Privacy policy
Last updated 29 September 2026
Erebos Labs operates Bidstage and is the controller of the personal data described here. Contact: support@bidstage.app.
What we collect and why
- Email address - to sign you in with one-time codes, send match emails you choose, and contact you about your subscription. Contract.
- Sign-in records - one-time codes and session tokens are stored only as keyed or one-way hashes. Codes expire after 10 minutes; sessions after 30 days. Contract and security.
- Request protection - a keyed hash of your IP address and browser hints to limit abuse. We do not store raw IP addresses. Legitimate interest.
- Your business profile - the website address or description you give us, the public pages we read from that website, and the profile, matches, saved items and drafts that follow. Contract.
- Billing records - plan, status, renewal date and Dodo customer and subscription ids. Payment details are held by Dodo Payments. Contract and legal obligation.
- Team membership - who invited whom and when, so seats and access work. Contract.
- Email preferences - daily, weekly or off, and which tenders we already emailed you. Contract.
- Weekly tender lists (no account) - if you sign up for a free weekly list on a tender page: your email address, the country or category you follow, when you confirmed and when we last emailed you. Consent, which you give by confirming and withdraw with the unsubscribe link in every email.
We use no advertising or analytics trackers. Cookies are strictly necessary: your session, the address a code was sent to during sign-in, and the website you entered before signing in. We never sell personal data.
To see which pages help people, we keep daily totals on our own database: how many times each public page was viewed, how many free searches were run (and the words of searches that found nothing), and how many checkouts were started. These totals hold no IP address, cookie, account or browser details and cannot be tied to you. Our own cookieless page counter (Railyard Insights) records the page, the referring site and your country; the visitor is a hash that changes every day, and no IP address or cookie is stored.
Who processes it
- Cloudflare - Hosting, request protection (Turnstile) and text embeddings (Workers AI).
- Oracle Cloud (Frankfurt, EU) - Our own server: the database and the scheduled jobs that collect tenders, match profiles and send emails.
- Anthropic - AI models that build your capability profile and write summaries and draft responses.
- Oracle Cloud (Email Delivery) - Sending sign-in codes, team invites, match emails and weekly tender lists, through our own Scribase Mail service.
- Resend - Backup email sending when the main mail service is unavailable.
- Dodo Payments - Checkout, billing and invoices as merchant of record. Card details never reach us.
Some processors are outside your country, including in the United States. Where the law requires it, transfers rely on adequacy decisions or standard contractual clauses.
How long we keep it
- Account, profiles, matches and drafts: while your account exists, then deleted within 30 days of a deletion request.
- Used or expired sign-in codes: 1 day. Ended sessions: 7 days. Closed team invites: 30 days.
- Closed tenders and their matches: about 30 days after closing, unless a draft refers to them.
- Billing records: as long as tax and accounting law requires.
Your rights
You can ask for access to, correction, deletion or a copy of your data, object to processing based on legitimate interest, or restrict processing. Email support@bidstage.app; we answer within 30 days. Turn match emails off at any time from your account or with the link in each email. You can also complain to your data protection authority.
Security
Data is encrypted in transit, access to the database is limited to the application, and secrets such as codes and session tokens are stored hashed. If a breach affects you, we will tell you without undue delay.
Changes
We will email subscribers about material changes before they apply.