Legal ยท Last updated 15 September 2026
Data processing
When Bidroq reads your bid packages, you are the controller and we are the processor. This page is the summary an estimating office or a general contractor's security questionnaire usually needs. A signable agreement is available on request.
Subject matter and duration
We process the documents and account information described below in order to produce cited scope sheets and answer questions across your own bid history. Processing runs for as long as your account is open. Documents follow the retention schedule: a trial that does not convert stays readable and downloadable for 30 days and is then purged; paid accounts are retained for the life of the account; after cancellation, lapse or deletion by the Owner, documents are purged within 30 days and backups within 60.
Categories of data
| Category | Examples | Source |
|---|---|---|
| Bid documents | Drawings, specifications, addenda, exhibits, manufacturer sheets | Your mailbox, a portal, or upload |
| Business records | Your pricing, production rates, bid and no-bid decisions | Entered by your office |
| Contact details | Names and work email of your estimators, and of the general contractor's staff as they appear in an invitation | The documents and your account |
| Usage records | Which reads were opened, which lines were corrected | Generated in use |
We do not ask for and have no use for special-category data, payment card data, or consumer personal information.
Our obligations
We process only on your instruction and for the purposes above. Our staff are bound to confidentiality. We will help you answer a data-subject request, a regulator, or a general contractor's questionnaire. We will not engage a new subprocessor without notice and the chance for you to object.
Subprocessors
The current list, with purpose and location, is available on request and is the authoritative version. Each is bound by terms no weaker than these.
Security measures
Documents in private storage, never public and never search indexed. Tenant isolation per contractor, enforced at query time. Sign-in through Google with administrator approval on your side, so removing a leaver's Google account removes their access here.
Model providers
Producing a read means sending document text to a model provider. We select among multiple providers per step. Your account can run inside your own cloud AI account, in which case the text is processed under your own provider agreement, in your own region, and appears on your own bill.
Deletion and return
Delete a package in the product and the read goes with it. On request we will delete or return everything we hold for your account, subject to those same retention and backup windows.
Audit
Once a year, or after a breach, you can ask for the information reasonably needed to confirm we are meeting these terms.
Getting it signed
Email hello@bidroq.com with the entity name and the signer. If your customer requires their own paper, send it and we will read it before the trial starts.