Information we process
We process your ChatGPT account identifier, email address and display name; plan and usage records; support requests; readiness results you choose to save; and the tender text you deliberately submit for AI review. Drafts and the other working areas saved by the workspace remain in your browser unless you deliberately submit text for AI review. Workspace backup and restore happen locally on your device; BidCerta does not receive the backup file.
Service measurement
BidCerta records limited first-party events such as landing-page visits, completed readiness assessments, workspace opens and checkout starts. These records contain the event, page, campaign source and time; they do not contain advertising identifiers or the contents of your tender. We use them to understand whether the service works and where customers encounter friction.
Why we process it
We use this information to provide and secure your account, enforce subscription allowances, deliver requested AI reviews, answer support requests, improve the service, prevent abuse and maintain legally required business records. The usual lawful bases are performing our contract, taking requested pre-contract steps and our legitimate interests in operating and improving a secure service.
Marketing choices
Saving a readiness result does not itself subscribe you to marketing. We send optional tendering guidance only when you actively select the marketing checkbox. Every marketing message should include a personal unsubscribe link; you may also withdraw consent by contacting us. BidCerta retains a minimal suppression record after opt-out so the address is not added again.
Processors and international transfers
Hosting and authentication are provided through OpenAI Sites. Submitted review content is sent to the OpenAI API to generate the review. Payment information is handled by Stripe; BidCerta does not store full card details. Providers may process data outside the UK using their applicable safeguards.
Retention and security
Account and commercial records are retained while your account is active and afterwards where reasonably required for tax, fraud prevention or legal claims. Support records are retained only as needed. API credentials are kept server-side as encrypted hosting secrets.
Your rights
You can download the account data held by BidCerta from Account. Depending on the circumstances, you may request access, correction, deletion, restriction, objection or data portability through the in-product support form. Some records may need to be retained to meet legal obligations. You may also complain to the UK Information Commissioner’s Office.
Important tender-data warning
Do not submit classified information, special-category personal data, security credentials or material you are not authorised to process. Remove unnecessary personal information from tender responses before using AI review.