Privacy Policy

Version and last updated: 2026-07-15

Information we collect

We collect account and company details; customer and property records; estimates, proposals, jobs, permits, inspections, invoices, messages, and photos; check-in time and location when you use that feature; and security and diagnostic events needed to operate the Service.

How we use it

We use this information to authenticate users, isolate organization data, provide estimating and field workflows, deliver transactional email, generate documents, protect the Service, diagnose failures, and comply with law. We do not sell personal information.

Storage and security

Data is hosted with Supabase and Vercel. Access is limited by account, organization, and role controls. Browser photo processing removes EXIF metadata, including source-device GPS metadata, before upload. The installed app may retain a minimal, read-only assignment snapshot with job number, trade, status, schedule, and address on the device for up to 12 hours. A pending check-in queue may retain up to 100 check-in or check-out events, including their time and optional location, for up to seven days while awaiting a connection; expired causal chains are discarded the next time the app runs. The assignment snapshot requires an unexpired session and is locked and removed when that session expires. Pending events remain account-partitioned, cannot be replayed as another user, and expire after the retention period above. Explicit sign-out clears both stores before the account session is ended.

Sharing

We disclose data to service providers only as needed to run the Service, including Supabase (database, authentication, and storage), Vercel (hosting), Sequenzy (transactional email), and, when configured, Sentry (privacy-minimized error monitoring). Sentry events are configured to omit default personal information and strip request data, user context, breadcrumbs, and raw error messages before transmission. If an AI review feature is explicitly enabled and used, selected inputs may be sent to the configured provider (Anthropic, Google, or OpenAI). We may also send an address you enter for jurisdiction lookup to Photon/Komoot, the U.S. Census geocoder, or OpenStreetMap Nominatim. BidTorch does not put those raw-address requests in its shared application cache. Crew maps load OpenStreetMap tiles only after an authorized user clicks to load them. Clicking a directions or location link sends the selected address or coordinates to Google Maps. We may also disclose information when required by law or to protect the Service.

Optional analytics

Google Analytics loads only after you choose "Allow analytics." BidTorch excludes quote, proposal, permit-kit, and project-tracking capability URLs and sends sanitized route paths. You can withdraw consent using the Analytics settings button. BidTorch treats supported Global Privacy Control and Do Not Track signals as a decline. Google may receive device, browser, IP-address, and usage information under its own privacy terms when analytics is allowed.

Links you choose to share

Customer quote, proposal, permit-kit, and tracking pages are protected by unguessable capability links, not a customer login. Anyone who has a link may be able to view that page until it expires or is revoked. Do not post these links publicly.

Retention and your rights

We retain organization data while the account is active and as needed for security, legal, backup, and dispute-resolution purposes. Depending on where you live and whether a law applies, you may have rights to know or access, correct, delete, or obtain a copy of personal information; opt out of sale or sharing; limit certain uses of sensitive information; and exercise those rights without discrimination. Contact your organization administrator to start an access, correction, export, or deletion request while BidTorch's monitored privacy contact is being established.

Children and changes

The Service is a business tool and is not directed to children. We may update this policy as the product or its providers change. A material change will receive a new version and, where appropriate, renewed acceptance.