Privacy Policy

BidBud (the “app”) is operated by Common Swift Technologies LLC (“BidBud”, “we”, “us” or “our”). We are the data controller for the personal information described in this policy, except where this policy says we act on a contractor’s behalf. You can reach us at support@bidbud.app or by post at Caldwell, NJ 07006, United States.

This policy covers the BidBud mobile app for iPhone and Android, our website at bidbud.app, the estimate and invoice pages we host for the app’s users, and the emails we send. It does not cover the app stores, Apple or Google sign-in, or any retailer site you open from a price quote; those have their own policies.

The app is a tool for contractors to scope, price, send and invoice jobs. The “you” in most of this policy is the contractor using the app. Section 7 is written for people who receive an estimate or invoice through it.

• No account needed to startThe app creates an anonymous account tied to a random identifier it generates on your phone. Email, Apple or Google sign-in are optional.
• Your job data stays yoursPhotos, descriptions, scopes, prices, clients, estimates and invoices are stored so the app can work. We do not sell them or use them for advertising.
• AI sees the job, not your identityPhotos and descriptions go to OpenAI to draft the scope. Item names and your city or region go to pricing services. Your name, email and client details are not sent to them.
• Dictation streams from your phoneLive dictation sends audio straight from the app to OpenAI for up to two minutes at a time. We only ever receive the text.
• Clients are logged when they open a linkWhen a client views, downloads or approves a document we record the time, IP address and browser, and store the name, optional email and signature they give.
• You can delete your account in the appDeletion removes your sign-in details, email, device link, push tokens and logo. Email us for anything the app does not remove.
• No cookies, no trackersThis website and the hosted document pages set no cookies and load no analytics or advertising scripts.
• Servers in the United StatesData is hosted on AWS and Supabase in the US. Transfers from the EU, UK and Switzerland rely on standard contractual clauses.

We collect what you type, dictate, photograph or upload, what your clients enter on document pages, and a limited amount of technical data needed to run and protect the service.

Account and sign-in

• Device identifier. On first launch the app generates a random identifier and sends it to us to create an anonymous account. It is not an advertising identifier and is not shared with ad networks. It is also used to count free estimates, so a new anonymous account on the same phone does not reset them.
• Email and password. If you add an email, we store the address, whether it has been verified, and a salted hash of your password. We never store the password itself.
• Apple or Google sign-in. We receive the account identifier Apple or Google gives us for the app, the email on that account and, on first sign-in, the name you allow them to share. We store the identifier and email so you can sign in again.
• Push notification tokens. If you allow notifications, the app registers a token for your device with its platform (iOS or Android), so we can send pushes through Apple or Google.
• Session tokens. After sign-in the app holds a signed token that identifies your account and device. We keep a version number so every token can be revoked at once from “Sign out everywhere” or a password reset.

Business profile

• About you and your business. Your name, business name, trade, team size, country and postal code, currency, default markup and tax settings, and your saved labor rates.
• Details printed on documents. Business email, phone, address, license number, website, logo, default terms and payment instructions. These appear on every estimate and invoice you send, and a copy is frozen with each document so it keeps showing what the client saw.
• Location. Your postal code is resolved to a city and region so prices can be searched near the job. If you tap “Find my location”, the app sends your device coordinates, rounded to about 110 metres, to a reverse-geocoding service to find the postal code. We do not store the coordinates.

Projects and documents

• Job content. The job description you type or dictate, up to 6 photos per project, your answers to clarifying questions, and the title, folder and client you assign.
• Scope and prices. The line items the AI drafts and you edit, retail quotes for materials, the labor rates applied, and the totals.
• Voice commands. The text of each voice edit you apply to an estimate is kept in a log on that estimate so you can see what changed. The audio itself is handled as described under dictation below.
• Estimates, invoices and payments. Numbers, dates, notes, terms, display settings, deposit and payment records you enter, and the status of each job.

Your clients

• Client records. The name, company, email, phone, address and notes you save for each client. If you import a client from your phone’s contacts, the picking happens on your device and only the fields you save reach us.
• Approvals. When a client approves an estimate we store the name they typed, the email they optionally gave, a drawn signature image if they signed, and the IP address the approval came from.
• Document activity. Each time a hosted estimate or invoice page is opened, its PDF downloaded, or the estimate approved, we record the event with the time, the visitor’s IP address and browser user-agent string.

Subscription

• Purchase events. Premium is bought through the App Store or Google Play and managed by Adapty. We receive events naming your account, the store, the transaction and original transaction identifiers, the event type and the subscription expiry. We never receive card numbers or billing addresses.

Technical and usage data

• IP address. Used to rate-limit sign-in, account creation, document approvals and other requests, and recorded in server logs.
• AI usage records. One record per AI run, tied to your account, device identifier and project, so we can enforce free-tier limits and hourly caps.
• Email sending counts. How many recipients you have emailed in a day, to limit abuse of our sending domain.
• Server logs. Our hosting provider records requests and errors. Logs include timestamps, IP addresses, the endpoint called, error messages and, for emails we send, the recipient addresses and subject line; they do not include photos, descriptions, document contents or passwords.

We use personal information only for the purposes below. Where the GDPR or UK GDPR applies, the legal basis for each is shown.

We do not sell personal information, we do not use it for advertising, we do not build profiles for marketing, and we do not make automated decisions about you that have legal or similarly significant effects. AI output in the app is a draft you review and can change.

The app’s core features use third-party AI and search services. Here is exactly what each one receives.

• Scope drafting (OpenAI). Your project photos, job description, answers to clarifying questions, the names of your saved labor rates, your trade, and the job’s city, region and country are sent to OpenAI to draft and refine the scope. Your name, email, business contact details and client records are not included.
• Voice edits (OpenAI). The text of a voice command and the current estimate lines are sent to OpenAI to work out the edit. All prices are recomputed on our servers.
• Live dictation (OpenAI). When you dictate, our server issues the app a secret that is valid for a few minutes. The app then streams audio directly to OpenAI’s transcription service, along with the language of your phone and a short list of trade terms to improve accuracy. Sessions are limited to 120 seconds. The audio never passes through our servers and we do not store it; we receive and store only the resulting text once you use it in a description or command.
• Material prices (Serper.dev and OpenAI web search). For each material or equipment line we send the item name, quantity, unit, your country and your city or region to Serper.dev, a Google Shopping search service. When a material cannot be found that way, up to a handful of items per estimate are searched with OpenAI’s web search tool using the same information. Resulting quotes for a given item in a given region are cached for 7 days and may be reused for other users pricing the same item there; the cache holds product listings only, never anything about you or your project.
• Location lookups (Zippopotam and OpenStreetMap Nominatim). Your postal code and country are sent to Zippopotam to find the city and region; results are cached for up to a year without any link to you. “Find my location” sends rounded coordinates to Nominatim; results are held in memory for 24 hours.

We use these services under their business and API terms. OpenAI states that content sent through its API is not used to train its models. Each provider processes data on our instructions as described here; we do not give them permission to use your content for their own purposes.

• By email. We send from our own address through Amazon Simple Email Service, with your business email (or account email) as the reply-to address so answers go to you. The email carries your business name, the document number and total, any message you type, a PDF of the document and a link to the hosted page. You choose the recipients, up to 10 per send.
• By link. Each document has a unique, hard-to-guess link you can send by text, WhatsApp or any other channel. Anyone with the link can see the document, so share it only with the people it is for. You can revoke a link at any time from the app; a revoked link shows nothing.
• What the page shows. Your business details and logo, the client’s name and address if you attached a client, the project description and location, the line items in the detail you chose, totals, notes, terms, payment instructions, a PDF download and, for estimates, an approval form.
• Frozen copies. When you send a document we store a copy of your business details as they were. Once an estimate is approved or an invoice paid that copy is frozen, so later edits to your profile do not change a document the client already accepted.

We share personal information only with service providers that process it for us under contract, with the people you choose to send documents to, and where the law requires. We do not sell it and we do not share it for cross-context behavioral advertising.

We may also disclose information when we believe in good faith it is required by law, a court order or a government request; to enforce our Terms or protect the rights, safety or property of our users, the public or us; or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to the information until it is changed with notice to you.

Our servers, database, file storage and email service run in the United States. The providers listed above may also process data in other countries where they operate. If you use the app from the European Economic Area, the United Kingdom or Switzerland, your information is therefore transferred outside your region.

For those transfers we rely on the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum in our agreements with providers, and, where a provider is certified, on the EU-US, UK and Swiss-US Data Privacy Frameworks. You can ask us at support@bidbud.app for more information about the safeguards in place.

What account deletion does

Deleting your account in the app immediately removes your email, pending email, password hash, Apple and Google identifiers, device link and push tokens, deletes your logo files, signs out every device and marks the account deleted, so it can never be signed into again. Projects, documents, clients and purchase history remain attached to the deleted record so invoices and approvals that were already sent stay consistent and we can meet tax and accounting duties. If you want these removed as well, email support@bidbud.app from the address on the account and we will erase everything we are not legally required to keep.

• All traffic between the app, this website, our servers and our providers is encrypted in transit with TLS.
• Passwords are hashed with scrypt and a unique salt. Reset and verification links are stored only as hashes and expire quickly.
• Photos, logos and signatures live in a private storage bucket under your account’s own folder and are served through short-lived signed URLs; nothing is publicly listable.
• Every API request is checked against your account, your device and the current token version, so a stolen token stops working as soon as you sign out everywhere or reset your password.
• Sign-in, account creation, emailing and approvals are rate-limited per IP address, account and device.
• Pages that carry a one-time or share token cannot be embedded in other sites and do not pass their address on as a referrer.
• Access to production systems is limited to the people who operate the service.

No system is perfectly secure. If we learn of a breach that affects your personal information we will notify you and the relevant authorities as the law requires.

• Stay anonymous. You can use the app without ever adding an email or signing in with Apple or Google. Without them, your account cannot be recovered if you lose or reset your phone.
• Edit or remove profile details. Everything in your business profile, including your logo, can be changed or cleared in Settings.
• Delete projects, clients and documents. Deleting a project removes its photos, scope, estimate and share links. Deleting a client removes the record, or archives it if projects or invoices still refer to it; documents already issued keep the client details they were issued with.
• Revoke links. Any share link can be withdrawn from the project or invoice screen.
• Push notifications. Turn them off in your phone’s notification settings at any time; the app still works without them.
• Location. “Find my location” is optional. You can type a postal code instead.
• Photos and microphone. The app asks for camera, photo library and microphone access only when you use those features, and you can refuse or revoke them in your phone’s settings.
• Sign out everywhere. Settings offers a single action that invalidates every signed-in device.
• Delete your account. Settings has a delete option that works as described in Section 10. You can also email support@bidbud.app.

Depending on where you live, you may have the right to:

• access the personal information we hold about you and receive a copy;
• correct information that is inaccurate or incomplete;
• have your information erased;
• restrict or object to our processing, including processing based on legitimate interests;
• receive the information you provided in a portable, machine-readable format;
• withdraw consent where processing is based on consent, without affecting processing before withdrawal;
• lodge a complaint with your data protection authority. In the EEA this is the authority of the country where you live or work; in the UK it is the Information Commissioner’s Office.

To exercise any of these rights, email support@bidbud.app from the address on your account. We may ask you to confirm your identity, for example by replying from the account email or confirming details only the account holder would know. We respond within one month, and will tell you if we need longer for a complex request. There is no charge unless a request is clearly unfounded or excessive.

Much of your data can also be exported directly: every estimate and invoice is available as a PDF from the app, and your profile and client records can be viewed and copied there.

This section applies to residents of California and of other US states with comprehensive privacy laws, such as Colorado, Connecticut, Oregon, Texas, Utah and Virginia, to the extent those laws apply to us.

• Categories collected. In the past 12 months we have collected the categories listed in Section 3: identifiers (device identifier, email, account identifiers, IP address); customer records (name, business contact details, client records); commercial information (projects, estimates, invoices, payments, purchase events); audio and visual information (project photos, logos, signatures, and dictation text); approximate geolocation (postal code, city and region); internet activity (document page views and downloads, server logs); and inferences limited to the AI-drafted scope of a job. We do not collect sensitive personal information other than account log-in credentials, which we use only to let you sign in.
• Sources. You, your clients when they use a document page, Apple or Google when you sign in with them, and Adapty for purchase events.
• Purposes and disclosures. Described in Sections 4 and 8. We disclose information to the service providers listed there for business purposes. We do not sell personal information and have not done so in the past 12 months, and we do not share it for cross-context behavioral advertising. Because we neither sell nor share, there is no opt-out to offer, and we treat Global Privacy Control signals as having nothing to opt out of.
• Your rights. You may request to know what personal information we have collected about you, to delete it, to correct it, and to receive it in a portable format. We will not discriminate against you for exercising these rights.
• How to make a request. Email support@bidbud.app or use the delete option in the app. We verify requests by matching the email you write from to the account, or by asking for information only the account holder would know. You may use an authorized agent; we will ask for proof that you gave the agent permission and may still verify your identity directly. We respond within 45 days and will tell you if we need up to 45 more.
• Retention. Set out in Section 10.

The app is a business tool for contractors and is not directed to children. We do not knowingly collect personal information from anyone under 18, and under 16 in the EEA and UK. If you believe a child has given us personal information, email support@bidbud.app and we will delete it.

This website, the hosted estimate and invoice pages, and the password reset and email verification pages set no cookies and do not use local storage. They load no analytics, advertising or social media scripts; the fonts are served from our own domain. Because there is nothing to opt out of, we do not show a cookie banner. The app itself talks only to our servers and the providers named in this policy, and sends them no advertising identifiers.

We will update this policy when our practices change. The “Last updated” date at the top shows the latest version. For material changes, such as a new category of data, a new purpose or a new kind of recipient, we will notify you in the app or by email before the change takes effect, and where the law requires it we will ask for your consent.

For any question, request or complaint about privacy, write to support@bidbud.app. We aim to answer within a few business days. You can also write to us at Caldwell, NJ 07006, United States.

• Company: Common Swift Technologies LLC
• Address: Caldwell, NJ 07006, United States
• Email: support@bidbud.app
• Website: https://bidbud.app

If you are in the EEA or UK and are not satisfied with our response, you have the right to complain to your supervisory authority.