Privacy Policy for BidCrunch

1. WHO WE ARE

Bidcrunch ("we", "our", or "us") is the data controller for the personal data collected through the BidCrunch web application. This means we decide how and why your personal data is processed. This Privacy Policy explains what we collect, why, and the rights you have under the UK GDPR.

2. DATA WE COLLECT

• Account Information: your name, email address, business name and main trade when you sign up.
• Project Data: postcodes, trade selections, measurements, and the blueprint files you upload.
• Usage Data: how you use the app, device identifiers and IP address, used for security and product improvement.
• Payment Information: all payments are processed securely by Paddle, our Merchant of Record. We do not store your card details on our servers.

3. HOW WE USE YOUR DATA & LEGAL BASIS

• Providing the service (account creation, takeoffs, bid generation) — legal basis: performance of our contract with you.
• Security and fraud prevention — legal basis: our legitimate interests.
• Improving the product (including improving our calculation algorithms) — legal basis: our legitimate interests.
• Customer support — legal basis: performance of our contract with you.

We do not sell your personal or project data to third parties.

4. WHO WE SHARE DATA WITH

• Paddle, our Merchant of Record, for the sale of subscriptions, payment processing, tax compliance and invoicing.
• Service providers who host and operate the app (cloud hosting and infrastructure providers).
• Professional advisers (legal, accounting) where needed.
• Authorities where required by law.

Where data is transferred outside the UK/EEA, we rely on appropriate safeguards such as adequacy decisions or standard contractual clauses.

5. DATA RETENTION

We keep your personal data for as long as your account is active. If you close your account, we delete or anonymise your personal data within 12 months, except where we must keep records longer to meet legal or tax obligations.

6. SECURITY

We protect your data with appropriate technical and organisational measures, including encryption in transit, access controls, and row-level isolation so each company can only see its own data.

7. COOKIES

We use essential cookies only — the ones needed to keep you signed in and keep the app secure. We do not use advertising or marketing cookies. You can control cookies through your browser settings.

8. YOUR RIGHTS UNDER UK GDPR

You have the right to access, correct, delete, restrict or port your personal data, to object to processing, and to withdraw consent where processing is based on consent. To exercise any of these rights, contact us through the application. We respond within one month. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority.