Privacy Policy

BidBestie is a tender search tool run by MDH Consultancy Solutions Limited, the team behind Bidsmithery. We are the data controller for the information described here. If you want anything explained, changed or deleted, email hello@bidbestie.com.

• Beta and waiting list sign ups: your email address, and for beta testers your business name, an optional website and the type of organisation you are, plus the date you gave consent and the wording you agreed to.
• Account details: if you create an account, your name, email address and password (stored scrambled, so nobody can read it), and the answers you give us about your business.
• Membership: your plan, when any free trial or free months from a code start and end, and which codes you have used.
• Saved searches and alerts: the searches you save, how often you want alert emails, and which tenders we have already emailed you about, so you never get the same one twice.
• Messages to the team: anything you send us through Help, with your name and email address so we can reply.
• How you use the tool: searches you run, opportunities you save or hide, and the feedback you give Biddy, so results get better for you.
• Talking instead of typing: if you use the microphone to search or describe your business, your browser turns your speech into words using its own speech service (Google in Chrome and Edge, Apple in Safari). We only ever receive the words, never a recording. If Biddy offers to remember something you said about your business, it is only saved if you say yes.
• Basic technical data: the usual server logs needed to keep the site working and secure.
• Payments: when payments are switched on, card payments will be handled by Stripe. We will see that you have paid and your invoices, but never your full card number.

We do not ask for or store your procurement portal logins. We never buy in lead lists.

• To provide the search, matching and personalisation features you asked for.
• To send the emails you need, such as confirming your account, resetting your password and the tender alerts you set up.
• To reply when you contact us through Help.
• To send occasional tips and updates about BidBestie. You can say no to these at any time, and every one has an unsubscribe link.
• To keep the service secure and fix problems.

Our lawful bases are your consent for marketing emails, and legitimate interests or performance of a contract for running the service itself.

To understand your searches, write the summaries of each tender and answer questions in Help, we send the words involved to an AI service (Google's Gemini models, through our hosting provider Lovable). That can include your search, what you've told us about your business and your Help question. We don't send your email address or password, and the AI never makes decisions about you. It only helps sort and explain tenders. Google processes these requests in its own data centres, mostly in the US. Neither Lovable nor Google uses your data to train AI models. Lovable may keep a record of these requests for up to 90 days, so we can look into problems.

Only the BidBestie team, plus the service providers who run parts of the service for us: Lovable (our website, which runs on Cloudflare's network, and our AI, which is Google's), Supabase (our database, stored in the European Union in Frankfurt, Germany, on Amazon Web Services), Resend (our emails) and Stripe (payments). They act on our instructions and cannot use your data for their own purposes. We do not sell your data, ever.

Account data is kept while your account is open. When you close your account from My account, it is deleted straight away. We keep only a note that your email inbox has had its free trial (stored on its own, not linked to anything else, so a trial is one per person), and, if you choose to tell us why you left, your reason without your name or email address. If you sign up but never confirm your email address, we send up to four reminders over a month and then stop. Messages you send us through Help are kept for up to 2 years so we can look back if something comes up again. Early list and beta sign up details are kept until you ask us to remove them, or up to 24 months after the last contact if you never go on to use BidBestie. Payment records are kept for as long as UK tax law requires, which is usually six years.

Your account and everything you save is stored in the European Union (Frankfurt, Germany). UK law recognises the EU as protecting personal data to the same standard as the UK, so no extra arrangements are needed for that. Data is encrypted while it travels and while it is stored, the database is backed up every day (backups are kept for about 14 days, in the same place), and only our server can read sign up records and Help messages, never anyone browsing the site. Our website and database provider, Lovable, holds SOC 2 Type II and ISO 27001 security certifications. Some providers handle data in the US: Google (for the AI), Resend (for emails) and Stripe (for payments). Where that happens, we rely on the protections UK law requires, such as the UK International Data Transfer Addendum or the UK and US data bridge.

You can ask for a copy of your data, ask us to correct or delete it, object to how we use it, or withdraw consent at any time. Every marketing email has an unsubscribe link. Email us and we will sort it within one month. If you are unhappy you can complain to the Information Commissioner's Office at ico.org.uk.

We use only the cookies and local storage needed to keep you signed in and remember your preferences. No advertising trackers.