1. Who we are
BidForge AI is a product of Ultyron, Inc., a Delaware corporation ("Ultyron", "BidForge AI", "we", "us"). We provide a business-to-business software platform that helps construction contractors analyse tender documents, decompose project scopes, and prepare bid proposals. This policy explains what personal information we handle when you or your organisation use the platform at bidforgeai.com and its subdomains (the "Service").
This policy covers the Service only. It does not cover third-party websites we link to, or the separate privacy practices of your own organisation.
Where your organisation holds a subscription, that organisation is the controller of the project data it uploads, and we act as its processor. Ultyron, Inc. is the controller for account, billing, and platform-usage information.
2. What we collect
Account information
Name, work email address, company name, role within the company, and a password stored only as a salted bcrypt hash. We never store your password in a readable form.
Project content you upload
Tender and RFP documents, drawings, specifications, spreadsheets, subcontractor quotes, pricing data, and the analyses and bid proposals the platform generates from them. These may incidentally contain personal information about third parties — for example the names and contact details of project stakeholders — where your documents include them.
Billing information
Subscription plan, billing cycle, invoice history, and the identifiers our payment processor assigns to your organisation. See Payments for what we do not receive.
Technical and usage information
IP address, browser and device characteristics, pages and features used, API request volumes, timestamps, error reports, and audit records of security-relevant actions such as sign-in, document deletion, and billing changes.
3. How we use it
- Providing the Service — analysing your documents, generating estimates and proposals, and storing your work between sessions.
- Account and subscription management — authenticating users, applying plan limits, issuing invoices, and processing renewals and cancellations.
- Support — responding to tickets and investigating faults you report.
- Security and abuse prevention — detecting unauthorised access attempts, enforcing separation between customer accounts, and maintaining audit trails.
- Service improvement — understanding which features are used, and diagnosing performance and accuracy problems in aggregate.
- Legal compliance — meeting tax, accounting, and other statutory obligations.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
4. Legal bases for processing
Where the UK GDPR or EU GDPR applies, we rely on:
- Performance of a contract — to deliver the Service your organisation has subscribed to.
- Legitimate interests — to secure the platform, prevent abuse, and improve the product, balanced against your rights.
- Legal obligation — to retain invoicing records and respond to lawful requests.
- Consent — where we ask for it specifically, which you may withdraw at any time.
5. AI processing of your documents
The Service uses large language models and vision models to read your documents and draft estimates and proposals. To do this, text and images extracted from your uploads are transmitted to third-party AI providers for processing and the results are returned to your workspace.
We do not sell your project data, and we do not use your documents to train our own models. Third-party AI providers process content under their own terms; we do not control those terms, and we do not represent that any particular provider offers zero-retention processing.
Automated outputs require human review
Estimates, scope breakdowns, and proposals produced by the Service are drafts generated by automated systems. They can contain errors and omissions. The platform requires you to confirm that you have verified quantities and prices before exporting a bid, and records that confirmation. No legal or similarly significant decision is made about you by automated means without human involvement.
Reducing what is sent
The platform includes a redaction capability that can replace identifiers such as phone numbers, email addresses, and tax or national identification numbers with placeholder tokens before content is sent to an AI provider, restoring them in the response. Availability depends on your organisation's configuration.
7. Payments
Card payments are processed by Stripe. When you enter card details, they are transmitted directly to Stripe and are handled under Stripe's own privacy policy. We never receive or store your full card number, expiry date, or security code. What we retain is limited to your plan, invoice history, the last four digits and card brand as Stripe reports them, and the customer and subscription identifiers Stripe assigns.
Ultyron, Inc. is the merchant of record for all BidForge AI subscriptions. Invoices and receipts are issued by Ultyron, Inc., and charges may appear on your card or bank statement under either the Ultyron or the BidForge AI name.
9. How we protect your information
Measures currently in place include:
- Encryption in transit — all traffic between your browser and the Service, and between the Service and its providers, is carried over TLS.
- Password protection — passwords are stored only as salted bcrypt hashes and are never logged or transmitted in readable form.
- Separation between customers — every record is bound to an organisation identifier, enforced in application queries and additionally by database-level constraints, so one customer cannot read or modify another's data.
- Role-based access control — permissions are scoped by role, and administrative functions are restricted.
- Audit logging — security-relevant actions such as sign-in, document deletion, billing changes, and export approvals are recorded.
- Access to production systems is limited to personnel who need it to operate and support the Service.
No system can be guaranteed secure. We describe here the controls we actually operate; we do not claim certifications we have not obtained. If we become aware of a breach affecting your personal information, we will notify you and any relevant regulator as required by applicable law.
10. Retention and deletion
We keep your account and project data for as long as your organisation's account is active. When an account is closed, project content is deleted or anonymised, except where we must retain records for legal reasons — most commonly invoices and tax records, which are kept for the statutory period.
You may ask us at any time to delete specific documents or your entire workspace by writing to support@bidforgeai.com. Operational telemetry and audit logs are retained on a rolling window and then removed.
11. International transfers
The Service is operated from, and uses providers located in, the United States and other jurisdictions. If you are in the United Kingdom, the European Economic Area, or another region with data-transfer restrictions, your information may be transferred outside that region.
Where such a transfer takes place, we rely on appropriate safeguards — including the UK International Data Transfer Agreement or Addendum and the European Commission's Standard Contractual Clauses, as applicable. You can request details of the safeguards applying to a specific transfer, and the identities and locations of the providers involved, at support@bidforgeai.com.
12. Your rights
Depending on where you live, you may have the right to:
- access the personal information we hold about you;
- correct information that is inaccurate or out of date;
- request deletion of your personal information;
- receive your data in a portable, machine-readable format;
- object to or restrict certain processing;
- withdraw consent where processing is based on it;
- not receive discriminatory treatment for exercising these rights.
To exercise any of these, write to support@bidforgeai.com. We will respond within the period required by applicable law. If your organisation controls the workspace your data sits in, we may direct your request to them and assist them in answering it.
If you are in the UK or EEA and believe we have not handled your request properly, you may complain to your local supervisory authority.
13. Children's privacy
The Service is a business tool intended for use by professionals. It is not directed to children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us and we will delete it.
14. Changes to this policy
We may update this policy as the Service evolves. When we do, we will revise the "Last updated" date above. If a change materially affects how we handle your personal information, we will give you notice — by email or in the application — before it takes effect.
15. Contact us
Questions about this policy, requests to exercise your rights, requests for our current sub-processor list, or requests for a data processing agreement:
Data controller: Ultyron, Inc., a Delaware corporation, trading as BidForge AI
Email: support@bidforgeai.com