Effective date: July 30, 2026
This Privacy Policy describes how BidForge ("BidForge," "we," "us," or "our") collects, uses, discloses, and protects information in connection with the BidForge platform at bid-forge.com (the "Service"). This policy applies to account holders and authorized users of the Service. It does not apply to third-party sites we may link to.
When you register, we collect your name, email address, phone number (if provided), company name, and a hashed password. We never store your password in plain text.
We collect the solicitations, drawings, specifications, wage determinations, pricing worksheets, past performance references, company licensing/insurance details, and other documents or data you upload or enter to use the Service (collectively, "Customer Content").
We automatically collect information about how you use the Service, including pages visited, features used, timestamps, IP address, browser and device type, and similar diagnostic and audit-log data, so we can operate, secure, and improve the Service.
When you subscribe, payment is processed by our payment processor, Stripe. Your card number and other sensitive payment credentials are entered directly into Stripe's systems and never touch BidForge's servers. We receive and store only limited billing metadata from Stripe, such as your subscription plan, status, and the last four digits of your card, for account management purposes.
We use the information described above to:
We share information with the following categories of service providers ("subprocessors"), each engaged solely to help us provide the Service, and each bound by contract to protect your information and use it only for the purpose we specify:
| Subprocessor | Role |
|---|---|
| Stripe | Payment processing and subscription billing. Handles your card details directly; BidForge never receives or stores full card numbers. |
| Anthropic | Large-language-model processing of solicitation and document text to extract scope, generate cost estimates, and draft bid package narratives. |
| DigitalOcean | Cloud hosting infrastructure — the servers and database that run the Service. |
| Cloudflare | Content delivery network, DNS, and edge security (DDoS mitigation, TLS termination) in front of our servers. |
| SAM.gov / USASpending.gov | Public U.S. government data sources we query to retrieve solicitation listings and federal award/spending records. These are read-only public data sources, not vendors we transmit your Customer Content to. |
We do not sell access to Customer Content to any subprocessor for their own independent use, and we require each subprocessor to use the data we share only to perform the service they provide us.
Account data is retained for as long as your account remains active, and for 90 days after account closure, to allow for reactivation, dispute resolution, and legal/accounting recordkeeping, after which it is deleted or anonymized except where longer retention is required by law.
Uploaded documents and generated Outputs are retained until you delete them within the Service or until your account is closed, plus a 90-day grace period following closure, after which they are permanently deleted from active systems (residual copies may persist briefly in encrypted backups until those backups age out).
You may request a copy of the personal data we hold about you, request that we correct inaccurate data, or request that we delete your account and associated data. To make a request, email [email protected] from the email address on your account. We will honor verified requests within 30 days, except where we are required or permitted by law to retain certain records (for example, billing records needed for tax purposes).
We do not sell your personal data to third parties, and we do not share your personal data with third parties for their own independent marketing purposes.
We apply industry-standard technical and organizational safeguards to protect your information, including: encryption in transit via TLS between your browser and our servers; a locked-down origin (Cloudflare origin authentication so our servers only accept traffic that has passed through our edge network); bcrypt password hashing (we never store plain-text passwords); and a tamper-evident audit log of account activity. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security, but we work to keep these protections current.
If we become aware of a security incident that compromises your personal data in a way that requires notice under applicable law, we will notify affected account holders without undue delay and provide information about the nature of the incident and steps we are taking in response, consistent with our legal obligations.
The Service is intended for business use by contractors and their authorized personnel. It is not directed to, and we do not knowingly collect personal information from, anyone under 18 years of age. If we learn that we have collected information from someone under 18, we will delete it.
We may update this Privacy Policy from time to time. If we make a material change, we will provide notice — such as by email to the address on your account or a notice within the Service — before the change takes effect. The "Effective date" at the top of this page reflects the date of the most recent revision.
Questions about this Privacy Policy, or requests to access, correct, export, or delete your data, may be directed to [email protected].