Privacy Policy

1. Who we are and when this policy applies

Larry NeJame LLC DBA BidGroove operates BidGroove. Our mailing address is PO Box 2445, Goldenrod, FL 32733, United States. This policy covers our website, account administration, contractor proposal service, and related support communications.

For account administration, security, billing, and our own business operations, we determine why and how personal information is used. For customer and project information a contractor uploads, we generally process information on that contractor’s instructions as its service provider or processor, as those terms apply under relevant law.

A contractor separately determines what information to put into a proposal, whom to contact, and how to use or retain its business records. Its own privacy practices and legal obligations also apply. If you receive a proposal, contact the contractor about the project, its communications, and its use of your information. We can assist with requests about our own processing or route a request to the responsible business.

2. Information we collect

We collect information that you, your company, a contractor, a proposal recipient, or a service provider supplies in connection with the service:

• Account and company information: name, email address, authentication information, company name, business address and contacts, logo, licensing or insurance details supplied by the company, team membership, roles, and workspace preferences.
• Customer and project records: customer names and contact details, property addresses, descriptions, measurements, inspection notes, photographs and captions, scope, materials, pricing, taxes, payment schedules, terms, and related documents or information users choose to include.
• Proposal activity and acceptance evidence: recipient email, selected packages and upgrades, acknowledgments, typed signature and printed name, verification and signing events, document versions, timestamps, IP address, browser user agent, and other audit information captured during delivery, viewing, and acceptance.
• Subscription information: plan, seats, billing contacts, provider customer and subscription identifiers, payment status, invoices, and relevant transaction events. This includes trial start and end dates, usage allowances, and checkout consent records. Company details may be saved while payment setup is incomplete. Stripe handles payment credentials submitted to its checkout during signup or later billing changes, including cards saved for automatic billing after a trial; we do not receive or store full payment-card numbers or security codes in our application.
• Communications and technical data: information in support requests and reports, registration agreement records, request and error logs, device or browser details, network addresses, session identifiers, and security or operational events.
• Optional analytics and guidance: consent choices and their timestamps, minimal product milestone identifiers, campaign source labels, checklist progress, and delivery or unsubscribe status.

3. Where information comes from

We receive information when you register, manage a workspace, create or receive a proposal, verify an email, sign a document, purchase a subscription, or contact us. A contractor may enter information about a customer who has no BidGroove account.

Our systems and infrastructure providers generate technical logs and record service events. Payment and delivery providers return statuses and identifiers. If enabled and used, Google address lookup returns suggested address or place information based on text submitted through that feature. We do not independently verify all information users submit.

4. How we use information

We use information for the following purposes:

• Create and secure accounts, authenticate users, apply company permissions, and keep workspace records separated.
• Prepare, calculate, store, display, deliver, and export proposals and PDFs; record customer choices and electronic acceptance; and maintain document history.
• Administer trials, subscriptions, creator seats, invoices, cancellations, and payment reconciliation.
• Respond to requests, troubleshoot problems, maintain and improve reliability, and communicate important account or service information.
• Detect abuse, protect users and systems, enforce agreements, maintain evidence of transactions and policy acceptance, meet legal obligations, and establish or defend legal claims.
• Understand service performance using operational information and aggregate or deidentified information. We do not use private proposal content to train a general-purpose AI model as part of the current service.

5. When we disclose information

We disclose information only for purposes connected with the service, your instructions, or other lawful grounds described here:

• Your company and authorized users: workspace owners, administrators, and other permitted members can access records according to their roles. Information created within a company workspace may remain with that company when an individual leaves.
• Proposal recipients and people you authorize: sending or sharing a proposal makes its customer-facing content available through the delivery or sharing method used. Signatures and acceptance records are available to the contractor and through the applicable document access controls.
• Service providers: infrastructure, database/authentication/storage (Supabase), hosting when deployed on Vercel, transactional email through Resend (or Postmark when configured), and subscription processing through Stripe. These providers receive the information needed for their functions. Optional Google address lookup receives the submitted search text and related request information when used. When enabled, PostHog receives optional product analytics and Inngest coordinates scheduled setup guidance. Resend also delivers optional guidance emails. We restrict provider data to what is needed for each function.
• Legal and safety recipients: where reasonably necessary to comply with a binding legal obligation or lawful process, prevent fraud or harm, investigate security issues, or protect legal rights. We consider the scope and validity of requests as appropriate.
• Business transactions: potential or actual advisers, acquirers, or successors in a merger, financing, reorganization, or sale, subject to appropriate confidentiality and applicable privacy requirements.
• Other recipients: when you direct us to share information or separately authorize a use requiring your consent.

6. Shared links, downloads, and external sites

Proposal links are intended for the contractor and its chosen recipients, but anyone who obtains a working link may be able to view its customer-facing information. Forwarding a link or downloading and sending a PDF can disclose customer names, property details, photos, pricing, and contract information beyond the original recipient.

Use sharing controls carefully and contact the contractor if you receive a link in error. Revoking a link cannot recall copies someone already downloaded. Third-party websites, payment pages, and independent integrations are governed by their own privacy policies; review them before providing information.

7. Cookies, tracking, and communications

We use authentication cookies and a workspace-selection cookie to keep users signed in and remember the selected company. Infrastructure and security providers may process related session and request information. Blocking necessary cookies may prevent login or other core functions.

With your separate, optional permission, we send selected product milestones and campaign source labels to a dedicated BidGroove PostHog project to understand signup, trial activation and subscription conversion. We do not enable automatic screen recording or include customer records, proposal content, signatures or payment credentials in these analytics. Analytics is off until you choose it, and you can withdraw permission in Privacy & email preferences. We do not include advertising pixels, cross-site advertising profiles, or sell or share information for cross-context behavioral advertising.

Because the current service does not conduct those advertising activities, browser Do Not Track or Global Privacy Control signals do not change its necessary account processing. We will honor applicable opt-out requirements if a covered activity is introduced.

Account verification, proposal delivery, security and billing messages are transactional. Acknowledging this policy does not subscribe you to marketing. If you separately opt in, we may send setup tips and trial guidance based on unfinished setup or proposal milestones. Unsubscribe in any guidance email or change Privacy & email preferences. This does not prevent necessary account or transaction notices. We record consent and suppression choices so scheduled messages respect them.

8. Retention and deletion

We retain information for as long as reasonably necessary for the purposes described here. The period depends on account activity, the contractor’s instructions, the nature of a signed or disputed transaction, accounting and tax requirements, applicable limitation periods, security needs, and legal holds.

Canceling a subscription does not automatically delete business records or signed proposals. Accepted proposal versions and evidence may need to remain unchanged to preserve the transaction record. That requirement is not a claim that every record must be retained forever or that a valid deletion request will always be refused.

We evaluate deletion requests in light of the responsible business’s instructions and applicable rights and exceptions. When deletion is appropriate, we delete or deidentify information from active systems through the applicable process. Isolated backups and provider logs may persist for their normal retention cycles and are restricted from ordinary use. We cannot remove copies independently held by a contractor or recipient.

Keep your own copies of business records. We do not promise indefinite retention or a guaranteed recovery period after deletion or account closure.

Optional analytics events are retained for up to one year. Pending export records are removed when analytics permission is withdrawn. Guidance delivery and consent records are retained while needed to honor choices, prevent duplicate mail and investigate delivery; unsubscribing does not erase suppression records or required transaction records.

9. Security

We use access controls, company-scoped database permissions, protected storage, server-side validation, and other technical and organizational measures designed to safeguard information. Access is limited according to role and operational need.

No system is completely secure, and we cannot guarantee prevention of every incident. Protect passwords, company membership, devices, recipient addresses, and shared links. Notify us of suspected misuse using the address below. We will investigate incidents and provide notifications when required by applicable law; this policy does not waive those obligations.

10. Choices and privacy requests

Depending on where you live and the law that applies, you may have rights to access or obtain a copy of personal information, correct it, request deletion, restrict or object to certain processing, withdraw consent for processing based on consent, or receive information in a portable format. Rights and exceptions vary; we do not condition nonwaivable rights on accepting our terms.

Write to Larry NeJame LLC DBA BidGroove, Attn: Privacy, PO Box 2445, Goldenrod, FL 32733, United States. Describe the request and your relationship to BidGroove or the contractor, identify the relevant account email or proposal if known, and provide a way to reply. Do not include passwords, payment-card numbers, or unnecessary identity documents. You can correct available company, customer, or project fields through authorized account functions; some signed records require a separate correction process.

We may request proportionate information to verify your identity or authority, particularly for access or deletion. Authorized agents may act where permitted by law with appropriate proof. We will respond within the timeframe applicable to the request and explain a denial where required. You may ask us to reconsider a decision using the same contact address and may complain to a competent privacy regulator. We do not retaliate against people for exercising applicable rights.

For information controlled by a contractor, direct your request to that business first. We will help it respond consistent with our role and legal obligations. A request to delete personal information is separate from cancellation of subscription renewal.

11. Regional information and legal bases

Where California or another U.S. state privacy law applies to our processing, the categories, sources, purposes, recipient categories, and retention criteria are described above. Covered individuals may exercise the applicable rights through the request process, including an appeal where provided by law. We do not sell or share information for targeted advertising, including information about minors, and do not use sensitive information to infer personal characteristics.

If European Economic Area, United Kingdom, or comparable data-protection law applies, the legal bases for our own processing may include performance of our agreement with you, compliance with legal obligations, legitimate interests in operating and securing a business service and resolving disputes, or consent where required. We consider the impact on individuals when relying on legitimate interests. You may object where applicable, and withdrawing consent does not affect earlier lawful processing.

Our receipt of data does not by itself establish that every regional law applies or that the service meets every regulated-industry requirement. Where we act only on a contractor’s instructions, that contractor is responsible for identifying its legal basis and providing required notices.

12. International processing

BidGroove is operated from the United States. Our infrastructure and providers may process information in the United States and other locations where they operate, which may have different privacy laws from your location.

Where applicable law requires safeguards for an international transfer, appropriate contractual or other legally recognized safeguards must apply. Contact us about processing locations or any required data-processing agreement before uploading data subject to those requirements. Use of the service is not treated as a blanket waiver of transfer protections or as consent that replaces required safeguards.

13. Children

BidGroove accounts are intended for adults acting for businesses. The service is not directed to children under 18, and we do not knowingly solicit personal information from children. Users should avoid including children’s faces or personal details in project photos or notes unless necessary and lawfully authorized.

If you believe a child has provided personal information to us, contact us so we can investigate and take appropriate action, including deletion where required.

14. Policy updates and contact

We will publish changes with a new effective date and provide additional notice or obtain consent when required for a material change. Updated disclosures do not retroactively authorize an incompatible new use of previously collected information where additional permission is legally required.

Privacy questions and requests may be mailed to Larry NeJame LLC DBA BidGroove, Attn: Privacy, PO Box 2445, Goldenrod, FL 32733, United States. Please include a reply address. Dated copies linked from account registration remain available for reference.