Outbidd Privacy Policy

1. INTRODUCTION

Outbidd Inc. ("Outbidd," "we," "us," or "our") is committed to protecting your privacy and handling information responsibly. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you access or use the Outbidd platform, websites, applications, vendor portal, and related services (collectively, the "Platform").

This Privacy Policy is incorporated into and forms part of our Terms of Use. Capitalized terms not defined here have the meaning given in the Terms of Use.

2. Who This Policy Applies To

‍The Platform serves two categories of users, and this Policy applies to both, as well as to visitors to our websites:

‍Organizations. Customers that subscribe to the Platform to manage construction projects from the owner's side, together with the individual account holders and authorized users who access the Platform under that subscription.

‍Invited Users (Vendors). Architects, engineers, general contractors, subcontractors, suppliers, designers, consultants, and other project stakeholders that an Organization invites to participate in its projects.

3. Our Role and Responsibility for Data

Outbidd handles data in two different capacities, and this affects your rights and where to direct requests:

‍As a business (controller). For the information you provide when you register and interact with us directly, such as your account details, and for the usage and technical information we collect automatically, Outbidd decides how that information is used and acts as the responsible business.

‍As a service provider (processor). For the project content and data that an Organization uploads or generates on the Platform ("Customer Data"), including bids, RFI responses, documents, and information about the Organization's own projects and clients, Outbidd processes that data on the Organization's behalf and according to the Organization's instructions and the agreement between Outbidd and that Organization. If you are an Invited User or an individual whose information appears in an Organization's project, and you want to access, correct, or delete that information, you should generally direct your request to the Organization that controls the project. We will assist the Organization as required by our agreement and applicable law.

4. Information We Collect

4.1 Information you provide directly.

- Account information, such as name, email address, phone number, company name, job title, and business details. Account creation, sign-in, and password management are handled by a third-party identity and authentication provider acting on our behalf, and we do not store your password. We access account profile information, such as your name and email address, to operate the Platform.
- Billing and payment information for Organizations (payment card details are handled by our payment processors, not stored by us).
- Project and business data, such as project details and specifications, bid submissions and pricing, cost codes and timelines, contractor and vendor information, project documents and plans, in-platform communications, and RFI submissions and responses.
- Support and communications, such as support tickets, feedback, survey responses, and correspondence with our team.

‍4.2 Information we collect automatically.

- Usage information, such as the features you use, actions taken, and frequency of use.
- Technical information, such as IP address, device identifiers, browser type, operating system, and log data.
- Performance and analytics information, such as performance metrics and error reports, and cookies and similar technologies as described in Section 11.

‍4.3 Information from third parties.

- Information from payment processors and from third party services you or an Organization integrate with the Platform.
- Information from the Organization that invites you, such as your name and role, when you are an Invited User.
- Business information from public sources and referral partners.

4.4 Information about other people. Organizations and Users may upload information about third parties, such as their personnel or clients. If you submit information about another person, you represent that you have the right to do so and to allow us to process it to provide the Platform. We rely on you to provide any notices and obtain any consents required for that information.

‍4.5 Sensitive information. The Platform is not designed to collect sensitive personal information such as government identifiers, health data, biometric data, or precise geolocation. Please do not submit sensitive personal information unless it is necessary for the Platform, and only where you have the right to do so.

5. How We Use Information

‍5.1 To provide and operate the Platform. To create and manage accounts, authenticate users, deliver features, facilitate communication and collaboration between Users, generate reports and analytics for the relevant Organization, process transactions and subscriptions, and provide support.

‍5.2 To secure and improve the Platform. To monitor performance, diagnose and fix problems, prevent fraud and abuse, maintain security, and develop and improve features.

‍5.3 AI and model improvement. We use data to develop and improve the artificial intelligence and machine learning models that power the Platform's bid analysis, scope gap detection, pricing predictions, and future AI features. Before data is used for this model-improvement purpose, customer names, company identifiers, and specific project names are removed or replaced with generic identifiers, and the data is combined with data from other Users so that outputs do not identify you or your projects. Data that may be used in de-identified and aggregated form for this purpose includes project types and sectors, general descriptions, geographic locations at the city or state level, bid amounts and cost breakdowns by division, contractor pricing patterns and historical bid data, project square footage, timelines, and scope, and differences between bid amounts and realized costs. We do not sell your identifiable data, and we do not share your identifiable bid data with your competitors.

‍5.4 Automated processing. The Platform generates outputs such as bid analyses and pricing predictions to support your decisions. These outputs are decision-support tools, not automated decisions made about you, and you remain responsible for verifying information and making your own project decisions.

‍5.5 Business analytics. To analyze market and industry trends and to generate benchmarks and insights, in de-identified or aggregated form that does not identify you or any specific project.

‍5.6 Communications. To send service and account notifications, billing information, security alerts, and, where permitted, product updates and marketing. You can opt out of marketing communications at any time.

‍5.7 Legal and compliance. To comply with legal obligations, respond to lawful requests, enforce our Terms of Use, and protect the rights, property, and safety of Outbidd, our Users, and others.

‍5.8 Marketing use of business identifiers. Where permitted by the applicable customer agreement, we may identify an Organization as a customer using its company name and logo. This use is governed by that agreement and does not involve using your personal information beyond identifying the Organization.

6. How We Share Information

6.1 Within the Platform. With the Users entitled to access a given project, including team members within an Organization and the Invited Users the Organization brings onto a project. If you are an Invited User, your activity and submissions on a project are visible to the Organization that invited you and to others it authorizes.

‍6.2 Service providers and subprocessors. With trusted vendors that perform services for us, such as cloud hosting and infrastructure, identity, authentication, and account management, payment processing, customer support, analytics, security, and generative AI or large language model providers that power Platform features. These providers are bound by contract to use the information only to provide services to us and to protect it.

‍6.3 Business transfers. In connection with a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to appropriate confidentiality protections.

‍6.4 Legal requirements. When required by law, court order, or governmental request, or to protect the rights, property, or safety of Outbidd, our Users, or others.

‍6.5 De-identified and aggregated data. We may use and share data that has been de-identified or aggregated so that it cannot reasonably be used to identify you, such as industry trends, benchmarks, and research insights.

‍6.6 No sale or sharing. We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act and similar state laws.

7. Data Retention

7.1 Organization Customer Data. Customer Data is retained for the period set out in the applicable agreement between Outbidd and the Organization. Under our standard terms, Customer Data is retained during the subscription term and for a limited period afterward (generally 90 days for export), after which it is deleted, with backup copies retained for a limited additional period (generally up to 180 days) in accordance with our backup procedures.

‍7.2 Account and business records. We retain account and business records for as long as your account is active and for a reasonable period afterward as needed to meet legal, tax, accounting, security, and dispute-resolution requirements.

‍7.3 De-identified and aggregated data. Data that has been de-identified and aggregated so that it cannot identify you or any specific project may be retained indefinitely.

‍7.4 Legal holds. We may retain information longer where required to comply with a legal obligation or to preserve it in connection with an actual or anticipated legal matter.

8. Data Security

We implement administrative, technical, and physical safeguards designed to protect information, including encryption of data in transit and at rest, multi-factor authentication and access controls, role-based access for project data, audit logging, regular security assessments, and employee training. User credentials and authentication are managed by a specialized third-party identity provider, and we do not store user passwords ourselves. Given the sensitivity of construction bid information, we apply additional protections such as isolation of competitive bid information and secure document handling.

No system is completely secure, and we cannot guarantee absolute security. In the event of a data breach affecting personal information in our custody, we will investigate and contain the incident, notify affected Users and, where we act as a service provider, the relevant Organization, and cooperate with authorities, in each case as required by applicable law and our customer agreements.

9. Your Privacy Rights

Depending on where you live and the capacity in which we hold your information, you may have the right to:

- Access the personal information we hold about you and obtain a portable copy.
- Correct inaccurate personal information.
- Request deletion of your personal information, subject to legal and business exceptions.
- Opt out of the sale or sharing of personal information, and limit the use of sensitive personal information (as noted above, we do not sell or share personal information or use sensitive personal information beyond providing the Platform).
- Object to or restrict certain processing, and opt out of marketing communications.
- Not be discriminated against for exercising your rights.
- Appeal a decision we make about your request, where provided by law.

‍How to exercise your rights. Contact us at [email protected]. We may need to verify your identity before acting on a request. We will respond within the time required by applicable law, generally within 45 days, and will tell you if we need an extension where permitted. You may use an authorized agent to submit a request on your behalf.

‍Requests about project data. If your request concerns information contained in an Organization's project (Customer Data for which we act as a service provider), we will refer you to, or coordinate with, the Organization that controls that data.

10. US State Privacy Rights

Residents of states with comprehensive privacy laws, including California, Virginia, Colorado, Connecticut, and others, have the rights described in Section 9, subject to each law's specific terms and exceptions.

‍California. Under the California Consumer Privacy Act as amended by the California Privacy Rights Act, California residents have the rights to know, access, correct, delete, and port their personal information, and to opt out of the sale or sharing of personal information and limit the use of sensitive personal information. We collect the categories of personal information described in Section 4 for the purposes described in Section 5, retain it as described in Section 7, and disclose it to the categories of recipients described in Section 6. We do not sell or share personal information as those terms are defined under California law, and we do not use or disclose sensitive personal information beyond the purposes permitted without an option to limit. To exercise your rights, use the "Your Privacy Choices" link where offered or contact us at [email protected].

‍Other states. Residents of other states with comprehensive privacy laws have equivalent rights, including the right to access, correct, delete, and port personal information, to opt out of targeted advertising, sale, and certain profiling, and, in most states, to appeal a denied request. We honor recognized universal opt-out mechanisms, such as the Global Privacy Control, where required by law.

11. Cookies and Tracking Technologies

We use cookies and similar technologies that are essential for the Platform to function, that help us analyze usage and performance, and that remember your preferences. We may use third party analytics services, such as Google Analytics, to understand how the Platform is used. You can control cookies through your browser settings, and we honor recognized opt-out signals where required. Disabling certain cookies may affect Platform functionality.

12. Cookies and Tracking Technologies

The Platform is operated from the United States and is intended for users in the United States. If you access the Platform from outside the United States, you understand that your information will be processed in the United States, where data protection laws may differ from those in your location, and you consent to that processing.

13. Children's Privacy

The Platform is not intended for anyone under 18 years of age, and we do not knowingly collect personal information from children. If we learn that we have collected information from a child, we will take steps to delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of material changes by email or through the Platform and will update the "Last Updated" date. Your continued use of the Platform after an update takes effect constitutes acceptance of the revised Policy.

12. CONTACT INFORMATION

Questions or requests regarding this Privacy Policy may be directed to:

Outbidd Inc.
Privacy requests, questions, and general support: [email protected]

‍We will respond to privacy inquiries within the time required by applicable law.

This Privacy Policy is effective as of the date last updated and applies to all users of the Outbidd Platform.