This Privacy Policy describes how Bid4Grid ("Platform", "we", "us", or "our") collects, uses, and shares your personal information when you use our application and any associated services (the "Service"). Bid4Grid is operated by a company based in Marietta, Georgia, USA.
When you access the Service, we automatically collect certain information about your device and session, including your web browser, IP address, time zone, and authentication tokens. We refer to this as "Device Information".
We collect Device Information using the following technologies:
We also collect data you provide directly when you register for an account, update your profile and security settings, submit or update a seller profile, create or respond to a buyer RfQ or Bid, list or update an Inventory item, complete evaluation scoring forms, request a Buyer or Seller seat package, or contact us via email.
The information you provide may include:
localStorage (scoped to your company) and are not transmitted to our servers unless you
use them in a reservation or lot record.We may also receive your Personal Information from third parties such as business partners, referral partners, or service providers involved in operating the Platform.
We use the information we collect for the following purposes and legal bases where applicable.
We process personal data where required to comply with applicable laws and regulations.
Where we send non-essential marketing communications, we will do so only with your explicit consent. You may withdraw consent at any time by contacting us. Withdrawal does not affect processing carried out before withdrawal.
We do not sell your Personal Information. We may disclose it to third parties in the following categories, solely as necessary to operate the Service:
We require third-party providers to process your data only as needed to provide services to us and in accordance with applicable data-protection requirements. We may also disclose your Personal Information to comply with applicable laws, respond to a subpoena or search warrant, or protect our rights.
Intra-platform compliance document access: Compliance documents uploaded by Sellers are accessible within the Platform to (a) Buyers reviewing Award Recommendations via the bid review panel, and (b) Platform administrators for audit and oversight purposes. Documents are not accessible to Evaluators through the scoring view, and are not exposed publicly. Document files are served through restricted links issued only to authorised roles at the point of access. Datasheet and warranty files an Evaluator can open have any Seller or manufacturer company name, and any email address or website containing it, automatically redacted from the file's searchable text before it is served. This text-based process cannot reliably remove identity information embedded in scanned pages, images, or logos. Where AI-Assisted evaluation is enabled, the Platform may use the Buyer's configured AI provider to attempt to identify and redact logos; this is a best-effort enhancement and is not guaranteed.
Inventory documents and photos: When a Buyer attaches an Inventory listing to an RfQ, the listing’s Technical Specifications documents are copied to the resulting Bid. From then on they are treated like any other Bid document: available to the Buyer and, with the redaction described above, to Evaluators. Specs the Seller adds to the listing later are copied to that listing’s open Bids too. Listing photos are shown in the marketplace and load from a link that does not require login, so anyone with the link can view them. Do not include personal or confidential information in listing photos.
When you reserve or purchase an Inventory listing, your identity as the reserving or purchasing Buyer is not shown to other Users in marketplace listing views — listings appear only as Reserved or Sold to the wider market, without revealing who reserved or bought them. However, when you submit a Standalone reservation (reserving a listing directly from the catalog without an existing RfQ), the delivery address you provide (contact name, email, phone, street, city, state, ZIP) is made visible to the listing seller so they can prepare fulfilment. No other identifying information is disclosed through that workflow. If you do not wish to share a delivery address, do not submit a Standalone reservation.
Buyer-provided AI access (optional): A Buyer company may enable AI-Assisted evaluation in its company settings, connecting its own AI provider account using an API key the Buyer supplies and controls. When active, RfQ and Bid documents for that company's evaluations are sent to the AI provider and endpoint the Buyer has configured. We store that API key encrypted and use it only to make requests on the Buyer's behalf while AI-Assisted evaluation is enabled; we do not use it for any other purpose and never display it back to any User. We do not control, and are not responsible for, how the Buyer's chosen AI provider stores, processes, retains, or otherwise uses data submitted to it — Buyers should review their own AI provider's privacy and data-retention practices before enabling this feature. In Standard mode (the default), no document data is sent to any AI provider.
We process and store data using application hosting, database, caching, background-processing, authentication, and outbound email services needed to operate the Platform.
Uploaded documents are stored in private Cloudflare R2 object storage. Access is provided through the Platform only to authorised users and is not made publicly available by the storage service. Inventory listing photos are the exception described in Section 3.
Optional MFA codes may be delivered through configured email or phone-based delivery providers, depending on the settings available for the Service.
No data transmission over the internet can be guaranteed to be 100% secure; you submit your information at your own risk.
When your data is no longer required, we securely delete or anonymise it where reasonably practicable and consistent with legal, audit, and operational requirements. You may also request deletion; see Section 9.
In the event of a personal data breach, we will assess the incident and provide notices required by applicable law. Where notification is required, we will provide notices in accordance with applicable law.
Notification, where required, may describe the nature of the breach, likely consequences, and measures taken or proposed.
The Service is intended for use by business professionals and is not directed at anyone under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected such data, we will delete it promptly.
We use session cookies and authentication tokens that are strictly necessary for the operation of the Service — specifically, to maintain your authenticated session. These are not used for advertising or behavioural tracking.
Because we use only strictly necessary cookies, we do not require your prior consent to place them where applicable law permits. However, you may configure your browser to refuse cookies; doing so may prevent you from logging in or using core features of the Service.
We do not use third-party advertising or cross-site tracking cookies.
By registering for an account, you agree to receive transactional emails including account verification links, password-reset emails, and operational notifications related to RfQs and Bids you are involved in.
You have the right to stop receiving non-essential marketing communications at any time by contacting us. Opting out of transactional emails may affect your ability to use the Service.
Depending on your jurisdiction, you may have rights to access, correct, delete, restrict, export, or object to certain processing of your personal data, or to request review of certain automated decisions where applicable law provides that right.
We will respond to privacy requests within the timeframe required by applicable law. We may need to verify your identity before acting on a request.
Additional privacy rights may apply depending on your location. If international transfer, sensitive personal information, complaint, or regulator-notice rules apply to your use of the Service, we will handle those matters as required by applicable law. You may contact us to exercise available rights or raise a privacy complaint.
This Privacy Policy applies only to Bid4Grid. We are not responsible for the data collection, privacy practices, or policies of any third-party site we may link to. We encourage you to read the privacy statements of any other sites you visit.
We may update this Privacy Policy from time to time. The date of the last revision is indicated at the top of this page. Where changes are material, we may notify you by email or by a prominent notice on the Platform before the change takes effect, where required by applicable law. Continued use of the Service after the effective date constitutes acceptance of the updated policy.
Please contact us if you have any complaints about how we handle your Personal Information. Depending on your jurisdiction, you may also have the right to lodge a complaint with a regulator or consumer protection authority.
For questions about this Privacy Policy, to exercise your data protection rights, or to raise a complaint, please contact Bid4Grid Administration:
Email: contact@bid4grid.com
Post: Bid4Grid Administration, Marietta, Georgia, USA. Full address available on request.
We aim to respond to administrative data requests within 30 days where practicable and in accordance with applicable law.