This Privacy Policy explains how Vorapure UK Ltd ("Bidalize", "we", "us") collects and uses personal data when you use our website and application at bidalize.com. We are the data controller for the personal data described here, and we process it in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
Bidalize is a service provided by Vorapure UK Ltd, a company registered in England & Wales under company number 17138078, with its registered office at 167-169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom.
For any privacy question, or to exercise your rights, contact us at hello@bidalize.com.
2. The data we collect
Data you give us
- Account data — your name, work email, company name, and password (stored only in hashed form).
- Uploaded content — the supplier quotes, RFP details, and related documents you add to the service. These may contain third-party business information such as vendor names, prices, and contact details.
- Approver details — the email addresses you enter to send an approval request. Approvers do not hold accounts.
- Support messages — anything you send us by email.
Data we collect automatically
- Usage and log data — actions taken in the app (recorded in your organisation's audit trail), plus technical data such as browser type, device, and IP address.
- Cookies — see our Cookie Policy.
Payment data
Subscriptions are handled by Paddle, our Merchant of Record. Card details are entered with Paddle and we never see or store your full payment card information. We receive confirmation of your subscription status and limited billing metadata.
3. How we use your data, and our legal basis
| What we do | Legal basis (UK GDPR) |
|---|---|
| Create and run your account; provide the core service (reading, scoring, and comparing quotes) | Performance of a contract |
| Process uploaded quotes through our AI providers to extract and score them | Performance of a contract |
| Send transactional email (invites, approval links, password resets) | Performance of a contract |
| Maintain your organisation's audit trail and secure the service | Legitimate interests (security, accountability) |
| Handle payments and keep billing records | Contract; legal obligation (tax/accounting) |
| Respond to support requests | Legitimate interests |
| Send occasional product or marketing email (if you have opted in) | Consent |
4. Roles: your data vs. your suppliers' data
For your account data, Bidalize is the data controller. For the content you upload — supplier quotes and the business information they contain — you (or your organisation) are the controller, and Bidalize acts as your processor: we process that content only to provide the service to you, on your instructions. You are responsible for ensuring you have the right to upload that information.
5. AI processing of your uploads
To read and evaluate quotes, the documents and their extracted contents are processed by third-party AI providers:
- Google (Gemini) — reads and extracts the contents of uploaded quotes.
- Anthropic (Claude) — provides scoring reasoning, recommendations, and negotiation intelligence.
These providers process your content to return a result to us; we do not permit them to use your content to train their models under the business terms we use. Extracted data is stored in your account so you can review and edit it.
6. Who we share data with (sub-processors)
We use a small set of trusted providers to run the service. We share only what each needs, under contracts that require them to protect it:
| Provider | Purpose |
|---|---|
| Supabase | Database and authentication hosting |
| Vercel | Website and application hosting |
| Google (Gemini) | AI reading/extraction of uploaded quotes |
| Anthropic (Claude) | AI scoring, recommendations, negotiation intelligence |
| Paddle | Payment processing (Merchant of Record) |
| Resend | Transactional email delivery |
| Google Workspace | Our business email |
We do not sell your personal data, and we do not share it for third-party advertising.
7. International transfers
Some of our providers are based outside the UK, including in the United States. Where personal data is transferred outside the UK, we rely on appropriate safeguards such as UK adequacy regulations or the International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses, as applicable.
8. How long we keep it
- While your account is active — we keep your account data and uploaded content so the service works.
- After cancellation — your account content is retained for up to 90 days and then deleted, unless you ask us to delete it sooner.
- Billing and tax records — kept for up to 6 years as required by UK law.
- Audit trail records — retained for the life of the organisation's account to preserve the integrity of the procurement record.
9. Your rights
Under UK data protection law you have the right to: access your data; correct inaccurate data; request erasure; restrict or object to processing; data portability; and withdraw consent where we rely on it. To exercise any of these, email hello@bidalize.com. We will respond within one month.
If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.
10. Security
We protect your data with encryption in transit, hashed passwords, role-based access controls within your organisation, and database-level access rules. No system is perfectly secure, but we work to keep your data safe and to notify you of any breach affecting your rights as required by law.
11. Children
Bidalize is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children.
12. Changes to this policy
We may update this policy from time to time. We will post the new version here and update the date above; significant changes will be notified by email or in the app.
13. Contact
Vorapure UK Ltd · Company No. 17138078 · 167-169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom
Email: hello@bidalize.com