Privacy Policy

Last updated: 17 September 2026

BidSkim ("we", "us", "our") is operated by BidSkim Limited. This privacy policy explains how we collect, use, and protect your personal data when you use our website at bidskim.com and our tender alert service.

1. What data we collect

Account data

When you sign up, we collect:

• Email address
• Password (stored securely using bcrypt hashing, we never store your plain text password)
• Company name and description
• Region preferences and certifications

Research dataset requests

If you request a research dataset, we collect your work or education email, organisation and selected research purpose. We send a requested access link using Resend. We record the release requested, delivery status, an IP-address hash, access expiry and download count to provide access and prevent abuse. We use these details for our legitimate interests in fulfilling research requests and protecting the service. We do not use a dataset request to enrol you in marketing. Access links expire after 72 hours. Request records are deleted after 90 days by daily housekeeping; operational backups follow our backup retention cycle. A necessary, secure access cookie lasts up to 72 hours. The download page has no analytics. Contact [email protected] to request deletion or object to this processing.

Usage data

With your consent, we use Google Analytics 4 and PostHog to understand how BidSkim is used (pages visited, features used, tender matches viewed, conversion funnels). See section 8 for cookie details. You can withdraw or change your consent at any time via the "Cookie settings" link in the site footer.

Payment data

Payments are processed by Stripe. We do not store your card details. Stripe handles all payment data under their own privacy policy.

2. How we use your data

• Tender matching: We use your company profile to score public sector tenders in Britain against your business using an AI service provider. Your profile data is sent to that provider for this purpose.
• Email alerts: We send daily digest emails to your registered email address via Resend when matching tenders are found.
• Service improvement: We use aggregated, anonymised data to improve our matching algorithms and understand which industries and regions are most active.

3. Lawful basis for processing

• Contract: Processing your account data to provide the tender alert service you signed up for.
• Consent: Analytics cookies, non-essential email communications and marketing preferences (opt in or out at any time).
• Legal obligation: Processing necessary to comply with tax, accounting, and other legal requirements.

4. Data sharing

We share your data only with the following service providers who process data on our behalf:

• Stripe: payment processing
• Resend: transactional email delivery, including requested research access links and subscriber alerts
• Google AI services: tender classification and matching
• Google Analytics 4: website analytics (only with your consent). Data is processed in Google data centres; IP addresses are not stored by default in GA4.
• Google Ads: measuring our own advertising (only with your consent to advertising cookies). If you reached us from a Google ad and later sign up or subscribe, we send Google the ad click identifier, the time, and for subscriptions the amount paid. We do not send your name or email address.
• Meta and LinkedIn: if we advertise on these platforms, their pixels load only after you allow advertising cookies, and never on private report or tender links.
• PostHog (EU region): product analytics, error diagnostics, heatmaps, surveys, and privacy-masked session replay (only with your consent). For signed-in users, analytics are linked to the BidSkim account ID and may include email, company name, plan tier, and onboarding status so we can understand the customer journey and resolve product issues. Form inputs are masked in replays and sensitive URL parameters are redacted in the browser before data is sent. Data is stored in the European Union.
• Render: hosting and database
• Cloudflare: content delivery, DDoS protection, and bot verification (Turnstile) on our signup form. When you create an account, Cloudflare processes technical signals such as your IP address and browser characteristics to confirm you are a genuine visitor rather than an automated bot. See Cloudflare's privacy policy.

We do not sell your data to third parties.

5. Data retention

• Account data: Retained while your account is active. Deleted within 30 days of account deletion.
• Tender data: Public sector tender notices are retained indefinitely as they are public records.
• Email logs: Subscriber-alert send history is retained for 6 months for deliverability monitoring.
• PostHog: Product analytics are retained for 1 year and privacy-masked session replays for 30 days, then deleted under our EU project retention settings.

6. Your rights (UK GDPR)

You have the right to:

• Access your personal data: email us and we'll provide a copy within 30 days
• Rectification: update your profile from your dashboard at any time
• Erasure: delete your account from Settings, or email us
• Object: object to any processing based on legitimate interest, or unsubscribe from any non-essential email at any time
• Data portability: request an export of your data by email
• Withdraw consent: at any time, without affecting prior processing

7. Email communications

Subscriber alerts are sent from [email protected] via Resend. They contain tender-match digests for paying users. Manage cadence and unsubscribe from your settings page, or use the one-click unsubscribe link in any email. Unsubscribes are honoured immediately.

8. Cookies

Essential cookies (always on)

These are required for the service to function. No consent is needed under PECR.

• session_id — keeps you signed in. First-party, HttpOnly, Secure. Expires on sign-out or after 30 days.
• pending_email_verification — lets you securely continue after confirming your email. First-party, HttpOnly, Secure. Expires after 24 hours or when you sign in.
• bidskim_report_ref — remembers the report link you opened so signup and onboarding can stay connected to it. First-party, HttpOnly, Secure. Expires after 30 days.
• bidskim_consent — stores your cookie-consent choice so we don't ask again. First-party. Expires after 180 days.
• Stripe cookies — set only on the checkout/billing flow for fraud prevention. See Stripe's policy.

Analytics cookies (only set after you accept)

We default all analytics and advertising cookies to denied using Google Consent Mode v2. Nothing below is set on your device until you choose "Analytics only" or "Allow all" in our cookie banner. "No thanks" is always available, and you can change your choice at any time via "Cookie settings" in the site footer.

• _ga (Google Analytics) — distinguishes unique visitors. Expires after 2 years.
• _ga_<id> (Google Analytics) — maintains session state. Expires after 2 years.
• ph_<id>_posthog (PostHog) — distinguishes unique visitors for product analytics. Expires after 1 year. Stored in the EU.
• bidskim_attr (BidSkim) — records how you first and most recently reached us (campaign tags and the referring site) so we can tell which channels bring customers. First-party. Expires after 90 days.

Advertising cookies (only set after you choose "Allow all")

These let advertising platforms measure whether our ads lead to signups and show our ads to people who have visited BidSkim. Advertisers who bid on the same searches never see them.

• _gcl_au, _gcl_aw, _gcl_gb (Google Ads) — link a visit to the Google ad that led to it. Expire after 90 days.
• Google advertising cookies (Google Ads remarketing) — let Google show our ads to past visitors. See how Google uses advertising cookies.
• bidskim_attr (BidSkim) — with this choice also stores the ad click identifier (for example gclid). Expires after 90 days.
• _fbp (Meta) and li_fat_id, bcookie (LinkedIn) — only if we advertise on those platforms. Expire after 90 days (Meta) and up to 1 year (LinkedIn).

9. Security

We protect your data using industry-standard security measures including encrypted connections (HTTPS), bcrypt password hashing, and encrypted session cookies. Our database is hosted on Render with automatic backups.

We use Cloudflare Turnstile to protect our signup form from automated abuse. This runs a lightweight, privacy-preserving bot check that requires no interaction for most visitors and does not use tracking cookies.

10. Children

BidSkim is a business service not directed at individuals under 18. We do not knowingly collect data from children.

11. Changes to this policy

We may update this policy from time to time. We'll notify registered users of significant changes via email.

12. Contact

For any privacy queries, data requests, or complaints:

• Email: [email protected]

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).