Privacy Policy (PIPEDA, CASL & GDPR)

Effective Date: November 13, 2026  |  Data Controller: BidPulse AI (Canada)  |  Privacy Contact: privacy@bidpulseai.app

BidPulse AI is operated from Canada and complies with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's Anti-Spam Legislation (CASL), and, where EU/EEA or UK residents use our service, the EU/UK General Data Protection Regulation (GDPR).

1. Data We Collect & Minimization

• Workspace & Alert Preferences: Business email, saved watch keywords, target regions, and explicit alert consent timestamps.
• Billing Information: Payment card data is processed directly by Stripe (PCI-DSS Level 1). BidPulse AI stores only plan status and Stripe customer/subscription IDs.
• Public Procurement Notices: Indexed from licensed open-government feeds (CanadaBuys, UK Contracts Finder, Grants.gov, SAM.gov). Personal buyer contact details are omitted from public storage.
• Strictly Necessary Session Cookie: We use an HTTP-only signed session cookie solely to preserve your workspace session and do not use third-party advertising trackers.

2. Infrastructure Regions & Subprocessors

• Primary Database — Supabase Postgres: Hosted in Canada Central (ca-central-1, Montreal).
• Application Edge — Cloudflare Workers: Low-latency routing under Cloudflare's DPA.
• Payments — Stripe: Subscription checkout and billing portal.
• Email Delivery — Resend: Transactional sign-in links and opted-in daily tender digests.

3. Retention & Self-Serve Data Rights

From My Workspace → Settings, or by writing to privacy@bidpulseai.app, you can:

• Export your data: Download a full JSON copy via /api/privacy/export.
• Erase your workspace: Delete your profile, briefs, and email history immediately.
• Withdraw email consent: Unsubscribe anytime via /unsubscribe.