PRIVACY POLICY

Last updated October 1, 2026

This Privacy Policy for BIDTRANSPARENCY LLC ("we," "us," or "our"), describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

• Visit our website at https://app.bidtransparency.com or any website of ours that links to this Privacy Policy.
• Use BidTransparency. BidTransparency is a cloud-based bid management platform for construction subcontractors. Users forward Invitation to Bid (ITB) emails to the platform, which automatically extracts bid details using AI and organizes them into a trackable dashboard. The platform sends automated follow-up emails and reminders to help users manage bid deadlines and responses. Access requires a paid monthly subscription.
• Engage with us in other related ways, including any marketing or events

You have read, agree, and accept this Privacy Policy, as well as our Terms of Service all of which forms a binding agreement (“Agreement”) between you and us. Capitalized terms contained in this Privacy Policy and not defined herein shall have the meaning ascribed to them in our terms of Service. If you do not agree to this Privacy Policy, you agree that you will not use our Site. The Company reserves the right to change this Privacy Policy at any time and will post such changes via our Site. If you do not agree to the amended Privacy Policy, you agree to stop using our Site. You will be deemed to have accepted the amended Privacy Policy if you continue to use our Site after such changes have been made. Any changes will be effective immediately upon the posting the new date and we will not send you a separate notice of changes so it is up to you to check back often to see if we have made changes and changed the date appearing above.

Communications From Us

To improve our Services, we may ask users to complete surveys that we use for research purposes, although users do not have to respond to them. We may periodically send users information regarding our Site, updates, promotional emails, special offers, or other information which we think users may find interesting. In such cases we will use the email address you provided to us and which you agree we may send emails to for such purposes. We will also use your information to respond to requests you may make of us. We may also refer to your information to better understand your needs and how we can improve our Site. You may opt-out of receiving promotional materials by following the opt-out instructions contained in the materials or by emailing Company at support@bidtransparency.com.

Questions or concerns? Reading this Privacy Policy will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at support@bidtransparency.com.

SUMMARY OF KEY POINTS

This summary provides key points from our Privacy Policy, but you can find out more details about any of these topics by clicking the link following each key point or by using our table of contents below to find the section you are looking for.

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use. Learn more about personal information you disclose to us.

Do we process any sensitive personal information? Some of the information may be considered "special" or "sensitive" in certain jurisdictions, for example your racial or ethnic origins, sexual orientation, and religious beliefs. We do not process sensitive personal information.

How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. We process your information only when we have a valid legal reason to do so. Learn more about how we process your information.

In what situations and with which parties do we share personal information? We may share information in specific situations and with specific third parties. Learn more about when and with whom we share your personal information.

How do we keep your information safe? We have adequate organizational and technical processes and procedures in place to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Learn more about how we keep your information safe.

What are your rights? Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information. Learn more about your privacy rights.

How do you exercise your rights? The easiest way to exercise your rights is by sending an email to support@bidtransparency.com, or by contacting us. We will consider and act upon any request in accordance with applicable data protection laws.

Want to learn more about what we do with any information we collect? Review the Privacy Policy in full.

TABLE OF CONTENTS

1. WHAT INFORMATION DO WE COLLECT?

2. HOW DO WE PROCESS YOUR INFORMATION?

3. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

4. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

5. DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?

6. HOW LONG DO WE KEEP YOUR INFORMATION?

7. HOW DO WE KEEP YOUR INFORMATION SAFE?

8. DO WE COLLECT INFORMATION FROM MINORS?

9. WHAT ARE YOUR PRIVACY RIGHTS?

10. CONTROLS FOR DO-NOT-TRACK FEATURES

11. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

12. THIRD-PARTY CONTACT INFORMATION IN FORWARDED EMAILS

13. CUSTOMER-DIRECTED COMMUNICATIONS, LINKS, INTEGRATIONS, AND CALENDAR FEEDS

14. AGGREGATED, DE-IDENTIFIED, AND PUBLIC BID INFORMATION

15. WHAT RIGHTS DO CALIFORNIA RESIDENTS HAVE UNDER THE “SHINE THE LIGHT” LAW?

16. DO WE MAKE UPDATES TO THIS NOTICE?

17. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

18. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following, including when included in forwarded emails, bid records, integration connections, calendar feeds, or communications sent through the Services:

• names
• email addresses
• contact preferences
• contact or authentication data
• bid-related project details, contacts, dates, values, statuses, notes, links, and email content
• Payment Data. If you choose to make purchases, payment card details are collected and processed through Stripe’s hosted checkout and billing portal and do not reach or reside on our systems. We store only Stripe identifiers and subscription status needed to administer billing. All payment data is handled and stored by Stripe. You may find their Privacy Policy link(s) here: https://stripe.com/privacy.
• integration credentials or authorizations you provide for systems you choose to connect
• Stripe customer, payment, and subscription identifiers

Sensitive Information. We do not process sensitive information.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To facilitate account creation and authentication and otherwise manage user accounts. We may process your information so you can create and log in to your account, as well as keep your account in working order.
• To deliver and facilitate delivery of services to the user. We may process your information to provide you with the requested service.
• To respond to user inquiries/offer support to users. We may process your information to respond to your inquiries and solve any potential issues you might have with the requested service.
• To send administrative information to you. We may process your information to send you details about our products and services, changes to our terms and policies, and other similar information.
• To request feedback. We may process your information when necessary to request feedback and to contact you about your use of our Services.
• To protect our Services. We may process your information as part of our efforts to keep our Services safe and secure, including fraud monitoring and prevention.
• To evaluate and improve our Services, products, marketing, and your experience. We may process your information when we believe it is necessary to identify usage trends, determine the effectiveness of our promotional campaigns, and to evaluate and improve our Services, products, marketing, and your experience.
• To comply with our legal obligations. We may process your information to comply with our legal obligations, respond to legal requests, and exercise, establish, or defend our legal rights.
• To process forwarded emails using artificial intelligence to extract and organize bid information. Forwarded email content is processed by third-party AI services, including the Gemini developer API, to automatically extract bid details such as project names, due dates, links, and contact information.
• Marketing: We may process your information to send you marketing and promotional communications about our Services, updates, and offers that may be of interest to you, and to measure engagement with those communications. You may opt out of promotional emails at any time by following the unsubscribe instructions in those emails or by contacting us at support@bidtransparency.com. If you opt out, we may still send you non-promotional communications, such as service-related, account-related, or security notices. 

3. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We may share information in specific situations described in this section and/or with the following third parties.

Vendors, Consultants, and Other Third-Party Service Providers. We may share your data with third-party vendors, service providers, contractors, or agents ("third parties") who perform services for us or on our behalf and require access to such information to do that work. References to third parties in this section also include recipients and systems to whom information is sent at your direction through the Services. We have contracts in place with our service providers, which are designed to help safeguard your personal information. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will also not share your personal information with any organization apart from us. They also commit to protect the data they hold on our behalf and to retain it for the period we instruct.

The third parties we may share personal information with are as follows:

• AI Service Providers

Google Gemini developer API

• Invoice and Billing

Stripe

• User Account Registration and Authentication

Clerk

• Site Hosting

Vercel

• Email Delivery and Processing

Resend

• Database and Data Storage

MongoDB Atlas

We also may need to share your personal information in the following situations:

• Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
• Customer-Directed Transfers and Integrations. If you enable an integration, connector, calendar feed, bid-decision notification, or other sharing feature, we may transfer the applicable bid records, project details, contacts, dates, values, statuses, notes, links, recipient lists, messages, and related information to the recipients or systems you or an authorized user direct. Those recipient systems and recipients are not our service providers for that customer-directed transfer, and their handling of the information is governed by your relationship with them, not by this Privacy Policy.
• Internal Access. Our personnel may access customer data, including bid records, forwarded emails, raw email text, failed parses, contact details, messages, and system logs, when reasonably necessary to provide support, operate, secure, troubleshoot, improve, or administer the Services.

From time to time, your personally identifiable information (“PII”) and business financial information (“Financial Information”). We will never share such Financial Information with third parties other than those third parties such as payment facilitators, banks, processing gateways, financial intermediaries, and merchant processors required to process and facilitate the sending and receiving of payments, and you understand that we cannot control how these third parties will use such Financial Information to perform their services to facilitate payments. Therefore, you hereby consent to such sharing of Financial Information. You agree to assume the risk and agree that it is your responsibility to properly handle, secure, not store and destroy such Financial Information as may be necessary to protect it from misuse. You hereby consent to such sharing of Financial Information and hold us harmless and indemnify us from any claims, breaches, loss, or damage resulting from the use of those payment facilitators, banks, processing gateways, financial intermediaries, and merchant processors we use. You agree we shall not be liable to you or any third party for misuse of such Financial Information. The actual credit card details never reach our servers but only pass through to our payment facilitator. We are only permitted to see the information in an anonymized manner and the full details are encrypted.

Under What Other Circumstances May We release PII?

We will not disclose, sell, distribute, rent, lease or use any of a user’s PII or Financial Information, or pass on any such PII or Financial Information to third parties, which are not our officers, directors, members, managing members, employees, business partners, affiliates, strategic partners, licensors, licensees, independent contractors, third party service providers, agents, representatives, recipients or systems designated through customer-directed transfers, unless we have Your permission, the disclosure is made to provide or operate the Services, or we are required by law to do so.

What We Don’t do with the Information We Gather:

We will not disclose, sell, distribute, rent, lease or use any of a user’s PII or Financial Information, or pass on any such PII or Financial Information to third parties, which are not our officers, directors, members, managing members, employees, business partners, affiliates, strategic partners, licensors, licensees, independent contractors, third party service providers, agents or representatives, unless we have Your permission or are required by law to do so.

We do not store your credit card information. The credit card information and actual processing does not take place on and is not stored on our servers. The transaction is processed on the servers of the particular credit card processor we use to process the transaction.

In Short: We use essential authentication cookies, hosting platform cookies, server logs, and limited tracking for marketing communications.

We use cookies and similar technologies that are necessary to maintain the security of our Services and your account, authenticate users, prevent crashes, fix bugs, save preferences, and assist with basic site functions. These include authentication cookies set by our identity provider and cookies or logs set by our hosting platform.

4. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: We may use cookies and other tracking technologies to collect and store your information.

We may use cookies and similar tracking technologies (like web beacons and pixels) to gather information when you interact with our Services. Some online tracking technologies help us maintain the security of our Services and your account, prevent crashes, fix bugs, save your preferences, and assist with basic site functions.

We also permit third parties and service providers to use online tracking technologies on our Services for analytics purposes to help us understand and improve how our Services are used.

To the extent these online tracking technologies are deemed to be a "sale"/"sharing" (which includes targeted advertising, as defined under the applicable laws) under applicable US state laws, you can opt out of these online tracking technologies by submitting a request as described below under section "DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?"

Automatically Collected Information

Whenever you interact with our Site, we automatically receive and record information on our server logs from your browser or device, which may include your IP address, geolocation data, device identification, “cookie” information, the type of browser and/or device you are using to access our Site, and the page or feature you requested. “Cookies” are identifiers we transfer to your browser or device that allow us to recognize your browser or device and tell us how and when pages and features on our Site are visited and by how many people. Cookies and similar tracking technologies, such as beacons, scripts, web beacons and tags (which together we refer to as “cookies”), are small bits of text, usually stored on a user's computer hard drive or within a browser. They enable our Site to remember information about the user's visit to our Site. On mobile websites and mobile applications, we use device IDs and / or Advertising IDs in a similar manner to which we use cookies. You can find more information about cookies at: www.allaboutcookies.org or www.youronlinechoices.eu.

The types of cookies we may use include but are not limited to:

Session Cookies. These are cookies which expire once you close your web browser.

Persistent Cookies. These are cookies which stay on your desktop or mobile device for a specific period of time or until you delete them from your device.

First-party cookies. These are cookies that are set by our Site when you visit, or by a third party at our request.

Third-party cookies. These are cookies that are set by a third-party other than that of the website you are visiting. If you visit our Site and another party sets a cookie through that website this would be considered a third-party cookie.

Essential cookies are sometimes called “strictly necessary” because without the use of this type of cookie we cannot provide many of the services that you need to use our Site. They are usually only set in response to actions made by you related to a request for Services or to use various features on our Site. For example, essential cookies help remember your preferences, such as setting your privacy preference or logging in, as you move around our Site and use its features.

We may receive confirmation when you open, click, or bounce a sales or marketing email from Us. This tracking is used for our outbound sales and marketing communications and is not enabled for product transactional emails such as bid confirmations, reminders, or follow-ups.

You may be able to change the preferences on your browser or device to prevent or limit your device’s acceptance of cookies. Most web browsers automatically accept cookies, but you can usually modify your browser settings to decline them. Should you choose to decline cookies, you may be unable to access certain information or parts of our Site, and some or all of the Services may not work properly. Please refer to your device’s settings to make those changes.

We may receive confirmation when you open an email from Us. This confirmation helps us make our communications with you more interesting and improve our Site, features, Content, and Services.

We may use this data to customize Content for you that we think you might like, based on your usage patterns. We may also use it to improve the Site – for example, this data can tell Us how often Users view particular Content or use a particular feature or Service offered though our Site, and we can use that knowledge to make improvements.

We do not collect GPS location, camera or photo access, Bluetooth signals, nearby Wi-Fi access points or cell tower information, battery level, mouse movements, or other device-sensor data through the Services.

• Device attributes: information such as the operating system your device uses, hardware and software versions, battery level, signal strength, available storage space, browser type, application and file names and types, and device plugins.

• Identifiers: unique identifiers, device IDs, and other identifiers, that may be available from games, apps or accounts you use, and family device IDs (or other identifiers unique to our products and services associated with the same device or account).

• Server Logs: Our systems and hosting providers may maintain server, application, database, and exception logs needed to operate, secure, and troubleshoot the Services.

• Cookies: We may use essential authentication cookies and secure tokens needed to keep users logged in and to operate the Services.

5. DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?

In Short: We offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies.

As part of our Services, we offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies (collectively, "AI Products"). These tools are designed to enhance your experience and provide you with innovative solutions. The terms in this Privacy Policy govern your use of the AI Products within our Services.

Use of AI Technologies

We provide the AI Products through third-party service providers ("AI Service Providers"), including the Gemini developer API. As outlined in this Privacy Policy, your input, output, and personal information will be shared with and processed by these AI Service Providers to enable your use of our AI Products for purposes outlined in "WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?" You must not use the AI Products in any way that violates the terms or policies of any AI Service Provider.

Our AI Products

Our AI Products are designed for the following functions:

• Text analysis

How We Process Your Data Using AI

All personal information processed using our AI Products is handled in line with our Privacy Policy and our agreement with third parties. This ensures high security and safeguards your personal information throughout the process, giving you peace of mind about your data's safety.

6. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Policy unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Policy, unless a longer retention period is required or permitted by law (such as tax, accounting, security, backup, dispute-resolution, or other legal requirements). No purpose in this notice will require us keeping your personal information for longer than twenty-four (24) months past the termination of the user's account.

When we have no ongoing legitimate business need to process your personal information, or when you submit a valid deletion request that we are required to honor, we will either delete or anonymize such information according to our deletion processes. If deletion is not then possible, we will securely store the information and isolate it from further processing until deletion is possible.

7. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We aim to protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

Security Incidents. If we determine that a security breach involving personal information has occurred, we will investigate, take reasonable measures to secure affected systems, and provide notices to affected individuals, regulators, and others when and as required by applicable law, including Connecticut law where applicable. Notices may describe the incident, the information involved, steps we have taken, and steps affected individuals may take to protect themselves.

8. DO WE COLLECT INFORMATION FROM MINORS?

In Short: We do not knowingly collect data from or market to children under 18 years of age.

We do not knowingly collect, solicit data from, or market to children under 18 years of age, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18 or that you are the parent or guardian of such a minor and consent to such minor dependent’s use of the Services. If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at support@bidtransparency.com.

9. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: You may review, change, or terminate your account at any time, depending on your country, province, or state of residence.

Withdrawing your consent: If we are relying on your consent to process your personal information, which may be express and/or implied consent depending on the applicable law, you have the right to withdraw your consent at any time. You can withdraw your consent at any time by contacting us by using the contact details provided in the section "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?" below.

However, please note that this will not affect the lawfulness of the processing before its withdrawal nor, when applicable law allows, will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent.

Account Information

If you would at any time like to review or change the information in your account or terminate your account, you can:

• Log in to your account settings and update your user account.

Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms and/or comply with applicable legal requirements.

Cookies and similar technologies: Most Web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove cookies and to reject cookies. If you choose to remove cookies or reject cookies, this could affect certain features or services of our Services.

If you have questions or comments about your privacy rights, you may email us at support@bidtransparency.com.

10. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Policy.

California law requires us to let you know how we respond to web browser DNT signals. Because there currently is not an industry or legal standard for recognizing or honoring DNT signals, we do not respond to them at this time.

11. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and receive details about the personal information we maintain about you and how we have processed it, correct inaccuracies, get a copy of, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. More information is provided below.

Categories of Personal Information We Collect

The table below shows the categories of personal information we have collected in the past twelve (12) months. The table includes illustrative examples of each category and does not reflect the personal information we collect from you. For a comprehensive inventory of all personal information we process, please refer to the section "WHAT INFORMATION DO WE COLLECT?"

Category	Examples	Collected
A. Identifiers	Contact details, such as real name, alias, postal address, telephone or mobile contact number, unique personal identifier, online identifier, Internet Protocol address, email address, and account name	YES
B. Personal information as defined in the California Customer Records statute	Name, contact information, education, employment, employment history, and financial information	YES
C. Protected classification characteristics under state or federal law	Gender, age, date of birth, race and ethnicity, national origin, marital status, and other demographic data	NO
D. Biometric information	Fingerprints and voiceprints	NO
E. Audio, electronic, sensory, or similar information	Images and audio, video or call recordings created in connection with our business activities	NO
F. Professional or employment-related information	Business contact details in order to provide you our Services at a business level or job title, work history, and professional qualifications if you apply for a job with us	NO
G. Education Information	Student records and directory information	NO
H. Inferences drawn from collected personal information	Inferences drawn from any of the collected personal information listed above to create a profile or summary about, for example, an individual’s preferences and characteristics	NO
I. Sensitive personal Information		NO

We may also collect other personal information outside of these categories through instances where you interact with us in person, online, or by phone or mail in the context of:

• Category A - Duration of account plus 24 months after termination
• Category B - Duration of account plus 24 months after termination
• Facilitation in the delivery of our Services and to respond to your inquiries.

We will use and retain the collected personal information as needed to provide the Services or for:

• Category A - Duration of account plus 24 months after termination
• Category B - Duration of account plus 24 months after termination

Sources of Personal Information

Learn more about the sources of personal information we collect in "WHAT INFORMATION DO WE COLLECT?"

How We Use and Share Personal Information

Learn more about how we use your personal information in the section, "HOW DO WE PROCESS YOUR INFORMATION?"

Will your information be shared with anyone else?

We may disclose your personal information with our service providers pursuant to a written contract between us and each service provider. Learn more about how we disclose personal information to in the section, "WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?"

We may use your personal information for our own business purposes, such as for undertaking internal research for technological development and demonstration. This is not considered to be "selling" of your personal information.

We have not sold or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months. We have disclosed the following categories of personal information to third parties for a business or commercial purpose in the preceding twelve (12) months:

• Category A. Identifiers
• Category B. Personal information as defined in the California Customer Records law

The categories of third parties to whom we disclosed personal information for a business or commercial purpose can be found under "WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?"

Your Rights

You have rights under certain US state data protection laws. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law. These rights include:

• Right to know whether or not we are processing your personal data
• Right to access your personal data
• Right to correct inaccuracies in your personal data
• Right to request the deletion of your personal data
• Right to obtain a copy of the personal data you previously shared with us
• Right to non-discrimination for exercising your rights
• Right to opt out of the processing of your personal data if it is used for targeted advertising (or sharing as defined under California’s privacy law), the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects ("profiling")

Depending upon the state where you live, you may also have the following rights:

• Right to access the categories of personal data being processed (as permitted by applicable law, including the privacy law in Minnesota)
• Right to obtain a list of the categories of third parties to which we have disclosed personal data (as permitted by applicable law, including the privacy law in California, Delaware, and Maryland)
• Right to obtain a list of specific third parties to which we have disclosed personal data (as permitted by applicable law, including the privacy law in Minnesota and Oregon)
• Right to obtain a list of third parties to which we have sold personal data (as permitted by applicable law, including the privacy law in Connecticut)
• Right to review, understand, question, and depending on where you live, correct how personal data has been profiled (as permitted by applicable law, including the privacy law in Connecticut and Minnesota)
• Right to limit use and disclosure of sensitive personal data (as permitted by applicable law, including the privacy law in California)
• Right to opt out of the collection of sensitive data and personal data collected through the operation of a voice or facial recognition feature (as permitted by applicable law, including the privacy law in Florida)

How to Exercise Your Rights

To exercise these rights, you can send an email to support@bidtransparency.com, or refer to the contact details at the bottom of this document.

Under certain US state data protection laws, you can designate an authorized agent to make a request on your behalf. We may deny a request from an authorized agent that does not submit proof that they have been validly authorized to act on your behalf in accordance with applicable laws.

Request Verification

Upon receiving your request, we will need to verify your identity to determine you are the same person about whom we have the information in our system. We will only use personal information provided in your request to verify your identity or authority to make the request. However, if we cannot verify your identity from the information already maintained by us, we may request that you provide additional information for the purposes of verifying your identity and for security or fraud-prevention purposes.

If you submit the request through an authorized agent, we may need to collect additional information to verify your identity before processing your request and the agent will need to provide a written and signed permission from you to submit such request on your behalf.

Appeals

12. THIRD-PARTY CONTACT INFORMATION IN FORWARDED EMAILS

Third-Party Contact Information in Forwarded Emails. When users forward Invitation to Bid emails to our platform, those emails may contain personal information of third parties, such as names and email addresses of general contractor contacts. This information is extracted and stored as part of the bid record to facilitate bid tracking and follow-up communications. We do not use third-party contact information for any purpose other than providing our Services to the user who forwarded the email, except as otherwise described for customer-directed bid-decision notifications, integrations, calendar feeds, and similar features.

13. CUSTOMER-DIRECTED COMMUNICATIONS, LINKS, INTEGRATIONS, AND CALENDAR FEEDS

Bid-Decision Notifications. Certain customers may enable automatic follow-up features that allow a general contractor or other recipient to click a signed link, update a bid outcome, and submit email addresses of other subcontractors who bid the same project so that the Services can send an individual notification on that recipient’s behalf. We may store the recipient list, message, sending recipient’s details, delivery records, and related email logs. These messages may identify the sender as the general contractor or other recipient via BidTransparency, route replies to that sender, and include information about BidTransparency. Where required or appropriate, we may provide an unsubscribe or suppression mechanism for commercial messages sent through this feature.

Non-User Link Actions. Non-users who receive signed links may interact with pages we operate and may change information in a customer’s account or trigger customer-directed communications without creating an account. We process information submitted through those pages to provide the requested feature, maintain records, prevent abuse, and comply with law.

Customer Links and External Materials. The Services may allow customers to store or send links or URLs to drawings, specifications, plan rooms, folders, or other external materials. We store the link but do not host, access, review, control, or verify the materials available at that address and cannot revoke access to a link after it has been sent or forwarded. Customers are responsible for ensuring they have the right to share both the link and the materials behind it.

Integrations and Connectors. If a customer administrator connects an enterprise system or authorizes credentials for a system the customer already licenses, bid data may flow between the Services and that system in one or both directions at the customer’s direction. The receiving system’s handling of that data is outside our control and governed by the customer’s own agreement with that vendor.

Calendar Feeds. If you enable a calendar feed, the feed may be served from a web address containing a long random token. Anyone with that address may be able to read the bid-list information exposed in the feed, such as project names, general contractors, and due dates, without logging in. You are responsible for controlling access to that address and may regenerate the token if you need to revoke the prior feed link.

14. AGGREGATED, DE-IDENTIFIED, AND PUBLIC BID INFORMATION

We may use information processed through the Services to create aggregated or de-identified data that does not identify you or any individual, and we may use that data to operate, improve, analyze, benchmark, or develop the Services and related market statistics. We may also collect, process, display, or analyze publicly available government procurement records, bid tabulations, notices of award, and similar public bid information. Public bid information may be incomplete, delayed, inaccurate, or subject to change, and you should not rely on it as the sole source for any bidding, business, or legal decision.

15. WHAT RIGHTS DO CALIFORNIA RESIDENTS HAVE UNDER THE “SHINE THE LIGHT” LAW?

California Civil Code Section 1798.83, also known as the "Shine The Light" law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us by using the contact details provided in the section "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?"

16. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Policy from time to time. The updated version will be indicated by an updated "Last updated" date at the top of this Privacy Policy. If we make material changes to this Privacy Policy, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Policy frequently to be informed of how we are protecting your information.

17. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, you may email us at support@bidtransparency.com or contact us by post at:

HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

55 N. Main Street

Middletown, CT 06457

United States

18. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

Based on the applicable laws of your country or state of residence in the US, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. To request to review, update, or delete your personal information, please send an email to support@bidtransparency.com.