1. Who this policy covers
This policy explains how Sidlaks Technologies ("we", "us"), operator of the Bid Readiness Toolkit ("the Platform"), collects, uses, stores, and protects personal data. Under India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), we act as the Data Fiduciary for your account and billing information, and you are the Data Principal. For content you upload — tender documents that may contain personal data of third parties, such as signatories on a bid — we process that data only as your agent, solely to provide the service you've asked for.
2. Information we collect
Account information: your name, email address, and password (stored as a salted hash by our authentication provider — we never see or store it in plain text).
Company and billing information: your organization's legal name, GST number(s), CIN, PAN, and — if you provide them for bid documentation — bank account and IFSC details. This is stored to help you prepare bids, not for our own billing, which is handled separately by Razorpay (see below).
Content you upload: tender notices, bid documents, compliance certificates, and other files you upload for a tender, along with the structured data our AI extracts from them.
Usage data: which features you use, when documents are processed, and how much AI processing each run consumes — kept indefinitely as an internal record, used for capacity planning and to detect misuse (such as one tender's data being reused to disguise a second, unrelated tender).
Payment information: if you subscribe, Razorpay processes and stores your payment method directly — we only ever receive a subscription ID, plan, and the amount charged. We never see or store your card, UPI, or bank login details.
Technical data: IP address and browser information collected by our bot-protection provider (Cloudflare Turnstile) when you sign up or log in, to keep the Platform free of automated abuse.
3. How we use your information
We use your information to: operate the Platform and the features you use (document extraction, compliance checks, cost estimation, bid compilation); process your subscription and generate receipts/tax invoices; respond to support requests submitted through Contact Us; detect fraud and abuse; and meet our own legal and tax-filing obligations. We do not sell your personal data, and we do not use your uploaded tender documents for anything other than providing the Platform to you.
4. AI processing of your documents
When you upload a document, its contents are sent to Anthropic's Claude API to extract structured data, assess qualification criteria, and draft compliance documents. Anthropic processes this content solely to return a response to us and, under Anthropic's own commercial API terms, does not use data submitted through its API to train its models. We retain the extracted results and a record of that processing run (see "Usage data" above) as part of your account's data on the Platform.
5. Who we share data with
We share data only with the service providers that help us run the Platform, each bound to use it solely for that purpose:
- Anthropic — AI processing of uploaded documents (see above).
- Razorpay — payment processing and subscription billing.
- Supabase — our database and file storage.
- Vercel — application hosting.
- Resend — transactional emails (e.g. billing notifications).
- Cloudflare — bot protection on sign-up and login.
We disclose data to government or regulatory authorities only where legally required to. We do not sell or rent your personal data to third parties for their own marketing purposes.
6. Storage, security, and retention
Your data is stored with Supabase, with database-level access rules that restrict every organization to its own data. Billing records (receipts and tax invoices) are retained indefinitely to meet GST record-keeping requirements. Tender and document data is retained for as long as your account is active, and you may request deletion of your account and its data at any time via Contact Us, subject to what we're legally required to keep (such as billing records already issued).
7. Your rights under the DPDP Act
As a Data Principal under India's DPDP Act, you have the right to: access a summary of the personal data we hold about you; request correction or erasure of it; withdraw any consent you've given, as easily as you gave it; nominate another individual to exercise these rights on your behalf in the event of death or incapacity; and register a grievance with us before approaching the Data Protection Board of India. To exercise any of these rights, contact us as described below.
8. Grievance Officer
For privacy questions, data requests, or grievances, contact our Grievance Officer at hello@bidreadinesstoolkit.com, or through the Contact Us page if you already have an account. We aim to acknowledge grievances within a reasonable time and resolve them as required under applicable law.
9. Cookies
We use only the essential cookies our bot-protection provider (Cloudflare Turnstile) sets during sign-up and login. We do not use advertising or cross-site tracking cookies.
10. Children's privacy
The Platform is a business tool intended for organizations bidding on government tenders and is not directed at, or knowingly used by, children.
11. Changes to this policy
We may update this policy from time to time. Continued use of the Platform after an update constitutes acceptance of the revised policy.
12. Contact
Questions about this policy, or requests relating to your personal data, can be sent to hello@bidreadinesstoolkit.com or, if you already have an account, through the Contact Us page. See also our Terms of Service.