Privacy notice

Last updated 14 October 2026

This notice explains how BidVault collects and uses personal data when you visit our website or use the BidVault platform, and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

BidVault is operated by Ammaar Hasan, trading as BidVault, 5 Tudor Avenue, KT4 8TY, United Kingdom ("BidVault", "we", "us"). We are the controller of the personal data described in this notice. You can contact us about privacy at bidvault1@gmail.com.

2. The personal data we collect

• Account details: your name, company name and email address, and your password. We never store your password itself, only a salted, one-way cryptographic hash of it.
• Account and subscription records: when your account and free trial started and ended, your plan, subscription requests and the dates your subscription is active.
• Usage records: the number of AI requests your account makes each day, which we use to apply fair-use limits.
• Security data: your IP address combined with the email address you enter, used only to limit repeated sign-up and log-in attempts, and kept for no more than 24 hours.
• Technical logs: our hosting provider records standard technical information, such as IP addresses, browser type and the pages requested, to keep the service secure and working.

3. Your documents and drafts

The documents you add to a Knowledge Vault, and the drafts, matrices, playbook and settings you create, are stored in your own web browser on your device. They are not stored on BidVault's servers.

When you use an AI feature, the text needed for that request (for example the tender question, the relevant excerpts from your vault and your instructions) is sent through our server to our AI provider, Anthropic, to generate the response. We pass this content through without storing it. Under Anthropic's commercial terms, Anthropic may not use this content to train its models, and it processes the content under its Data Processing Addendum.

Your documents may contain personal data about other people, such as staff names in CVs or referee details in case studies. You are responsible for having a lawful basis to share that information with us. When we process it to provide the service, we do so on your behalf and on your instructions, as described in our Terms of Service.

4. How and why we use your data

We do not sell your personal data, and we do not use it for automated decisions that have legal or similarly significant effects on you.

5. Who we share data with

We use the following service providers, which process data on our behalf under contracts that protect it:

• Cloudflare, Inc.: website hosting, our account database and security.
• Anthropic, PBC: AI processing for drafting features.
• Google Fonts and Unsplash: our website loads typefaces from Google and an image from Unsplash, which means your browser shares your IP address with them when pages load.
• cdnjs (operated by Cloudflare): supplies the software the platform uses to read Word and PDF files in your browser.

We may also disclose data if the law requires it, or to professional advisers and any buyer of our business, under appropriate confidentiality protections.

6. International transfers

Some of our providers, including Cloudflare and Anthropic, are based in the United States or process data outside the UK. Where personal data leaves the UK, we rely on appropriate safeguards, such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework where the recipient is certified.

7. How long we keep data

• Account details and records: for as long as your account is open. You can delete your account at any time from your account page, which permanently removes your account details, sessions and usage records straight away.
• Free trial accounts that never become subscriptions: deleted automatically 12 months after the trial ends.
• Log-in sessions: up to 30 days, or until you log out.
• Security data for limiting log-in attempts: no more than 24 hours.
• Invoices and financial records: six years, as required by UK tax law.

Data stored in your browser stays there until you delete it, clear your browser data or delete the client in the platform.

8. Cookies and browser storage

We use one cookie, bv_session, which keeps you logged in. It is strictly necessary for the service, so it doesn't need your consent. The platform also uses your browser's storage to keep your vaults, drafts and settings on your device. We do not use analytics, advertising or tracking cookies.

9. Security

We protect your data with encrypted connections (HTTPS), hashed passwords, secure session cookies, limits on repeated log-in attempts and access controls on our systems. No system is completely secure, so please use a strong, unique password and keep it private.

10. Your rights

You have the right to access your personal data, to have it corrected or erased, to restrict or object to its use, and to receive it in a portable format. To use any of these rights, contact us at bidvault1@gmail.com. We'll respond within one month.

If you're unhappy with how we handle your data, please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

11. Business users only

BidVault is a service for businesses and is not intended for anyone under 18.

12. Changes to this notice

We'll update this notice when our practices change and show the date of the latest version at the top. We'll tell account holders by email about any significant changes.