This Privacy Policy explains how Vorapure UK Ltd ("Bidalize", "we", "us") collects and uses personal data when you use our website and application at bidalize.com. We are the data controller for the personal data described here, and we process it in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
Bidalize is a service provided by Vorapure UK Ltd, a company registered in England & Wales under company number 17138078, with its registered office at 167-169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom.
For any privacy question, or to exercise your rights, contact us at hello@bidalize.com.
2. The data we collect
Data you give us
- Account data — your name, work email, company name, and password (stored only in hashed form).
- Uploaded content (Sourcing) — requisitions, request details, supplier quotes and related documents you add to the service, including quotes that suppliers email to your request's quote address (we keep the sender's email address and the text of the email with the quote). These may contain third-party business information such as supplier names, prices, and contact details.
- Supplier lists (Supplier Check) — the supplier lists you upload to be checked: business names and tax registration numbers, and any other columns in your file. A tax number can identify an individual where the supplier is a sole trader, so we treat these lists as personal data where that applies.
- Approver details — the email addresses you enter to send an approval request. Approvers do not hold accounts.
- Support messages — anything you send us by email.
- Tester applications — if your organisation applies to test Bidalize: what it buys, roughly how many quotes it collects a month, its website if you give it, your name and email, the dates of the tester period, and which tester emails we have sent.
- ROI report requests — when you ask for the report at bidalize.com/roi: your name, company, email address, the figures you entered, whether you ticked that we may contact you, and a one-way scrambled form of your IP address (used only to limit how many reports one visitor can request).
Data we collect automatically
- Usage and log data — actions taken in the app (recorded in your organisation's audit trail), plus technical data such as browser type, device, and IP address.
- Cookies — see our Cookie Policy. If you accept Google Ads cookies on our website, Google records that you arrived from one of our ads, and if you then sign up, that a sign-up happened. We use this only to see which ads work.
Payment data
Paid subscriptions are handled by Paddle, our Merchant of Record. Card details are entered with Paddle and we never see or store your full payment card information. We receive confirmation of your subscription status and limited billing metadata. If a payment fails, Paddle emails the person who pays, in our name, to ask them to update the card; the link in that email opens bidalize.com/billing, the one page of this website that loads Paddle's script. If you open the payment window and leave without paying, Paddle sends one reminder email with a link back to it.
3. How we use your data, and our legal basis
| What we do | Legal basis (UK GDPR) |
|---|---|
| Create and run your account; provide the service (reading and comparing quotes, awards and sign-off, supplier checks) | Performance of a contract |
| Process uploaded requisitions and quotes through our AI providers to read them and check them against your requirements | Performance of a contract |
| Send transactional email (invites, approval links, password resets) | Performance of a contract |
| Check your supplier lists against public tax registers and show the results to your organisation | Performance of a contract |
| Keep copies of public tax registers (for example Pakistan's FBR and PRA active-taxpayer lists) to run those checks | Legitimate interests (providing supplier checks); the registers are published by the tax authorities |
| Maintain your organisation's audit trail and secure the service | Legitimate interests (security, accountability) |
| Handle payments and keep billing records | Contract; legal obligation (tax/accounting) |
| Respond to support requests | Legitimate interests |
| Send the ROI report you asked for, keep a record that it was sent, and stop the form being misused | Legitimate interests (providing what you asked for; preventing abuse) |
| Contact you about the ROI report, only if you ticked the box | Consent (you can withdraw it at any time by writing to hello@bidalize.com) |
| Decide on a tester application, run the tester period, and send its emails (the decision, a feedback call invitation, a reminder before it ends) | Legitimate interests (running the tester programme you applied to) |
| Measure which of our Google ads lead to sign-ups | Consent (the cookie banner; change it any time with Cookie settings at the bottom of each page) |
| Limit how many suppliers a free account can email, and refuse sign-ups from temporary email addresses | Legitimate interests (preventing misuse of the service and of our email) |
| Send occasional product or marketing email (if you have opted in) | Consent |
4. Roles: your data vs. your suppliers' data
For your account data, Bidalize is the data controller. For the content you upload — requisitions, supplier quotes, supplier lists and the business information they contain — you (or your organisation) are the controller, and Bidalize acts as your processor: we process that content only to provide the service to you, on your instructions. You are responsible for ensuring you have the right to upload that information.
5. AI processing of your uploads
To read requisitions and quotes, the documents and their extracted contents are processed by third-party AI providers:
- Google (Gemini, Cloud Vision) — reads text from uploaded documents and photos, and extracts the contents of quotes.
- Anthropic (Claude) — reads requisitions into a draft request, checks quotes against your requirements, and helps with calculations you ask for.
Negotiation notes and rankings are worked out from the figures on your comparison sheet; they are not generated by an AI provider. Supplier Check does not send your supplier lists to any AI provider.
These providers process your content to return a result to us; we do not permit them to use your content to train their models under the business terms we use. Extracted data is stored in your account so you can review and edit it.
6. Who we share data with (sub-processors)
We use a small set of trusted providers to run the service. We share only what each needs, under contracts that require them to protect it:
| Provider | Purpose |
|---|---|
| Supabase | Database and authentication hosting |
| Vercel | Website and application hosting |
| Google (Gemini, Cloud Vision) | AI reading of uploaded documents and photos |
| Anthropic (Claude) | AI reading of requisitions, requirement checks, calculations |
| Paddle | Payment processing (Merchant of Record), emails about failed payments, and one reminder email after an unfinished checkout |
| Resend | Transactional email delivery, and receiving quotes suppliers email to a request |
| Google Workspace | Our business email |
| Google Ads | Only if you accept advertising cookies: measuring which of our ads lead to sign-ups |
We do not sell your personal data, and we do not share it for third-party advertising. We do not use remarketing (following you around the web with our ads).
7. International transfers
Some of our providers are based outside the UK, including in the United States. Where personal data is transferred outside the UK, we rely on appropriate safeguards such as UK adequacy regulations or the International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses, as applicable.
8. How long we keep it
- While your account is active — we keep your account data and uploaded content so the service works.
- When a paid plan ends — your organisation moves to the Free plan and its content is kept, so you can still open and download everything. We delete it when you ask us to, or under the rule for unused Free organisations below. Copies in routine backups are overwritten within a further 30 days of deletion. The detail is in the Terms of Service.
- Unused Free organisations — if nobody has signed in for 12 months, we delete the organisation after 30 days' notice by email.
- ROI report requests — kept for up to 2 years, then deleted; sooner if you ask.
- Tester applications — kept with your organisation's account; an application that was declined is deleted after 12 months, or sooner if you ask.
- Billing and tax records — kept for up to 6 years as required by UK law.
- Audit trail records — retained for the life of the organisation's account to preserve the integrity of the procurement record, and deleted with the organisation's content.
- Supplier lists — your current list, and earlier lists you have replaced, are kept so results can be compared over time; they are deleted with your account content, or sooner if you ask.
9. Your rights
Under UK data protection law you have the right to: access your data; correct inaccurate data; request erasure; restrict or object to processing; data portability; and withdraw consent where we rely on it. To exercise any of these, email hello@bidalize.com. We will respond within one month.
If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.
10. Security
We protect your data with encryption in transit, hashed passwords, role-based access controls within your organisation, and database-level access rules. No system is perfectly secure, but we work to keep your data safe and to notify you of any breach affecting your rights as required by law.
11. Children
Bidalize is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children.
12. Changes to this policy
We may update this policy from time to time. We will post the new version here and update the date above; significant changes will be notified by email or in the app.
13. Contact
Vorapure UK Ltd · Company No. 17138078 · 167-169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom
Email: hello@bidalize.com