Privacy Policy

This Policy explains how BidPros — a venture powered by AltaPro AI, owned in partnership with our founding partner — collects, uses, discloses and protects personal information when you use our service. BidPros is based in Edmonton, Alberta, Canada.

We handle personal information in a manner consistent with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy law, including Alberta’s Personal Information Protection Act (PIPA).

Most of what we hold is business information. Some of it — your name, your work email, your phone number, the names on documents you upload — is personal information, and that is what this Policy is about.

To operate the Service and verify your business, we collect:

• Company information — business name, address, trades, equipment, service area, crew size, certifications, insurance limits and profile details.
• Contact information — your name, work email address and phone number, and the same for users you invite.
• Account credentials — your email and a securely hashed password. We never store your password in readable form.
• Business registration numbers — CRA Business Number, provincial corporate registry number, or WCB/insurance number, used to verify your business is real and eligible.
• Verification and award documents — the proof documents you upload, and any award notices or purchase orders used to confirm a win.
• Your rates and commercial data — labour and equipment rates, margins, bid-size range and margin floor. This is confidential to your Account.
• Connected account data — when you connect an email account or a buyer portal, the tokens or credentials needed to send submissions on your instruction, plus the send status of what we send.
• Content you create — claims, drafts, proposals, notes, pipeline records, and any RFPs you post.
• Usage and technical data — IP address, browser and device type, pages viewed, and log data needed to run, secure and debug the Service.

We do not collect payment card numbers. Where a payment is taken, it is handled by our payment processor and we receive only the result and a reference.

• From you — signup, verification, your profile and rates, documents you upload, and content you create.
• Automatically — usage and technical data generated as you use the Service.
• From public sources — publicly available procurement postings and award notices, which may name your business. We use award notices to confirm wins.
• From accounts you connect — only what the connection requires to send on your behalf.

We use your information to:

• verify your business and grant access to the Service;
• score opportunities against your profile and build your matched feed;
• draft and price proposals using your own rates;
• submit proposals through the email account or portal connection you authorize;
• track your pipeline and confirm a verified win;
• invoice the 5% success fee where it applies;
• send service messages — match alerts, closing-date reminders, verification and billing notices;
• provide support, secure the Service, prevent fraud and abuse, and debug problems;
• produce aggregated, de-identified statistics that do not identify you or your business; and
• meet our legal, tax and audit obligations.

We do not use your uploaded documents for any purpose beyond operating the Service, and we do not permit your content to be used to train third-party public AI models.

We collect, use and disclose personal information with your consent, or as otherwise permitted or required by law. Creating an account and submitting verification is your consent to the uses described here.

For business contact information used to run a business relationship, PIPEDA permits certain uses without separate consent. You may withdraw consent for non-essential uses at any time — see section 15. Withdrawing consent for uses the Service depends on (verification, for example) means we can no longer provide it.

To score opportunities and draft proposals, we transmit the opportunity text together with your profile and rates to our third-party AI provider for processing. Personal information in that payload is limited to what the draft needs — typically your company details and the signature block you configure.

Our AI provider processes this on our instruction only, does not use it to train public models, and is bound by confidentiality obligations. AI output is a draft for your review; it is never used to make an automated decision about you (see section 18).

When you connect an email account or buyer portal, you authorize us to use that connection only to prepare and send submissions you direct. We do not read your inbox for any other purpose, we do not mine your mail for contacts, and we do not send anything you have not initiated.

Credentials and tokens are encrypted at rest with a key held outside the database, are never exposed to other members, and are never written to logs. You can disconnect at any time from your Account, which deletes the stored credential.

Verification documents and award proofs are stored in access-controlled storage inside our primary database, not on a public bucket or a shared drive. Access is limited to the people and systems that need it to review a verification or confirm a win, and access is logged. These documents are used for verification and fee confirmation only, and are never shared with other members.

We use a small number of cookies, and only the ones the Service needs:

• Session and authentication cookies — keep you signed in and protect against cross-site request forgery. These are strictly necessary; the Service cannot work without them.
• Preference storage — local storage remembering, for example, that you dismissed the install-to-home-screen prompt.

We do not run third-party advertising or cross-site tracking cookies, and we do not sell or share information for behavioural advertising. Blocking strictly necessary cookies will prevent you from signing in.

We do not sell your personal information, and we never have. We share it only where needed to run the Service:

• Where you direct us — submitting your proposal to a buyer sends the content you approved to that buyer.
• With service providers — under contract and confidentiality obligations, listed in section 11.
• Other members, only for what you publish — if you post a commercial RFP, the details you choose to publish go to matched members. Your rates, drafts and pipeline are never shared.
• Where required by law — to comply with a valid legal requirement, or to establish, exercise or defend a legal claim. We review such requests and disclose only what is required.
• In a business transfer — if the business is merged, acquired or its assets sold, subject to this Policy continuing to apply.

We rely on a small set of providers, each contractually limited to processing on our instruction:

• Hosting and application delivery — running the site and the app.
• Managed database — storing your account, profile, documents and content.
• AI processing — scoring and drafting, as described in section 6.
• Email delivery — sending service and notification email.
• Payment processing — invoicing and collecting the success fee.

We do not permit these providers to use your information for their own purposes. To ask which specific providers we currently use, email hello@bidpros.ca.

Our providers may store or process information outside Canada, including in the United States. While information is in another country it may be accessible to the courts, law enforcement and national security authorities of that country under its laws. We use providers that offer contractual protections comparable to those required in Canada. If this matters to you, contact us at hello@bidpros.ca before you upload sensitive documents.

We apply administrative, technical and physical safeguards proportionate to the sensitivity of the data:

• encryption in transit (HTTPS) and encryption at rest for per-tenant secrets;
• passwords stored only as salted hashes;
• access to member data scoped to a single account on every query, and restricted internally to staff who need it;
• rate limiting and authentication on the endpoints that matter;
• credentials kept out of logs.

No system is perfectly secure. We limit what we collect to what the Service actually needs, and if a breach creates a real risk of significant harm we will notify affected members and the Privacy Commissioner as the law requires.

We keep information only as long as we need it:

• Account and profile data — while your account is active, and for a reasonable wind-down period after closure.
• Verification documents — for the life of the account plus the period we must keep proof of the check.
• Award proofs and fee records — for as long as tax, accounting and audit law requires, generally seven years.
• Connected credentials — deleted when you disconnect or close the account.
• Logs — a short operational window, then deleted or aggregated.

After the applicable period we delete or anonymize the information. Backups roll off on their own schedule.

Under PIPEDA and applicable provincial law you have the right to:

• Access — ask what personal information we hold about you and how it has been used and disclosed.
• Correct — have inaccurate or incomplete information fixed.
• Delete — ask us to delete information we are not required to retain.
• Withdraw consent — for uses that are not necessary to provide the Service, subject to legal and contractual limits.
• Export — request a copy of your content in a usable format.
• Opt out of non-essential email — unsubscribe from anything that is not a service or billing notice.

Email hello@bidpros.ca with the request and enough detail for us to find your records. We may need to verify your identity and your authority to act for the business first. We respond within 30 days, and will tell you if we need an extension and why. There is no fee for a reasonable request; if a request would cost significant effort we will quote you before doing the work.

The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us information, email hello@bidpros.ca and we will delete it.

We use automated scoring to rank opportunities in your feed and AI to draft proposals. Neither makes a decision that has a legal or similarly significant effect on you. A match score only orders a list you can browse in full, and every draft is yours to review and change. Business verification is reviewed by a person before access is granted or refused.

We may update this Policy. If we make a material change, we will give reasonable notice — by email or an in-app notice — before it takes effect, and update the effective date above. Continuing to use the Service after that date means you accept the updated Policy.

To exercise your rights, ask a question, or raise a concern about how we handle your information, contact our privacy contact at hello@bidpros.ca. We take complaints seriously and will investigate and respond. We answer privacy requests within 30 days, as section 16 sets out.

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Alberta, to the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca).

See also our Terms of Service.