Privacy Policy

1. Information We Collect

1.1 Account and Profile Information

When you create an account, we collect:

• Full name and email address
• Password (stored in hashed form via Supabase Auth — we never store plaintext passwords)
• User role within your organization (admin, staff, consultant, contractor, or partner)
• Optional profile avatar URL

1.2 Organization and Billing Information

When you create or join an organization, we collect:

• Organization name and slug (URL identifier)
• Billing contact information and payment method data (processed by Stripe — we do not store raw card numbers)
• Subscription plan, billing interval, and subscription status
• Stripe Customer ID and Subscription ID (for billing management)
• Trial period and renewal dates

1.3 Business Development Pipeline Data

BiD is a business tool. The core data you create and store includes:

• Government contracting opportunity records (titles, solicitation numbers, agencies, NAICS codes, due dates, estimated values, contract types, pipeline stage, notes, and related fields)
• Uploaded solicitation documents (RFI, RFQ, RFP files) for AI extraction — stored in Supabase Storage
• Company profile information including capabilities, NAICS codes, set-aside status, and past performance records you provide
• Team member information including names, email addresses, and roles within your organization
• Pipeline activity, stage transitions, assignment records, and collaboration notes

1.4 AI-Processed Data

BiD uses AI (powered by Anthropic's Claude API) to extract structured data from solicitation documents you upload. When you use AI features:

• The content of uploaded documents is transmitted to Anthropic's API for processing
• Extracted fields are stored in your BiD pipeline record
• AI credit usage is tracked against your plan limits

Please review Anthropic's Privacy Policy for information about how they handle data submitted to their API.

1.5 Usage and Technical Data

We automatically collect certain technical data when you use BiD:

• IP address and browser/device information
• Pages visited, features used, and interaction logs
• Authentication events and session tokens
• Error logs and performance metrics

1.6 Communications

If you contact us for support or sales, we retain records of that correspondence, including your email address and message content.

2. How We Use Your Information

We use collected information to:

• Provide, operate, and improve the BiD platform
• Process subscription payments and manage billing through Stripe
• Authenticate users and enforce multi-factor authentication (MFA)
• Deliver AI-powered features including document extraction, MRAS workflows, and capabilities statement generation
• Send transactional emails (account verification, password reset, billing notifications)
• Respond to support requests and customer inquiries
• Monitor platform security, detect fraud, and enforce our Terms of Service
• Comply with applicable legal obligations

We do not sell your personal information to third parties. We do not use your pipeline data or uploaded solicitation documents to train AI models without your explicit consent.

3. How We Share Your Information

We share information only as follows:

3.1 Within Your Organization

BiD is a multi-user platform. Other members of your organization will have access to shared pipeline data, opportunity records, and company profile information based on their assigned roles.

3.2 Service Providers

We share data with vendors that help us operate the Service:

• Supabase — database, authentication, and file storage
• Stripe — payment processing and billing management
• Anthropic — AI document processing and generation features
• Vercel — hosting and deployment infrastructure

These providers are contractually required to protect your data and may only use it to perform services on our behalf.

3.3 Legal Requirements

We may disclose information when required by law, subpoena, court order, or to protect the rights, property, or safety of Avvyd Solutions, our users, or the public.

3.4 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of our assets, user information may be transferred as part of that transaction. We will notify you via email or prominent notice within the Service prior to any such transfer.

4. Data Retention

We retain your account and pipeline data for as long as your account is active. If you cancel a paid plan, your account moves to the Free tier and your data is retained — we do not automatically delete pipeline data upon downgrade.

If you request account deletion, we will delete or anonymize your personal information within 30 days, except where retention is required by law or for legitimate business purposes (e.g., billing records). Uploaded solicitation documents are retained while your account is active and deleted upon account deletion request.

5. California Consumer Privacy Act (CCPA)

If you are a California resident, you have the following rights under the CCPA:

• Right to Know — You may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, our purposes, and the categories of third parties with whom we share it.
• Right to Delete — You may request deletion of personal information we have collected, subject to certain exceptions.
• Right to Opt-Out of Sale — We do not sell personal information. You do not need to opt out.
• Right to Non-Discrimination — We will not discriminate against you for exercising any of your CCPA rights.

To submit a CCPA request, contact us at legal@avvyd.ai. We will respond within 45 days. We may need to verify your identity before processing a request.

6. Data Security

We implement industry-standard security measures including:

• Encryption of data in transit via TLS/HTTPS
• Supabase Row Level Security (RLS) policies to enforce data isolation between organizations
• Multi-factor authentication (MFA) available on all accounts
• Hashed password storage — plaintext passwords are never stored
• Access controls limiting employee access to user data

No method of transmission over the internet is 100% secure. While we take reasonable precautions, we cannot guarantee absolute security. For a full description of our security posture, see our Security & Trust page.

7. Children's Privacy

BiD is a business-to-business platform intended for use by organizations and their employees. We do not knowingly collect personal information from individuals under the age of 18. If we become aware that we have collected information from a minor, we will take steps to delete it promptly.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the Effective Date. For significant changes, we will provide additional notice (such as an in-app notification or email). Your continued use of BiD after changes become effective constitutes acceptance of the updated policy.

9. Contact Us

For privacy-related questions or to exercise your rights: