

4. The shared rate index (optional, off by default)

A workspace contributes anonymised priced observations to Bidligence's cross-customer rate index only while a user with the finance role or higher — finance, technical lead, bid manager or admin — has turned on Rate Library → "Contribute anonymised rates". The setting is off for every new workspace.

A contributed observation records the catalogue item, the country and region, the unit, the price and its currency, the observation date, the evidence class and a confidence weight. Inside Bidligence it is also tagged with your workspace and, where the price came from a supplier quote, an uploaded price list or an RFQ, with that supplier, the name of the source document and the wording of the line the price was read from — that is what lets you withdraw or correct it afterwards. Whole documents are never copied into the index.

None of those tags is published. Other customers see a shared rate blended into the recomputed estimate for its item and country, and — once at least three customers have contributed for that item and country — may also see it individually and anonymised: price and currency, unit, evidence class, confidence and the month only. Never the exact date, the supplier, the document, your notes, or which customer it came from.

Turning the setting off marks your existing contributions unshared and triggers a recompute of the affected countries, which deletes any estimate that no longer has qualifying evidence behind it. It cannot recall a figure another customer has already used. Deleting your workspace deletes its observations.

5. Retention and deletion

Workspace data is retained while your account is active. An admin can delete the whole workspace from Settings → Workspace & data; the page lists what will be destroyed and asks for the workspace name to be typed back before it will proceed. If no admin is reachable, write to privacy@bidligence.com from the address on your account and we act once we have confirmed you are an admin of it. A workspace whose subscription is still billing is not deleted until the subscription has been cancelled, so that nobody is charged for a workspace that no longer exists.

The deletion itself is immediate and irreversible, applies to every member of the workspace, and destroys its bids, tender documents, analyses, BOQs, generated documents, design drawings, exports, RFQs and supplier quotes, evidence vault, library, lessons, suppliers, rate observations, comments, Hunter 1.0 conversations, notifications and activity. The stored files behind those records — tender documents, evidence-vault items, uploaded price lists and exports — are deleted from object storage in the same operation; any file that cannot be removed at the time is logged and cleared within 30 days. Drawing files uploaded to Autodesk for conversion are deleted from Autodesk with the workspace, and in any case within 30 days by the temporary retention policy of the Autodesk storage bucket that holds them.

Where you would rather we acted for you — including deletion of a user account, or of personal data held outside a workspace — write to privacy@bidligence.com. We complete a verified request within 30 days, except where retention is required by law.

Some records are kept after a workspace or account is deleted: payment, refund and chargeback records for as long as tax and accounting law requires; a minimal record that a workspace existed and what it paid, with no names or content; and sign-in and sign-up security events, with the IP address stored only as a keyed hash, for 180 days, to prevent abuse.

With each of those security events we also keep the network the address belongs to (for an IPv4 address its first three numbers, such as 203.0.113.x), the browser's user-agent string and, for a sign-up, the domain of the e-mail address — never the full address or the full e-mail.

6. Your rights

You may access, correct, export or delete your data. An admin can download the workspace's own data at any time from Settings → Workspace & data, as one machine-readable JSON file together with a manifest of every stored file so the originals can be fetched; no request to us is needed. For anything else — a copy of your personal data, a correction, or erasure, including where you are not an admin — write to privacy@bidligence.com.

7. Security

Data is encrypted in transit and at rest; access is role-based and logged. Report security concerns to security@bidligence.com; how we handle reports is set out at /security.

When you choose a password, we check it against Have I Been Pwned's list of passwords exposed in public data breaches. Only the first five characters of a one-way (SHA-1) hash of the password are sent; the password itself, and its full hash, never leave Bidligence. Passwords are stored only as bcrypt hashes.

To stop automated abuse, sign-in, sign-up and password-reset requests are counted per network and per address for a short time (minutes to a day), stored only as keyed one-way hashes. Where a bot check is shown on a form, it is Cloudflare Turnstile, which processes your IP address and browser signals for that check only.

If you turn on two-factor sign-in, we store your authenticator key encrypted and your recovery codes only as one-way hashes, and record each use of a code with your other sign-in events. Turning it on, off, or using a recovery code is e-mailed to you.

8. Access by Bidligence staff

A small number of authorised Bidligence staff can see account and billing information — workspace and user names, e-mail addresses, plan, usage counts, payments and the credit history — to run the Service, answer support requests, prevent abuse and keep records accurate. Staff do not open the content of your bids — tender documents, priced Bills of Quantities, generated documents, Hunter 1.0 conversations, won-contract rates, or who contributed a shared rate — except to resolve a support request or a security incident. Each such access needs a recorded reason, is logged, and is e-mailed to the workspace's admins when it happens. Every staff action is recorded in an audit log that staff cannot edit.

9. Cookies and local storage

Bidligence's cookies and browser storage are listed one by one, with their purpose and how long each lasts, in the Cookie Policy at /legal/cookies. In short: strictly necessary cookies keep you signed in, protect your account and let you pay, and are always on; storage that remembers interface preferences on your device (theme, the language you read Bidligence in, the 3D view's last look) is used only if you allow it in the cookie banner, which you can change at any time from Cookie settings.

We use no advertising or analytics cookies. The Autodesk Viewer we embed for DWG sheets collects usage analytics for Autodesk by default; we switch that off. If you choose a language while signed in, it is also saved with your account so it follows you to other devices.