Privacy Policy

This Privacy Policy explains how Istari Strategy Consulting ("Istari Strategy", "we", "us", or "our") collects, uses, and protects information in connection with The Bid Company (the "Service"). It applies to visitors of thebidcompany.com and to customers and users of the Service at portal.thebidcompany.com. We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, for individuals in the European Union, the General Data Protection Regulation (GDPR).

Account and workspace information. Name, work email, password (stored as a salted hash, never in plain text), and the company profile you provide during setup, for example legal business name, industry sector, set-aside eligibility, security clearance level, and registered procurement portals.

Customer Content. Bid documents, requirements, draft proposal answers, content-library material, contact records, and similar material you or your workspace upload to or create within the Service.

Usage data. Log data such as pages viewed, features used, and general device/browser information, collected to keep the Service reliable and to understand which features are actually useful.

Sign-in data. If you sign in with Google or Microsoft, we receive the basic profile information that provider shares with us (name, email, profile photo) to create and authenticate your account. We do not receive your password for that provider.

Cookies and local storage. We use essential cookies/local storage to keep you signed in and remember workspace preferences. We do not use third-party advertising trackers on the Service itself.

• To provide the Service: matching bids, scoring fit, running Smartflow, and powering Ask Istari;
• To operate your account and workspace, including team membership and access approvals;
• To send service communications (deadline reminders, digest emails, and account notices) per your Settings;
• To bill your subscription and communicate about your plan;
• To maintain security, detect abuse, and enforce our Terms of Service; and
• To improve the Service, including understanding which features are and aren't working well.

We do not sell, rent, or trade your personal information to third parties.

Features like Smartflow's requirement extraction and drafting, fit scoring, and Ask Istari send relevant Customer Content to third-party large-language-model providers to generate their output. This processing is scoped to what a feature needs (for example, the text of a document you're drafting against); it is not used to train a third-party provider's general-purpose models, and providers we use are contractually restricted from doing so with the data we send them.

We share personal information only with the sub-processors needed to run the Service, each bound by a data-processing agreement:

• Cloud hosting and database: to store your workspace's data and run the application;
• Authentication providers (Google, Microsoft): only if you choose to sign in that way;
• AI service providers: to power scoring, extraction, and drafting features, as described above;
• Email delivery providers: to send the notifications and digests you've configured; and
• Payment processors: to bill your subscription, for paid plans.

We may also disclose information where required by law, to protect the rights or safety of Istari Strategy or others, or in connection with a merger, acquisition, or sale of assets, in which case we will provide notice before your information becomes subject to a different privacy policy.

We retain workspace data for as long as your account is active. If you close your account, we delete or de-identify Customer Content within a reasonable period, except where we are required to retain it longer for legal, accounting, or dispute-resolution purposes.

Subject to applicable law, you may:

• Request access to the personal information we hold about you;
• Ask us to correct inaccurate information;
• Ask us to delete your personal information, subject to our legitimate retention needs;
• Withdraw consent to non-essential communications at any time, using the unsubscribe link or your notification Settings; and
• If you are in the EU, exercise the additional rights GDPR provides, including data portability and the right to lodge a complaint with your local supervisory authority.

To exercise any of these rights, contact us at hello@istaristrategy.com.

We use industry-standard safeguards, including encryption in transit, access controls scoped to your workspace, and row-level data isolation between tenants, to protect information in the Service. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Istari Strategy is based in Canada, and the Service may be hosted or processed in Canada or other countries where our providers operate. Where we transfer personal information across borders, we take steps to ensure it remains protected consistent with this Policy.

The Service is intended for business use by adults and is not directed at children. We do not knowingly collect personal information from children.

We may update this Privacy Policy from time to time. If we make a material change, we will provide notice before it takes effect, the same way we would for a material change to our Terms of Service.

Questions about this Privacy Policy, or a request relating to your personal information, can be sent to hello@istaristrategy.com.