Privacy Policy
- Version
- 1.1
- Last updated
- 20 September 2026
How Bidfill AI collects, uses, shares and protects your personal data, and the rights you have over it.
1. Who we are
Bidfill AI is a product of Bame Consult Ltd, a company registered in England and Wales. Bame Consult Ltd is the data controller for the personal data described in this policy, which means we decide why and how it is processed.
If you have a question about this policy or about how we handle your data, contact us through our contact page.
2. What this policy covers
This policy covers the Bidfill AI web application and the marketing site at the same domain. It explains what we collect, why, how long we keep it, who we share it with and what rights you have.
It does not cover the buyer portals you submit finished applications to. Those are operated by the contracting authorities themselves and have their own privacy notices.
3. Personal data we collect
We collect the following, all of it either given by you or generated by your use of the service:
| Category | Examples | Source |
|---|---|---|
| Account | First and last name, email address, password (stored only as a hash) | You, at sign-up |
| Company profile | Registered and trading name, Companies House number, registered address, SIC code, trading status, employee and turnover bands, sectors, ICO registration number, website address | You, during onboarding; some fields prefilled from Companies House |
| Contact details | Primary contact name, role, email and phone for tender submissions | You |
| Compliance declarations | Your answers to the twelve mandatory and discretionary exclusion questions under Regulation 57 of the Public Contracts Regulations 2015 | You |
| Documents | Files you upload — policies, insurance certificates, accounts, case studies — and their filenames | You |
| Application content | The text of your bid responses, including AI-generated drafts and your edits | You and our AI features |
| Website content | Text retrieved from the company website address you give us, used to make drafts sound like you | Your public website |
| Billing | Subscription plan, status, renewal date and payment outcomes | Stripe |
| Usage | Sign-in times, actions taken in the product, and errors encountered | Generated automatically |
We do not ask for special category data. Please do not upload documents containing health, biometric or similar sensitive information about individuals; if you do, you are responsible for having a lawful basis to share it with us.
We never collect or store your bank details. Card payments are handled entirely by Stripe and never reach our servers. Bank account details for a tender are added by you to the exported document or the buyer's portal, not in Bidfill.
4. Why we process it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Creating and running your account, and providing the features you have signed up for | Performance of a contract |
| Scoring opportunities and drafting bid content from your profile | Performance of a contract |
| Taking payment and managing your subscription | Performance of a contract |
| Sending service emails — welcome, subscription confirmations, deadline reminders, payment problems | Performance of a contract |
| Keeping the service secure, investigating misuse and diagnosing faults | Legitimate interests, being the interest in a service that works and is not abused |
| Improving the product by understanding which features are used | Legitimate interests, being the interest in improving what we offer |
| Keeping records of payments taken | Legal obligation, under UK tax law |
| Sending marketing emails, if we introduce them | Consent, which you can withdraw at any time |
5. Artificial intelligence and your content
Several features send your content to Anthropic, our AI provider, to generate a response: eligibility scoring, bid section drafting, the per-bid document checklist and policy drafting. What is sent is your company profile, the relevant tender text and, where applicable, the section you are working on.
Anthropic processes this on our behalf as a processor under contract. Content submitted through their API is not used to train their models.
AI output is a draft, not advice. It can be wrong, out of date or unsuitable for a particular tender. You are responsible for checking everything before you submit it. See section 8 of our terms of service.
6. Who we share it with
We do not sell personal data and we do not share it for anyone else's marketing. We use the following processors to run the service:
| Processor | What they do | What they receive |
|---|---|---|
| Supabase | Database, file storage and authentication | All account, profile, document and application data |
| Vercel | Application hosting | Request data, including IP address, in the course of serving pages |
| Stripe | Payment processing and subscription billing | Your email address and payment details, which you give to Stripe directly |
| Anthropic | AI scoring and drafting | Company profile, tender text and bid content, as described in section 5 |
| Resend | Sending service emails | Your email address, name and the content of the email |
We also send outbound requests to Companies House, Find a Tender and Contracts Finder to retrieve public information. These are lookups of public records; we do not send them your personal data beyond a company number you have asked us to look up.
We may disclose personal data if we are legally required to, or to establish or defend legal claims.
7. International transfers
Some of our processors operate outside the UK, including in the United States. Where personal data leaves the UK we rely on the UK International Data Transfer Addendum to the European Commission's standard contractual clauses, or on UK adequacy regulations where they apply, so that your data keeps an equivalent level of protection.
8. How long we keep it
| Data | Retention |
|---|---|
| Account, profile, documents, applications and eligibility checks | For as long as your account is open |
| Everything above, after you delete your account | Deleted immediately from our active systems |
| Records of payments taken | Seven years from the end of the relevant financial year, as UK tax law requires |
| Activity and audit logs | Up to 90 days, except records of payments taken |
| Security counters used for rate limiting | Up to 25 hours |
| Opportunity data from government sources | Retained as reference data; it is public information and contains no personal data about you |
When you request account deletion, your personal data is deleted immediately from our active systems. Payment records are retained for 7 years as required by law.
Those payment records are no longer linked to your account once it is deleted. The email address on them is retained, because a financial record has to identify who paid.
9. Deleting your account
You can delete your account yourself at any time from your settings page. Deletion happens immediately, is permanent, and cannot be undone.
Deleting your account will:
- Cancel any paid subscription immediately, so you are not charged again
- Remove every file you have uploaded, and every document we generated for you
- Remove your company profile, compliance declarations, applications and eligibility checks
- Remove your login, so you are signed out and cannot sign back in
Export anything you want to keep before you delete. We cannot recover it afterwards.
10. Your rights
Under the UK GDPR you have the right to:
- Be told what we hold about you and get a copy of it
- Have inaccurate data corrected
- Have your data erased, which you can do yourself from settings
- Restrict how we process it, or object to processing based on legitimate interests
- Receive the data you gave us in a portable format
- Withdraw consent at any time, where we rely on consent
To exercise any of these, contact us. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.
11. Security
Data is encrypted in transit and at rest. Access to your data is restricted at the database level, so one customer's records cannot be read by another. Uploaded files are stored in a private bucket and are reachable only through short-lived links issued to you.
Administrative access is limited to staff who need it and is logged. No system is perfectly secure; if a breach occurs that is likely to risk your rights and freedoms, we will tell the Information Commissioner's Office within 72 hours and tell you without undue delay.
12. Cookies
We use only the cookies needed to keep you signed in and to run the service. We do not use advertising cookies. Full details are in our cookie policy.
13. Children
Bidfill AI is a business tool and is not intended for anyone under 18. We do not knowingly collect data about children. If you believe a child has given us personal data, contact us and we will delete it.
14. Changes and complaints
We may update this policy. The version number and date at the top of this page always reflect the current version, and we will tell you about material changes by email before they take effect.
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk.