This policy explains how TBay Tech Service (“BidPilot”) handles personal information when people visit the website, request or use an account, submit a historical-bid demo, or communicate with us.
What we collect
- Business contact and account information such as name, work email, phone, role, company, location, and authentication identity.
- Sales, support, onboarding, invoice, consent, and customer-relationship records.
- Authorized project documents, project metadata, office rates, and the requirements, candidate conditions, risks, calculations, and proposal drafts produced from them.
- Technical and security records such as timestamps, request metadata, audit events, authentication events, and service errors.
For the public demo, BidPilot stores the company, work email, file size, consent version, status, and result counts. It does not save the demo PDF or result in BidPilot’s D1 database or R2 document storage.
Why we use it
We use information to provide and secure BidPilot, authenticate users, process authorized documents, create reviewable analysis, support customers, manage pilots and invoices, communicate about requested services, investigate incidents, comply with law, and improve product reliability. We do not sell personal information.
AI processing
store: false and deletes temporary OpenAI File objects after processing. Standard OpenAI abuse-monitoring logs may still retain customer content for up to 30 days, subject to provider and legal exceptions.BidPilot does not use customer documents to train a shared BidPilot model.
Service providers and location
- Cloudflare: hosting, network security, access control, Workers, D1, R2, and Turnstile.
- OpenAI: API-based document analysis.
- Resend: transactional email.
- Wave: customer and invoice administration; project PDFs are not intentionally sent to Wave.
Providers may process information in Canada, the United States, or other locations where they operate, where it may be subject to lawful access.
Consent and upload responsibility
Customer organizations decide who may upload documents and are responsible for the required rights, tender permissions, notices, and consents. Do not upload payment-card data, passwords, personal health information, government-classified material, malware, or documents prohibited from third-party or AI processing.
Retention and deletion
- Demo PDFs are not saved to BidPilot R2 or D1; the temporary OpenAI File is deleted after the response. The provider retention described above may still apply.
- Customer workspace PDFs and outputs remain during the service term. They are deleted on a verified request or within 30 days after account closure, subject to legal holds and a requested export period.
- Lead records are deleted or anonymized after 24 months without activity, unless the person remains a customer or asks us to retain the relationship.
- Consent, security, audit, invoice, and business records remain only as needed to operate the service, resolve disputes, document authorization, or meet legal obligations.
Deletion from active systems may not immediately remove limited provider security logs or controlled backup copies, which expire under provider and backup cycles.
Safeguards
We use access controls, server-side credentials, TLS, private object storage, audit events, file validation, human approval gates, and least-necessary service access. No online service is risk-free, so customers must independently review output and avoid prohibited data.
Your choices
You may request access, correction, account or project deletion, withdraw consent where applicable, or complain by emailing the Privacy Officer. We may verify identity and authority first. If a concern is unresolved, individuals may contact the Office of the Privacy Commissioner of Canada.
Communications and changes
Operational messages may be required for the service. Marketing messages will identify the sender and include an unsubscribe method where required. Material policy changes will be posted with a new effective date and active customers will receive additional notice where appropriate.