Privacy Policy

Version 2 (draft). This must be reviewed by an Australian legal professional before launch.

1. Who we are

BidSuite is operated by Bid Suite Pty Ltd (ABN [to confirm]), based in Australia. This policy explains how we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). For privacy matters, contact support@bidsuite.com.au. [Registered business address to be added before launch.]

2. Dealing with us anonymously

Where lawful and practicable, you may deal with general enquiries to us anonymously or using a pseudonym. However, because BidSuite is an account-based service, we cannot provide the Service itself without the account information described below.

3. The information we collect

Account: email address, a securely hashed password (we never see or store your actual password), and multi-factor authentication settings.

Organisation: organisation name, members and roles, and invitations.

Business and tender information (your "Knowledge Base" and tender content): company details (legal name, ABN, ACN, addresses, contacts), insurances, licences, certifications, personnel details (names, roles, qualifications, and where you choose, Indigenous status), past projects (including referee names and contact details), subcontractors, plant and equipment, uploaded tender documents, AI analyses, drafted responses, and assembled submissions.

Billing: subscription tier and status. Card details are handled by Stripe; we do not store them.

Usage: records of AI feature use, support-chat activity (that a message was sent, not its content), and an audit log of changes.

Technical: basic technical information necessary to operate and secure the Service (see Cookies, clause 12).

4. Sensitive information

Some information you may record, in particular Indigenous status of personnel or subcontractors, is "sensitive information" under the Privacy Act, which generally requires consent to collect. We only hold such information because you choose to enter it for your tender purposes. By entering it, you confirm you have any necessary consent to provide it. You should only record sensitive information where you have a lawful basis to do so.

5. How we use your information

To provide and operate the Service: run your account, generate AI analyses and draft responses from your Knowledge Base, assemble submissions, manage your team and billing, send service communications, provide support, maintain security, and meet legal obligations. We do not sell your personal information.

6. Artificial intelligence and your content

BidSuite uses AI provided by Anthropic to analyse tender documents and draft responses. When you run an AI analysis or build a response, the relevant content, including your uploaded tender documents and Knowledge Base information (which may include staff names and referee contact details), is sent to Anthropic for processing, currently in the United States. We send only what the feature requires. Our support chat sends only the messages you type, not your tender or account data. Anthropic's current API terms state that content submitted via their API is not used to train their models; as this is a third party's commitment, you should review Anthropic's current terms directly. AI output may be inaccurate; see our Terms and Conditions regarding your responsibility to review it.

7. Direct marketing

We may send you service-related (transactional) communications necessary to operate your account. We may also, with your consent or as otherwise permitted by law, send you marketing communications about BidSuite (such as product updates or offers). You can opt out of marketing at any time using the unsubscribe link in those messages or by contacting support@bidsuite.com.au. We comply with the Spam Act 2003 (Cth) and APP 7. We will not use sensitive information for marketing without your consent.

8. Who we share your information with

We use trusted service providers, each receiving only what its function requires:

• Supabase: database, authentication, file storage.
• Anthropic: AI processing (United States).
• Vercel: application hosting.
• Resend: service and notification emails.
• Gotenberg: PDF conversion.
• Stripe: payment processing.
• Google: if you sign in with Google.

We do not otherwise disclose your information except where required or authorised by law.

9. Overseas disclosure (APP 8)

Your primary data is stored with our database provider in [DATA LOCATION TO BE FINALISED AT DEPLOYMENT: currently Mumbai, India; relocating to Sydney, Australia before public launch]. Some providers process information overseas, including in the United States (Anthropic, and our email and payment providers). Because some of this information may include personal and sensitive information and third-party contact details, we draw your attention to this overseas disclosure. By using BidSuite and entering such information, you consent to this disclosure. We take reasonable steps to ensure overseas recipients handle your information appropriately, and we remain accountable for our handling of it under the Privacy Act.

10. Third-party personal information you provide

Where your organisation enters personal information about other people (such as referees or staff), your organisation is responsible for ensuring it has the right and any necessary consent to provide that information. We handle it on your organisation's behalf to provide the Service. If an individual whose details appear in an organisation's data wishes to access or remove their information, they should contact that organisation; we will assist on request. See also the warranties and indemnity in our Terms and Conditions.

11. Your rights, retention, and deletion

Access and portability: you can download a copy of your account and organisation data at any time using "Download my data" in your settings, or request access by contacting us.

Correction: you can edit your account and Knowledge Base records at any time, or ask us to correct information.

Deletion: you can delete individual records, leave an organisation, delete your account, or (as an admin) delete an entire organisation, from within the app, with safeguards (for example, you cannot orphan an organisation as its last admin without first promoting another). When you delete your account, your identity and membership are removed; data shared with an organisation remains for its other members unless you were the sole member, in which case that organisation's data is deleted with your confirmation.

Retention: we keep your information while your account is active and as needed to provide the Service and meet legal, accounting, and security obligations. When information is no longer needed, or on account or organisation deletion, we remove it from live systems promptly. Residual copies in routine encrypted backups are purged within [backup retention period TO CONFIRM at deployment] days.

12. Cookies and analytics

We use essential cookies and similar technologies necessary to operate the Service, including to keep you securely signed in. We may use limited analytics to understand and improve how the Service is used. [Specific analytics tools to be confirmed and listed before launch; if none are used, this will state so.] We do not use cookies for third-party advertising. You can control cookies through your browser, though disabling essential cookies may prevent the Service from working.

13. Data breaches

We maintain reasonable security measures (see clause 14). In the event of a data breach that is likely to result in serious harm, we will comply with our obligations under the Notifiable Data Breaches scheme (Privacy Act Part IIIC), including notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) as required.

14. How we protect your information

Our measures include: strict per-organisation access controls so users can only access their own organisation's data; secure authentication with hashed passwords and optional multi-factor authentication; private file storage accessible only via short-lived secure links; encrypted connections (HTTPS); a tamper-resistant record distinguishing AI-generated content from human edits; and server-side protection of credentials and keys. No system is completely secure, but we take reasonable steps to protect your information.

15. Complaints

If you have a privacy concern or complaint, contact support@bidsuite.com.au. We will acknowledge your complaint promptly and aim to respond within 30 days. If you are not satisfied with our response, you may complain to the OAIC (oaic.gov.au).

16. Children

BidSuite is a business tool not intended for anyone under 18, and we do not knowingly collect information from children.

17. Changes to this policy

We may update this policy from time to time. For material changes, we will give reasonable notice (for example, by email or in-app notice). The current version and its date are always shown here; previous versions are available on request.

18. Contact

Bid Suite Pty Ltd, support@bidsuite.com.au. [Postal address to be added before launch.] For unresolved concerns: the OAIC at oaic.gov.au.