BidWingman Privacy Policy

1. Who we are

BidWingman is operated by Brixton Systems LLC, a Georgia limited liability company ("we", "us"). This policy explains what personal information we collect through bidwingman.com and the BidWingman app, how we use it, and who receives it. Contact: info@bidwingman.com.

2. Information we collect

Information you give us:

• Account details: full name, work email address and an optional company name.
• Company profile: company name, SAM UEI, EIN, DUNS, CAGE code, address, phone number, certifications, contract vehicles and NAICS codes.
• Content you enter: opportunities, estimates, tasks, site visits, documents you upload, past performance records, and information about contacts, field employees, teaming partners and subcontractors.
• Messages you send to Victor, and feedback you send us.
• Your email address, if you join our mailing list.

Payment information: you enter your card details on a page hosted by Stripe. We do not receive or store your full card number. Stripe gives us a customer ID, your plan and your subscription status.

Information collected automatically:

• Sign-in session data that keeps you logged in.
• Website usage data from Google Analytics on our public website and sign-up pages, such as pages viewed, approximate location, browser type and referring site.

Information about other people: you may enter personal information about other people, such as contacts and employees. You are responsible for having the right to do so, as the Terms of Service explain.

Job applicants: if a company uses BidWingman to receive applications, we collect, on that company's behalf, the applicant's name, email address, phone number, home address and answers to company questions, optional message and optional resume, the time of the application, and a record that the applicant read the applicant notice. We also keep a one-way hash of the applicant's IP address for a short period to limit spam.

New hires: if a company uses BidWingman to collect onboarding information, we collect, on that company's behalf, the new hire's name, contact details, home address, date of birth, emergency contact, any documents they upload (resume, license, training certificates), a photo of themselves for an employee ID when the link asks for one, the time they submitted, and a record that they read the notice. If the company has turned on payroll details for the link, we also collect the new hire's Social Security number, how they want to be paid, the bank routing number, account number and account type for direct deposit, a federal W-4, a state withholding form, an optional voided check, and a record that they accepted the payroll details terms. If the new hire chooses direct deposit and the link asks for it, we also collect a signed direct deposit authorization: the name they type as their signature, the date and time they signed, the last four digits of the account and routing numbers, a hashed network address, and a PDF copy of the signed form. The numbers are encrypted before they are stored.

3. How we use information

• To provide, secure and support the Service.
• To process payments and manage subscriptions.
• To send service emails, such as sign-in links, password resets, team invitations, mention notices and billing messages.
• To send reminders about unfinished signups, a welcome email and product updates. You can unsubscribe from marketing emails at any time.
• To answer your questions and fix problems.
• To improve the Service and understand how our public website is used.
• To receive and manage job applications for the company that asked for them, and to send the applicant a confirmation email.
• To receive and store onboarding information for the company that asked for it.
• To receive and store payroll details when a company turns that on for a new hire link.
• To meet legal obligations and protect our rights.

4. Victor and Anthropic

When you use Victor, we send information to Anthropic, whose model generates the answers. Each time you send a message, this can include:

• Your first name and email address.
• Your company name, SAM UEI, NAICS codes, certifications, contract vehicles and plan.
• Counts of your opportunities by stage, and the names of opportunities due within 14 days.
• Project and milestone names, and certifications expiring within 90 days.
• The screen you are viewing.
• Up to 40 recent messages from your shared Victor history across BidWingman and BidVictor, from the last 30 days.

On the date of this policy, we do not send the contents of documents you upload to Anthropic. Victor can show you file names and links.

5. Who we share information with

We share information with service providers who help us run BidWingman:

• Supabase: our database, sign-in service and file storage. It holds the information described in section 2.
• Stripe: payments and subscriptions. It receives your name, email address, plan and your company's account ID.
• Resend: sends our emails. It receives the recipient's address and the content of each message.
• Inngest: runs background jobs. It receives job data such as record IDs.
• Anthropic: powers Victor, as described in section 4.
• Google Analytics: website analytics on our public website and sign-up pages.
• Unsplash: our public website loads some photos from Unsplash, so your browser connects to Unsplash and it may receive your IP address and browser details.

For job applications, the company that posted the opening decides who sees the applicant's information. Its team members with hiring access can see it. Supabase stores it and Resend sends the confirmation and alert emails. Both act as our processors. We do not use applicant information for our own marketing.

Onboarding records are visible only to the company's team members with full HR access. Supabase stores them and Resend sends the notification email. Both act as our processors. BidWingman encrypts the numbers before Supabase stores them, and the tax forms are kept as private files. The photo for the employee ID is kept as a re-encoded JPEG copy, not the original file, and is not used for face matching. The signed direct deposit authorization is kept as a private PDF file that shows only the last four digits of the account and routing numbers, and it is kept after the payroll details are purged unless the company deletes the record. Only those team members can ask to see them, one number at a time, and each request is written to an access log with the reason given.

BidVictor: if you connect your BidWingman account to BidVictor, another Brixton Systems product, we share linked documents, past performance records, opportunity notices, shared Victor history and sign-in information with it.

We may also disclose information when the law requires it, to protect our rights or the safety of others, or in a merger or sale of the business. We do not sell personal information and we do not share it for advertising.

6. Cookies and similar storage

• Sign-in cookies that keep you logged in.
• A session cookie that supports signing in between BidWingman and BidVictor.
• Browser storage that remembers small settings, such as whether the Victor chat is open, whether you dismissed a banner, and whether you used a welcome offer.
• Cookies set by Google Analytics on our public website and sign-up pages. You can block them with a browser setting or by installing Google's opt-out browser add-on.

7. How long we keep information

We keep your account information and content while your account is active. After it ends, we keep it until you ask us to delete it, except for billing, tax and legal records we need to keep. You can delete individual records inside the app at any time. We do not currently run an automatic deletion schedule. Applicant records and resumes stay until the company or we delete them. They are deleted manually. Onboarding records and their documents also stay until the company or we delete them. Payroll details stay until the company purges them, which permanently deletes the numbers and the tax form files. There is no automatic deletion. Deleted data may remain in encrypted backups for a limited period.

8. Your choices and requests

You can ask us to give you a copy of your information, correct it, or delete it. Email info@bidwingman.com. We may need to confirm your identity first, and we will respond within 30 days. You can unsubscribe from marketing emails with the link in each message. Applicants should contact the company they applied to, which can reply to the confirmation email, to see, correct or delete their application. New hires should contact the company they are joining to see, correct or delete their information. You can also email info@bidwingman.com and we will pass the request on.

9. Security

We use safeguards such as encrypted connections and access controls that keep each company's data separate from other companies' data. No system is completely secure, so we cannot guarantee absolute security. Please keep your sign-in credentials private.

10. Where information is processed

We are based in the United States. Our service providers may process information in the United States and other countries.

11. Children

BidWingman is for businesses. It is not directed to anyone under 18, and we do not knowingly collect information from children.

12. Changes to this policy

We may update this policy. For material changes we will notify you by email or in the Service. The date at the top shows when it was last updated.

13. Contact

Brixton Systems LLC
Email: info@bidwingman.com