Policies & trust
Privacy Policy
This policy explains what personal data BidBlock collects, why we collect it, where it is stored, how long we keep it and what rights you have. It covers our website, our marketing and the BidBlock application.
The short versionSeven things to know about your data.
- We are a UK company and we follow UK GDPR and the Data Protection Act 2018.
- Your bid content belongs to you. You are the controller of it; we process it to run the service on your instructions.
- Application data is stored on servers in Austria, inside the EU. Backups are encrypted and also held in the EU.
- We do not keep the original files you upload. Documents are parsed and the extracted text is stored; the original file is not retained.
- Some processing happens in the United States — AI, web search, email and analytics. Section 08 explains this and the safeguards.
- Analytics runs on our public website only, never inside the product, and only after you accept analytics cookies.
- We do not sell personal data, and your content is not used to train AI models.
01Who we are
BidBlock is an AI bidding workspace for organisations tendering for public and private sector contracts.
BidBlock is a trading name of SIGNMI AI LTD, a company registered in England and Wales under company number 16756550, incorporated on 1 October 2025, with its registered office at 118 Colindale Avenue, Colindale, London, NW9 5GX. In this policy, "BidBlock", "we", "us" and "our" mean SIGNMI AI LTD.
We are the data controller for the personal data described in this policy, except where we act as a processor — see section 02.
For any data protection question, contact privacy@bidblock.ai. This mailbox is monitored.
Our registration with the Information Commissioner's Office is [ICO registration number to be confirmed].
02Controller and processor
Our role depends on the data involved, and the distinction matters for your rights.
| Data | Our role | What that means |
|---|---|---|
| Account and billing data | Controller | We decide why and how this is processed — to create your account, take payment and support you. |
| Website and analytics data | Controller | We decide what we measure about how our public website is used. |
| Bid content you upload | Processor | Your organisation is the controller. We process tender documents, evidence and drafts on your instructions, under our Data Processing Agreement. |
If your bid content contains personal data — staff CVs, named referees, case studies naming individuals — your organisation remains responsible for it. We process it only to provide the service.
03What we collect
Information you give us
- Account details — name, work email address, password (stored hashed), organisation name and role.
- Billing details — billing name, address and VAT number where applicable. Payments are taken through Stripe's hosted checkout; we never see or store card numbers.
- Bid content — tender documents you upload, evidence library records, drafted responses and anything else you put into your workspace.
- Support and enquiries — the content of messages you send us, including demo and enterprise enquiries.
- Marketing preferences — whether you have consented to product and marketing email.
When you upload a tender document, it is parsed and the extracted text is stored so the product can work with it. The original uploaded file is not retained. This reduces what we hold about you, and it is worth knowing if your own information governance team asks.
Information we collect automatically
- Usage and application logs — actions taken in the product, timestamps and errors encountered, kept for security and diagnostics.
- Access logs — records of who accessed production systems, retained for six months.
- Website analytics — only on our public website, and only with your consent. See section 05.
There is no analytics inside the application. We do not use session recording, a third-party error-tracking platform or a CRM.
Information from other sources
- Public procurement notices — tender notices published by UK public bodies. These are public records, though they may contain buyer contact names published by the buyer.
- Stripe — confirmation of payment status and the last four digits of the card used.
04Why we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Creating and running your account | Performance of a contract |
| Providing the workspace, including analysis and drafting | Performance of a contract |
| Taking payment and preventing fraud | Performance of a contract; legal obligation |
| Service email such as password resets and deadline reminders | Performance of a contract |
| Security, access logging and diagnostics | Legitimate interests — keeping the service secure and available |
| Website analytics | Consent |
| Marketing email | Consent, or soft opt-in for existing customers. Unsubscribe at any time. |
| Improving the product | Legitimate interests — understanding what works and what does not |
| Meeting accounting and legal obligations | Legal obligation |
Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights. You can object to that processing — see your rights.
05Analytics and cookies
We use Google Analytics on our public website only, to understand how people find bidblock.ai and which pages are useful. We use it to improve the site, not to build profiles of individuals or to sell data.
Google Analytics does not run on app.bidblock.ai. We do not use in-app product analytics, session recording or an error-tracking platform. Nothing watches what you do inside your workspace, and nothing records your screen.
What website analytics collects
- Pages viewed and how long was spent on them
- Referring source — a search engine, a link from another site, or a campaign link
- Approximate location at country or region level
- Device type, browser and screen size
Analytics data is retained for 14 months, after which it is deleted.
Your consent
Strictly necessary cookies — the ones that keep you signed in, remember your cookie choice and protect against fraud — are always set, because the service does not work without them.
Google Analytics does not load at all until you accept analytics cookies. If you decline, or ignore the banner, no analytics scripts run and no analytics cookies are set.
You can change or withdraw your choice at any time from our Cookie Policy page or the cookie settings link in the website footer. Withdrawing consent does not affect processing that already took place.
| Category | Purpose | Consent needed |
|---|---|---|
| Strictly necessary | Signing in, session security, remembering your cookie preference. | No |
| Analytics | Google Analytics on the public website only. | Yes |
| Functional | Google Calendar booking on our demo page, and remembering interface preferences. | Yes |
Our Cookie Policy lists the individual cookies we set, what each does and how long it lasts.
Other Google services on our website
- Google Fonts — used for typography on our website. [Confirm whether fonts are self-hosted or loaded from Google's servers — if loaded from Google, your IP address is sent to Google when the page loads.]
- Google Calendar — used for demo booking. If you book a demo, the details you enter go to Google Calendar.
Browsers send a "Do Not Track" signal inconsistently and there is no agreed standard for responding to it, so we do not rely on it. Use the cookie banner or the cookie settings link instead — those choices we do act on.
06How AI processing works
BidBlock uses AI to analyse procurement documents, match evidence to questions and draft responses. This matters for your data, so we are specific about it.
- We use OpenAI to process AI requests. Content is sent to OpenAI solely to produce the output you asked for.
- Your content is not used to train OpenAI's models. API data is excluded from training by default.
- OpenAI may retain API data for up to 30 days for abuse and misuse monitoring, after which it is deleted.
- OpenAI processes in the United States. See section 08 on international transfers.
- We use Tavily for public web searches. Tavily receives only short search phrases — never your tender documents, your evidence or your drafted responses.
- Outputs are stored in your workspace and visible only to people you have given access to.
Every response should be reviewed by someone in your organisation before submission, because everything in a bid becomes contractual on award. We built the product on that assumption and we would rather say so than imply otherwise.
Our AI and Data Use Policy sets out the detail.
08Where your data is stored, and international transfers
Your application data stays in the EU
The BidBlock application runs on netcup servers in Austria. That is where your account, the parsed text of your tender documents, your evidence library, your drafted responses and our application logs are stored. Encrypted nightly backups are held separately, also within the EU, and kept for 30 days.
We are a UK company, so moving personal data from the UK to the EU is a restricted transfer under UK GDPR. The UK government has made adequacy regulations covering the EEA, which means these transfers are permitted without additional safeguards.
Some processing happens in the United States
We want to be straightforward about this rather than bury it. Several of our providers process data in the US:
- OpenAI — receives the content needed to produce an AI output. This includes text from your tender documents and your evidence.
- Tavily — receives short search phrases only.
- Stripe — receives billing details you enter at checkout.
- Resend — receives the email address and content of emails we send you.
- Google — receives website analytics data, if you have consented, and demo booking details if you book one.
The United States does not have UK adequacy regulations covering all transfers. For these transfers we rely on:
- the UK Extension to the EU–US Data Privacy Framework where the provider is certified under it; or
- the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment and any additional measures needed.
The specific mechanism for each provider is recorded in our sub-processors list. You can request a copy of the relevant safeguards by emailing privacy@bidblock.ai.
Some public sector contracts require all processing to stay within the UK, and a few require it to stay within the UK and EEA with no US involvement. BidBlock does not currently meet a UK-only requirement, because AI processing happens in the US.
If that applies to a contract you are bidding for, contact us at privacy@bidblock.ai before you sign up, so you find out now rather than at due diligence.
09How long we keep it
| Data | Retention |
|---|---|
| Original uploaded files | Not retained — parsed, then discarded |
| Items you delete in the product | Recoverable for 30 days, then permanently deleted |
| Account and bid data after account closure | Deleted within 30 days; removed from backups within a further 30 days |
| Encrypted backups | 30 days, rolling |
| Production access logs | 6 months |
| Website analytics | 14 months |
| Content sent to OpenAI | Up to 30 days for abuse monitoring, then deleted by OpenAI |
| Billing records | 6 years, to meet UK accounting requirements |
| Support correspondence | [period to confirm] |
| Marketing list | Until you unsubscribe, then a suppression record so we do not email you again |
You can delete individual records from your workspace at any time. You can request deletion of your whole account by emailing us.
10How we protect it
- Encryption in transit — HTTPS is enforced across the website and the application.
- Encrypted backups — nightly, held separately within the EU.
- Restricted production access — SSH-key-only access to production servers, limited to named authorised staff.
- Access logging — records of production access retained for six months.
- Separation between customers — customer records are held in a shared database and separated by organisation-level access controls, so one customer cannot see another customer's content.
- Disk encryption at rest on the live server — [being confirmed with netcup].
No system is completely secure. If a breach affects your personal data and is likely to result in a risk to your rights, we will notify the ICO within 72 hours of becoming aware, and tell you without undue delay where the risk is high.
Our Security Statement has more detail, including what we can provide for supplier due diligence.
11Your rights
Under UK GDPR you have the right to:
- Access a copy of the personal data we hold about you
- Rectification of data that is inaccurate or incomplete
- Erasure of your data in certain circumstances
- Restrict how we process your data
- Object to processing based on legitimate interests, and to direct marketing at any time
- Data portability — you can export your tender, bid and evidence data in CSV or JSON format directly from the product
- Withdraw consent where we rely on it, including for analytics cookies and marketing email
To exercise any of these, email privacy@bidblock.ai. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.
If your request concerns bid content held in a workspace belonging to an organisation you work for, that organisation is the controller and we will direct the request to them.
If you are unhappy with how we have handled your data, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, or by calling 0303 123 1113.
12Children
BidBlock is a business tool and is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
13Changes to this policy
We may update this policy as the product and the law change. The date at the top shows when it was last updated. If a change materially affects how we use your personal data — for example adding a new provider that processes your content — we will tell you by email or in the product before it takes effect.
Previous versions are available on request.
14Contact us
- Email: privacy@bidblock.ai
- Post: SIGNMI AI LTD, 118 Colindale Avenue, Colindale, London, NW9 5GX
- Company number: 16756550
Related documents: Terms of Service · Cookie Policy · AI & Data Use Policy · Data Processing Agreement · Sub-processors · Security Statement