Privacy Policy

01What we collect

Your account details: name, business name, email and phone, your business address, and your contractor license number and its expiry date.

The work you create in DeftBid: bids, line items, your price book, customers you bid to, photos you attach, and the documents you send.

Records of customer actions on the links you send — when a bid was opened, what was selected, and what was signed. A signature record also holds the IP address and the browser reported by each signer’s device: your customer’s when they consent and when they sign, and yours when you counter-sign. These records exist so you can prove what happened.

Basic technical information: device type, app version, crash reports, and an identifier for your device, used to deliver notifications and to connect usage analytics and crash reports from the same device.

Usage analytics: how the app is used — screens viewed and features tapped — so we can see what is working and what is not. These records never carry your customers’ names or contact details, and bid amounts appear in them only as broad ranges, never exact figures. Google Analytics also derives an approximate location — country, region and city — from the IP address your device connects from.

How our job templates fit your work: when you send a bid we record which auto-generated lines you changed and what the bid totalled, kept in your own account, so we can improve the templates DeftBid ships. Turning usage analytics off stops this for the bids you send.

The words you dictate: dictate a bid and they become bid text. Your device turns speech into text on the device itself wherever it can; a phone without on-device recognition sends the audio through its platform’s speech service — typically Google’s or Apple’s — to be transcribed. DeftBid keeps the words, not the recording.

Your device’s location, only when you ask for it: tap “Use my current location” on a job address and DeftBid takes one reading of where your device is and turns it into a street address to fill the field in, for you to check. DeftBid keeps that address, not the coordinates, and takes no reading at any other moment. Your device’s own operating system does the work of turning a reading into an address, which means it goes through the platform’s mapping service — typically Google’s or Apple’s — the same way dictation goes through their speech service. The address it produces is never marked as confirmed: a reading taken in a driveway regularly lands on the neighbour’s house. Decline the permission and nothing in DeftBid stops working — type the address instead. The web app never asks.

What you record against an invoice: how much you were paid, when you received it, how it was paid — check, cash, Zelle, Venmo, Cash App, PayPal, a payment link, or another way you name — any reference you enter, and your own note. You record these yourself, after the fact. No payment passes through DeftBid, and DeftBid never asks for or stores your customer’s card or bank account details.

How you ask to be paid: the check payee, payment handles and payment link you save in your profile. DeftBid copies them onto each invoice you issue and shows them to the customer that invoice was sent to. They are yours to add, change or remove at any time, and DeftBid emails you whenever they change.

02Your customers

Some of what we hold is about your customer, not you: their name and contact details, what they did on a bid link, what they signed, and what you have recorded them as paying. We hold it on your behalf, as part of running your account — it is your record of the job, not a relationship between DeftBid and them.

DeftBid also sends email to your customer for you: the bid or invoice you send them, the signing codes and signed copies that go with it, a note when you approve the options they picked, a receipt when you record a payment from them, or a refund, reversal or write-off against their invoice, and — unless you switch invoice reminders off — a reminder about an invoice that has passed the date you set for payment. A reminder goes out in your business name with your email address as the reply address, DeftBid tells you before the first one is sent, and there is a limit on how many go out. You can stop them for a single invoice or switch them off for every invoice, in the app. DeftBid does not email your customer about a bid you have not sent them, and never chases a quote.

Our direct relationship is with you. What notice you owe your own customer about how you handle their information is part of your relationship with them, not something DeftBid takes over.

If your customer contacts us about information on a bid you sent, we will refer them to you unless the law requires us to act ourselves. Close your account and their data follows the same schedule as yours, below.

03What we never do

We do not sell your data, your customer list, or your pricing.

We do not use your price book or bid history to train artificial intelligence models that DeftBid sells, licenses, or otherwise makes available to anyone else.

We do not show your customers advertising.

04Why we hold it

To run the service: store your bids and the invoices you raise from them, deliver the links you send, and keep the signature records that make a signed bid provable.

To support you when something goes wrong.

To meet legal and tax record-keeping obligations for signed agreements.

05Who else sees it

Payment processing is handled by Stripe when you subscribe on the web. Card details never reach DeftBid.

App Store and Google Play handle billing when you subscribe there.

The service runs on Google’s Firebase platform, so your bids, documents, and signature records live in Google Cloud data centers. Google hosts them under contract and may not use them for its own purposes. Google also processes the usage analytics described above, through Google Analytics, configured for measurement only, every advertising use is switched off. Our website at deftbid.com uses Google Analytics the same way: it sets a first-party analytics cookie in your browser so we can count visits and see which pages and searches bring people to DeftBid. That is measurement only — no advertising use, and nothing you type into the app reaches it.

Electronic signature capture is handled by DocuSeal. To run a signing we send it the document, both signers’ names and email addresses, and the identifiers that match the result back to your bid; it holds those and the signature record it produces, under the same rule: processing for you, no use of its own.

Email delivery — the bids and invoices you send, signed-document copies, signing codes, invoice reminders, receipts for the payments, refunds, reversals and write-offs you record, notes when you approve the options your customer picked, the notification emails we send you in place of push, and account notices — is handled by Resend. It sees the messages and attachments it delivers for you.

Notifications reach your phone through Google’s Firebase Cloud Messaging and, for an iPhone or iPad, on through Apple’s push service. A notification carries what it is telling you: the customer’s name, the bid it is about, the bid’s total when a bid is signed, the amount of an invoice when they tell you they have paid it, and your customer’s own words when they decline, ask for changes, or tell you they have paid — so all of that passes through the platform on its way to your lock screen. Turn push off and we send email instead.

Some features use AI. Where one does, the text you give that feature is sent to Anthropic’s Claude API through our servers, used to produce the result, and not used by Anthropic to train its models. No AI feature is switched on in DeftBid today; this is how it will work when one is. We never attach your stored customer list, contact records, or signature records; what you type or dictate into an AI feature is sent as it is, so anything you include in it goes with it.

Dictation is different: turning your speech into text is done by your device or, when on-device recognition is unavailable, by its platform’s speech service — typically Google’s or Apple’s — as described under What we collect. Dictated words reach Anthropic only if you put them into an AI feature.

Working out the address at a location is the same kind of thing: your device hands the reading to its own operating system, and the platform’s mapping service — typically Google’s or Apple’s — names the place. DeftBid holds no account with either for this and pays neither: the reading goes through your device’s own arrangement with its maker, not through DeftBid’s servers. The reading never reaches DeftBid; only the address you keep does.

Typing a job address is different, and unlike a location reading it does pass through DeftBid. As you type in the job address field, or change an address already in it, the text in the field is sent from DeftBid’s servers to Google Maps Platform’s Places service, on an account DeftBid holds and pays for, to suggest matching street addresses; when you pick one, DeftBid asks Google for that address’s full details, such as the ZIP code. Google receives that text — usually your customer’s property address — and the address you pick, but not your name, your customer’s name, or which bid it is for. Unlike the hosting described above, Google handles this under its own terms: it may use and keep what it receives to provide and improve its services, as described in the Google Privacy Policy (policies.google.com/privacy), and under the data-protection terms that come with DeftBid’s Google Maps Platform agreement.

Any other provider that hosts part of the service does so under contract, and may not use your data for its own purposes.

06How long we keep it

Your work stays as long as your account is open.

A signature record — the signed document, the consent record, and the audit trail around it — stays for as long as your account is open, because that is what makes it useful as evidence of what was agreed. Closing your account ends that: our copies go with everything else on the 30-day schedule below, while the executed document remains with DocuSeal under its own retention schedule, and in the copies emailed to you and your customer at signing.

Close your account and DeftBid deletes your other account data, including your price book, customer records, photos, documents, and the invoices and payment records you raised against your bids, from its active systems within 30 days. A backup copy may persist for a limited additional period until it is overwritten, and a copy held by a service provider such as Resend follows that provider’s own retention schedule.

Export your work before you close the account. Once the deletion completes DeftBid holds no copy of it. The export is reachable for as long as the account is open, on every device and whether or not a trial or subscription is still live — taking your own records is never gated on paying us.

DeftBid may keep information beyond these timelines where the law requires it, where a security investigation needs it, or where it is relevant to an unresolved dispute, for as long as that purpose lasts.

Two records outlive the account. One is a deletion receipt holding the account’s id, the email address it was registered to, the dates you asked and we finished, whether you asked in the app or on our website, whether a free trial had started on the account, and which stores of data the purge cleared and how each of its other steps ended. It is what lets us answer “you said you deleted me — did you?”, and it is not kept forever: we delete the receipt two years after the account is purged. Ask to delete and then change your mind, and the cancelled request is dropped after 30 days.

The other is a trial fingerprint, so that each person gets one free trial: a one-way fingerprint of your account’s email address — and, if you sign in with Apple, of your Apple ID. It can tell us that a new account’s address has already had a trial, but it cannot be turned back into the address, and once your account is purged it names no account. We delete it two years after the trial started or the account was purged, whichever is later, and use it for nothing else.

07Your choices

Export your records at any time while your account is open: your bids as a spreadsheet, the invoices you raised and the payments you recorded against them, your price book, the signed contracts, and the documents and photos attached to your bids. Your saved bid templates and your business profile are not in the export file.

Ask us to correct or delete your account data by emailing privacy@deftbid.com. DeftBid responds in a reasonable time and may need to verify your identity first. A deletion request follows the retention rule above: DeftBid deletes what it can from its active systems and keeps only what that rule allows it to keep.

Choose which notifications you get and how they reach you — push, email, or both — without losing any records. A signature, a decline or a change request always reaches you: that notice is the record of what happened on your bid.

Turn off usage analytics in the app’s settings at any time; the choice follows your account to every device you sign in to. For the website, block or clear cookies in your browser.

08Changes

When this policy changes in a way that matters, DeftBid tells you in the app and asks you to accept the new version before you carry on — the same notice the Terms of Service gives for a change to the terms.

If DeftBid is ever part of a merger, acquisition, or sale of the business, your data goes with it — and so does every promise this policy makes about it. A buyer inherits the rules, not a free hand.

09Children

DeftBid is built for adults running a contracting business. It is not directed at children, and DeftBid does not knowingly collect personal information from anyone under 13.

If DeftBid learns that it has collected personal information from a child under 13, it will delete that information. If you believe a child under 13 has given DeftBid personal information, contact privacy@deftbid.com with the child’s name and the account or bid link involved, and a parent or guardian may ask DeftBid to review and delete it.

10Contact

This policy is issued by Tarsow Creative, LLC, doing business as DeftBid (“DeftBid”).

privacy@deftbid.com