Privacy Policy

Last updated: 22 June 2026

BidSkim ("we", "us", "our") is operated by BidSkim Limited. This privacy policy explains how we collect, use, and protect your personal data when you use our website at bidskim.com and our tender alert service.

1. What data we collect

Account data

When you sign up, we collect:

• Email address
• Password (stored securely using bcrypt hashing, we never store your plain text password)
• Company name and description
• Region preferences and certifications

Usage data

With your consent, we use Google Analytics 4 and PostHog to understand how BidSkim is used (pages visited, features used, tender matches viewed, conversion funnels). See section 8 for cookie details. You can withdraw or change your consent at any time via the "Cookie settings" link in the site footer.

Payment data

Payments are processed by Stripe. We do not store your card details. Stripe handles all payment data under their own privacy policy.

2. How we use your data

• Tender matching: We use your company profile to score public sector tenders in Britain against your business using an AI service provider. Your profile data is sent to that provider for this purpose.
• Email alerts: We send daily digest emails to your registered email address via Resend when matching tenders are found.
• Service improvement: We use aggregated, anonymised data to improve our matching algorithms and understand which industries and regions are most active.

3. Lawful basis for processing

• Contract: Processing your account data to provide the tender alert service you signed up for.
• Consent: Analytics cookies, non-essential email communications and marketing preferences (opt in or out at any time).
• Legal obligation: Processing necessary to comply with tax, accounting, and other legal requirements.

4. Data sharing

We share your data only with the following service providers who process data on our behalf:

• Stripe: payment processing
• Resend: transactional email delivery (subscriber alerts)
• Google AI services: tender classification and matching
• Google Analytics 4: website analytics (only with your consent). Data is processed in Google data centres; IP addresses are not stored by default in GA4.
• PostHog (EU region): product analytics, error diagnostics, heatmaps, surveys, and privacy-masked session replay (only with your consent). For signed-in users, analytics are linked to the BidSkim account ID and may include email, company name, plan tier, and onboarding status so we can understand the customer journey and resolve product issues. Form inputs are masked in replays and sensitive URL parameters are redacted in the browser before data is sent. Data is stored in the European Union.
• Render: hosting and database
• Cloudflare: content delivery, DDoS protection, and bot verification (Turnstile) on our signup form. When you create an account, Cloudflare processes technical signals such as your IP address and browser characteristics to confirm you are a genuine visitor rather than an automated bot. See Cloudflare's privacy policy.

We do not sell your data to third parties.

5. Data retention

• Account data: Retained while your account is active. Deleted within 30 days of account deletion.
• Tender data: Public sector tender notices are retained indefinitely as they are public records.
• Email logs: Subscriber-alert send history is retained for 6 months for deliverability monitoring.
• PostHog: Product analytics are retained for 1 year and privacy-masked session replays for 30 days, then deleted under our EU project retention settings.

6. Your rights (UK GDPR)

You have the right to:

• Access your personal data: email us and we'll provide a copy within 30 days
• Rectification: update your profile from your dashboard at any time
• Erasure: delete your account from Settings, or email us
• Object: object to any processing based on legitimate interest, or unsubscribe from any non-essential email at any time
• Data portability: request an export of your data by email
• Withdraw consent: at any time, without affecting prior processing

7. Email communications

Subscriber alerts are sent from [email protected] via Resend. They contain tender-match digests for paying users. Manage cadence and unsubscribe from your settings page, or use the one-click unsubscribe link in any email. Unsubscribes are honoured immediately.

8. Cookies

Essential cookies (always on)

These are required for the service to function. No consent is needed under PECR.

• session_id — keeps you signed in. First-party, HttpOnly, Secure. Expires on sign-out or after 30 days.
• pending_email_verification — lets you securely continue after confirming your email. First-party, HttpOnly, Secure. Expires after 24 hours or when you sign in.
• bidskim_report_ref — remembers the report link you opened so signup and onboarding can stay connected to it. First-party, HttpOnly, Secure. Expires after 30 days.
• bidskim_consent — stores your cookie-consent choice so we don't ask again. First-party. Expires after 180 days.
• Stripe cookies — set only on the checkout/billing flow for fraud prevention. See Stripe's policy.

Analytics cookies (only set after you accept)

We default all analytics cookies to denied using Google Consent Mode v2. Nothing below is set on your device until you click "Accept analytics" in our cookie banner. You can withdraw consent at any time via "Cookie settings"in the site footer.

• _ga (Google Analytics) — distinguishes unique visitors. Expires after 2 years.
• _ga_<id> (Google Analytics) — maintains session state. Expires after 2 years.
• ph_<id>_posthog (PostHog) — distinguishes unique visitors for product analytics. Expires after 1 year. Stored in the EU.

We do not use advertising cookies, third-party marketing pixels, or cross-site tracking.

9. Security

We protect your data using industry-standard security measures including encrypted connections (HTTPS), bcrypt password hashing, and encrypted session cookies. Our database is hosted on Render with automatic backups.

We use Cloudflare Turnstile to protect our signup form from automated abuse. This runs a lightweight, privacy-preserving bot check that requires no interaction for most visitors and does not use tracking cookies.

10. Children

BidSkim is a business service not directed at individuals under 18. We do not knowingly collect data from children.

11. Changes to this policy

We may update this policy from time to time. We'll notify registered users of significant changes via email.

12. Contact

For any privacy queries, data requests, or complaints:

• Email: [email protected]

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).