Privacy Policy

01What we collect

Your account details: name, business name, email and phone, your business address, and your contractor license number and its expiry date.

The work you create in DeftBid: bids, line items, your price book, customers you bid to, photos you attach, and the documents you send.

Records of customer actions on the links you send — when a bid was opened, what was selected, and what was signed. A signature record also holds the IP address and the browser reported by each signer’s device: your customer’s when they consent and when they sign, and yours when you counter-sign. These records exist so you can prove what happened.

Basic technical information: device type, app version, and crash reports.

Usage analytics: how the app is used — screens viewed and features tapped — so we can see what is working and what is not. These records never carry your customers’ names or contact details, and bid amounts appear in them only as broad ranges, never exact figures. Google Analytics also derives an approximate location — country, region and city — from the IP address your device connects from.

How our job templates fit your work: when you send a bid we record which auto-generated lines you changed and what the bid totalled, kept in your own account, so we can improve the templates DeftBid ships. Turning usage analytics off in the app stops this too.

The words you dictate: dictate a bid and they become bid text. Your device turns speech into text on the device itself wherever it can; a phone without on-device recognition sends the audio through its platform’s speech service — typically Google’s or Apple’s — to be transcribed. DeftBid keeps the words, not the recording.

Your device’s location, only when you ask for it: tap “Use my current location” on a job address and DeftBid takes one reading of where your device is and turns it into a street address to fill the field in, for you to check. DeftBid keeps that address, not the coordinates, and takes no reading at any other moment. Your device’s own operating system does the work of turning a reading into an address, which means it goes through the platform’s mapping service — typically Google’s or Apple’s — the same way dictation goes through their speech service. The address it produces is never marked as confirmed: a reading taken in a driveway regularly lands on the neighbour’s house. Decline the permission and nothing in DeftBid stops working — type the address instead. The desktop and web apps never ask.

What you record against an invoice: how much you were paid, when you received it, how it was paid — check, cash, Zelle, Venmo, Cash App, PayPal, a payment link, or another way you name — any reference you enter, and your own note. You record these yourself, after the fact. No payment passes through DeftBid, and DeftBid never asks for or stores your customer’s card or bank account details.

How you ask to be paid: the check payee, payment handles and payment link you save in your profile. DeftBid copies them onto each invoice you issue and shows them to the customer that invoice was sent to. They are yours to add, change or remove at any time, and DeftBid emails you whenever they change.

02Your customers

Some of what we hold is about your customer, not you: their name and contact details, what they did on a bid link, what they signed, and what you have recorded them as paying. We hold it on your behalf, as part of running your account — it is your record of the job, not a relationship between DeftBid and them.

DeftBid also sends email to your customer for you: the bid or invoice you send them, the signing codes and signed copies that go with it, a note when you approve the options they picked, and — unless you switch invoice reminders off — a reminder about an invoice that has passed the date you set for payment. A reminder goes out in your business name with your email address as the reply address, DeftBid tells you before the first one is sent, and there is a limit on how many go out. You can stop them for a single invoice or switch them off for every invoice, in the app. DeftBid does not email your customer about a bid you have not sent them, and never chases a quote.

Our direct relationship is with you. What notice you owe your own customer about how you handle their information is part of your relationship with them, not something DeftBid takes over.

If your customer contacts us about information on a bid you sent, we will refer them to you unless the law requires us to act ourselves. Close your account and their data follows the same schedule as yours, below.

03What we never do

We do not sell your data, your customer list, or your pricing.

We do not use your price book or bid history to train artificial intelligence models that DeftBid sells, licenses, or otherwise makes available to anyone else.

We do not show your customers advertising.

04Why we hold it

To run the service: store your bids and the invoices you raise from them, deliver the links you send, and keep the signature records that make a signed bid provable.

To support you when something goes wrong.

To meet legal and tax record-keeping obligations for signed agreements.

05Who else sees it

Payment processing is handled by Stripe when you subscribe on the web. Card details never reach DeftBid.

App Store and Google Play handle billing when you subscribe there.

The service runs on Google’s Firebase platform, so your bids, documents, and signature records live in Google Cloud data centers. Google hosts them under contract and may not use them for its own purposes. Google also processes the usage analytics described above, through Google Analytics, configured for measurement only, every advertising use is switched off.

Electronic signature capture is handled by DocuSeal. To run a signing we send it the document, both signers’ names and email addresses, and the identifiers that match the result back to your bid; it holds those and the signature record it produces, under the same rule: processing for you, no use of its own.

Email delivery — the bids and invoices you send, signed-document copies, signing codes, invoice reminders, and account notices — is handled by Resend. It sees the messages and attachments it delivers for you.

Notifications reach your phone through the platform’s push service — Apple’s for an iPhone or iPad, Google’s for an Android phone. A notification carries what it is telling you: the customer’s name, the bid it is about, the bid’s total when a bid is signed, the amount of an invoice when they tell you they have paid it, and your customer’s own words when they decline, ask for changes, or tell you they have paid — so all of that passes through the platform on its way to your lock screen. Turn push off and we send email instead.

Some features use AI. Where one does, the text you give that feature is sent to Anthropic’s Claude API through our servers, used to produce the result, and not used by Anthropic to train its models. No AI feature is switched on in DeftBid today; this is how it will work when one is. We never attach your stored customer list, contact records, or signature records; what you type or dictate into an AI feature is sent as it is, so anything you include in it goes with it.

Dictation is different: turning your speech into text is done by your device or, when on-device recognition is unavailable, by its platform’s speech service — typically Google’s or Apple’s — as described under What we collect. Dictated words reach Anthropic only if you put them into an AI feature.

Working out the address at a location is the same kind of thing: your device hands the reading to its own operating system, and the platform’s mapping service — typically Google’s or Apple’s — names the place. DeftBid holds no account with either for this and pays neither: the reading goes through your device’s own arrangement with its maker, not through DeftBid’s servers. The reading never reaches DeftBid; only the address you keep does.

Any other provider that hosts part of the service does so under contract, and may not use your data for its own purposes.

06How long we keep it

Your work stays as long as your account is open.

A signature record — the signed document, the consent record, and the audit trail around it — stays for as long as your account is open, because that is what makes it useful as evidence of what was agreed. Closing your account ends that: our copies go with everything else on the 30-day schedule below, while the executed document remains with DocuSeal under its own retention schedule, and in the copies emailed to you and your customer at signing.

Close your account and DeftBid deletes your other account data, including your price book, customer records, photos, documents, and the invoices and payment records you raised against your bids, from its active systems within 30 days. A backup copy may persist for a limited additional period until it is overwritten, and a copy held by a service provider such as Resend follows that provider’s own retention schedule.

Export your work before you close the account. Once the deletion completes DeftBid holds no copy of it. The export is reachable for as long as the account is open, on every device and whether or not a trial or subscription is still live — taking your own records is never gated on paying us.

DeftBid may keep information beyond these timelines where the law requires it, where a security investigation needs it, or where it is relevant to an unresolved dispute, for as long as that purpose lasts.

One record outlives the account: a deletion receipt holding the account’s id, the email address it was registered to, the dates you asked and we finished, and which stores of data the purge cleared. It is what lets us answer “you said you deleted me — did you?”, and it is not kept forever: we delete the receipt two years after the account is purged. Ask to delete and then change your mind, and the cancelled request is dropped after 30 days.

07Your choices

Export your records at any time while your account is open and your access is live: your bids as a spreadsheet, the invoices you raised and the payments you recorded against them, your price book, the signed contracts, and the documents and photos attached to your bids. Your saved bid templates and your business profile are not in the export file.

Ask us to correct or delete your account data by emailing privacy@deftbid.com. DeftBid responds in a reasonable time and may need to verify your identity first. A deletion request follows the retention rule above: DeftBid deletes what it can from its active systems and keeps only what that rule allows it to keep.

Choose which notifications you get and how they reach you — push, email, or both — without losing any records. A signature, a decline or a change request always reaches you: that notice is the record of what happened on your bid.

Turn off usage analytics in the app’s settings at any time.

08Changes

When this policy changes in a way that matters, DeftBid tells you in the app and asks you to accept the new version before you carry on — the same notice the Terms of Service gives for a change to the terms.

If DeftBid is ever part of a merger, acquisition, or sale of the business, your data goes with it — and so does every promise this policy makes about it. A buyer inherits the rules, not a free hand.

09Children

DeftBid is built for adults running a contracting business. It is not directed at children, and DeftBid does not knowingly collect personal information from anyone under 13.

If DeftBid learns that it has collected personal information from a child under 13, it will delete that information. If you believe a child under 13 has given DeftBid personal information, contact privacy@deftbid.com with the child’s name and the account or bid link involved, and a parent or guardian may ask DeftBid to review and delete it.

10Contact

This policy is issued by Tarsow Creative, LLC, doing business as DeftBid (“DeftBid”).

privacy@deftbid.com