Privacy Policy

1. Who operates BidFern

BidFern is a service operated by GUARDIANPIXEL LABS LTD, a company registered in England and Wales under company number 17081281, with its registered office at 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Where this policy says "we", it refers to that company, which is the controller of the personal data described here.

Any question, request or complaint about personal data can be sent to contact@bidfern.app, or to the postal address in section 16.

2. Scope of this policy

This policy applies to bidfern.app and to the BidFern application, including account creation, quote generation, quote delivery and online approval. It applies to information about the people who buy a plan and about people whose details are entered into a quote.

Quotes you send may link to pages hosted by us for your own clients. Those pages are covered by this policy as far as our own handling of the data goes. Your relationship with your client, and what you tell your client about their data, remains yours.

3. Personal information collected

We collect only what the service needs to work and to be billed correctly.

Account information

• Full name and business name
• Email address
• Trade and crew size, given at sign-up
• Chosen plan and subscription status

Content you create

• Job descriptions, dictated or typed notes, and scope details
• Site photos and room or area measurements you upload
• Your price book: labor rates, crew costs, material costs, markup rules
• Client names, addresses, email addresses and phone numbers you enter into a quote
• Generated quotes, revisions, approval events and e-signature records

Billing information

• Subscription plan, billing dates, charge amounts and payment status
• Card details are entered directly with our payment processor. We never receive or store full card numbers.

Technical information

• IP address
• Device type, operating system and browser
• Usage logs: pages opened, quotes generated, features used, timestamps, error reports
• Cookies and similar technologies, as described in the Cookie Policy

4. Information about your clients

For that information, you act as the person who decides why it is collected; we hold and process it on your behalf so the quote can be produced, delivered and signed. We do not use your clients' information for our own purposes, do not market to your clients, and do not share it with anyone except the service providers listed in section 8.

If one of your clients contacts us directly about their information, we will normally refer them to you and let you know, unless the law requires otherwise.

5. Why the information is collected and consent

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, personal data may only be collected for stated, specified purposes and must be limited to what those purposes need. The purposes are:

• To create and secure your access — the email address given at checkout. There is no registration form and no password.
• To produce your quotes — job notes, photos, measurements, price book and client details.
• To deliver quotes and record approvals — client email address, approval and signature events.
• To bill you and prevent payment fraud — plan, billing dates, payment status.
• To keep the service running and safe — IP address, device data, usage and error logs.
• To answer your emails — whatever you include in your message.
• To send service messages — receipts, renewal notices, security notices and important changes. These are needed to run your subscription and are not marketing.

We rely on performance of a contract for everything needed to run the service you paid for, on legitimate interests for keeping it secure and diagnosing faults, on consent for optional cookies and marketing email, and on legal obligation for tax records. Optional cookies are only set after you accept them in the cookie banner. Any marketing email follows the Privacy and Electronic Communications Regulations (PECR) and always carries a one-click unsubscribe; unsubscribing from marketing does not stop transactional messages about your own subscription.

You may withdraw consent at any time (section 10). Withdrawing consent to the processing that is necessary to run the service means the account can no longer be provided, and it will be closed.

6. How your content is used

• Your job notes, photos, price book, quotes and client details are not sold, rented or traded. Ever, to anyone.
• Your content is not used to train third-party artificial intelligence models. Where an AI provider is used to generate a quote, it is used under terms that prohibit training on the content submitted.
• We do not read your quotes except where you ask for support, where it is needed to fix a technical failure, or where the law requires it.
• Aggregated statistics that cannot identify you or your clients — for example, the total number of quotes generated in a month — may be used to improve and describe the service.

7. How long information is kept

• Account data is kept while the account is active, and is deleted within 90 days of the account being closed.
• Quotes and price book data stay available for export for 30 days after cancellation, and are deleted after that, as set out in the Refund & Cancellation Policy.
• Uploaded photos are deleted on request at any time, and otherwise follow the retention of the quote they belong to.
• Billing records are kept for the period UK tax and accounting rules require, currently six years, then deleted.
• Signed approval records are kept for six years so a signature can be evidenced if it is disputed, unless you ask for earlier deletion and no dispute is open.
• Server and security logs are kept for up to 12 months.

8. Service providers and transfers outside the UK

Running BidFern requires a small number of specialist providers. Each receives only what it needs:

• Payment processor — takes card details, charges your subscription and issues refunds.
• Hosting and storage provider — runs the application and stores your account data, photos and quotes.
• Transactional email provider — sends quote links, follow-ups and receipts.
• AI model provider — turns the job description and measurements you submit into draft line items.
• E-signature delivery provider — presents the quote for approval and records the signature event.
• Analytics provider — measures site and app usage, only where you have accepted analytics cookies.

Some of these providers store or process data outside the United Kingdom, including in the United States and in the European Union. Data held in another country can be subject to that country's laws, including lawful access by its authorities, and the protections there may differ from those in the UK.

A transfer out of the UK happens only on one of the bases the UK GDPR allows: UK adequacy regulations for the destination country, or the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, backed by an assessment of the destination country's legal framework and of the protections in place. Each provider is bound by a written agreement that limits use of the data to the service being provided, requires confidentiality and appropriate security, and requires prompt notification of any personal data breach.

9. Security

• All traffic between your device and BidFern is encrypted in transit using TLS.
• Stored data, including uploaded photos, is encrypted at rest.
• There are no passwords to store: access is recorded in a cookie set in your own browser when payment succeeds — they can only be reset.
• Access to production systems is limited to the operator, protected by multi-factor authentication, and logged.
• Backups are encrypted and access to them is restricted in the same way.

No system is perfectly secure. Because access lives in the browser you paid from, keep that browser locked when you are away from it, and tell us at once if a device with access is lost or shared with someone who should no longer have it — anyone who can use that browser can use the plan, and we will reset the accessed by someone else.

10. Your rights

Under the UK GDPR you have the right to:

• Access the personal information held about you and be told how it is used and who it has been shared with.
• Correct information that is inaccurate, incomplete or out of date.
• Delete your information where it is no longer needed for the purpose it was collected for, and to close your account.
• Withdraw consent to a given use, understanding that some uses are needed for the service to exist.
• Portability — receive the computerised personal information you supplied in a structured, commonly used technical format. Your quotes and price book can be exported from the builder at any time.
• Complain to a regulator. In the United Kingdom that is the Information Commissioner's Office (ICO), which you can contact without going through us first.

We would rather hear from you first, and will try to settle any complaint directly.

11. How to exercise your rights

Write to contact@bidfern.app from the email address you paid with, state what you are asking for, and give enough detail to find the right records. We may ask for reasonable proof of identity so information is not disclosed to the wrong person.

We answer within 30 days of receiving the request. If a request is refused, we will say why, cite the provision relied on, and explain how to seek a review.

12. Cookies

Cookies and similar technologies are described in full in the Cookie Policy, including the categories used, how long each lasts and how to block them. Non-essential cookies stay off until you accept them, and you can change your choice at any time from the cookie settings link in the footer.

13. Age requirement

BidFern is a business tool for people who quote paid work. It is not directed at anyone under 18, and accounts may only be created by people aged 18 or over. If we learn that an account belongs to a minor, it will be closed and the associated personal information deleted.

14. Confidentiality incidents

If a personal data breach occurs — unauthorised access to, use of, disclosure of, or loss of personal data — it is recorded, assessed at once, and contained as quickly as possible. Where the breach is likely to risk people's rights and freedoms, the Information Commissioner's Office is notified within 72 hours of us becoming aware of it; where the risk is high, every affected person is told promptly as well, together with what happened, what data was involved and what to do about it. Where you are the one who entered your client's information, you will be told so you can inform your client.

15. Changes to this policy

This policy may be updated as the service changes or as the law changes. The "Last updated" date at the top always shows the current version. For any change that materially affects how personal information is handled, everyone with a running plan is notified by email at least 30 days before it takes effect. Continuing to use BidFern after that date means the updated policy applies.

16. Contact

Questions about this policy, requests to exercise your rights, and privacy complaints all go to the same place: