Skip to content
GeneralBid.

Privacy Policy

Last updated 27 September 2026. This explains what GeneralBid collects, why, and what we will never do with it.

The short version

  • The free Bid Leveler computes in your browser. Your bids are not sent to us unless you choose to save a share link.
  • A proposal or spec section you drop in to be read is sent to us and to our AI provider to be read. We do not store it. The same goes for proposals emailed to a package inbox: we keep the reading, not the email.
  • Analytics (visit counts and our own product events) runs only with your consent in the EU, EEA, UK and Switzerland, and can be switched off anywhere with “Privacy choices” at the foot of every page.
  • Session recordings and heatmaps never start unless you say yes, wherever you are, and form fields are always hidden in them.
  • Text messages are only sent to a subcontractor who has opted in.
  • Cost benchmarks are opt-in, aggregated from at least five companies, and never identify a company, project or bidder.
  • We do not sell personal data, and we never have.
  • We do not load advertising scripts, and we do not use your data to target ads.
  • You can export everything you have given us, and delete it, at any time.

What we collect

If you only use the free tool: nothing that identifies you. The levelling happens locally in your browser, and your working sheet is kept in your browser’s local storage on your own device so a refresh does not lose it; you can remove it at any time with the Clear button. The figures you type are not transmitted.

If you have a proposal read: the PDF or pasted text, and the names of your scope lines, are sent to us over TLS and passed to our AI provider, Anthropic, to be read onto those lines. The structured result comes straight back to you. We do not store the proposal or its text. In the free tool we do not store the result either; in a GeneralBid account, whatever you choose to apply to a levelling sheet is saved with that sheet, like anything else you enter. Under Anthropic’s commercial terms for its API, content sent to it is not used to train its models; Anthropic may keep it for a limited period under those terms, for example to detect misuse, and then deletes it. Our server logs record that a proposal was read (time, size and the amount of processing used), never its contents. To keep the free tool free, requests are rate-limited per IP address.

If you draft scope lines from a spec: the spec section you drop in or paste (a PDF or text), and the trade you pick, are sent to us and to Anthropic in the same way as a proposal, and handled the same way: the proposed lines come back to you and we do not store the spec or its text. Only the lines you choose to add are kept, in your browser in the free tool or with the package in an account.

Product events: to understand which parts of the site and the tool are used, and how many people go on to create an account, this site and the app record a short, fixed list of events, such as “tool opened”, “sample loaded”, “proposal read”, “CSV exported”, “share link saved” and “sign-up started”. Each event carries its name, the time, the page path without its query string, a random anonymous id generated in your browser and kept in its local storage (gb.anon), and at most a few labels: the trade or template, where on the site it happened, the campaign parameters of the link you arrived by (utm_source, utm_medium, utm_campaign) and the host name of the site that referred you. Nothing you type into a sheet, and no proposal or spec content, is ever part of an event. The events are sent to our own servers, not to an advertising or analytics company, and we do not store your IP address with them. When you follow a link from this site to the app, the anonymous id is added to the link (?aid=) so that tool use before sign-up can be counted in the same funnel; if you then create an account, the id is linked to it. On this site, product events are part of “Analytics” in your privacy choices (see below): no events are sent, and the id is neither created nor added to links, unless analytics is on. Events are deleted after 400 days.

Site analytics (SingleAnalytics): with analytics on, this site loads SingleAnalytics, a web analytics service operated by SingleAnalytics Inc. [confirm the registered entity and its address]. It records page views, the pages you move between, clicks on links and buttons, your browser and its user-agent string, device type, screen size, page performance timings, and the country, region and city derived from your IP address. It does not store your IP address with any of this. To count unique visitors it keeps a one-way hash of your IP address and browser. The address itself is held for up to two hours to screen out bots, and can appear in SingleAnalytics’ server logs. To recognise a returning browser it sets a first-party cookie with a matching local-storage entry (sa_uid, kept for a year), and keeps the current visit in local storage (sa_sid and sa_sts, replaced after 30 minutes without activity).

Session recordings and heatmaps (SingleAnalytics): only if you also say yes to recordings, SingleAnalytics records how pages are used: mouse movement, clicks, scrolling and a reconstruction of what the page showed, so we can replay a visit and see where people get stuck. The value of every form field is masked before it leaves your browser, so figures you type into the Bid Leveler, and anything you type into a form, are not recorded. Recordings are deleted after [7 days on SingleAnalytics’ Free plan, 30 on Starter, 90 on Growth, 180 on Scale — confirm which plan this site uses], and page views and events after [30, 90, 180 or 365 days on the same plans]. They never start without your yes, and turning them off stops them straight away.

Your choices: in the EU, EEA, the UK and Switzerland, or when we cannot tell where you are, analytics and recordings are off until you choose. Elsewhere, analytics is on by default and recordings are off until you choose; a Do Not Track or Global Privacy Control signal switches analytics off by default everywhere. To tell which applies, the site asks our own server for the country your connection comes from, which our host already derives; we do not store it. Your choice is kept in your browser (gb.consent) and you can change it at any time with “Privacy choices” at the foot of every page. Switching analytics off removes the ids above from your browser. We rely on your consent for analytics where the law requires it, and on our legitimate interest in understanding how the site is used elsewhere; recordings always rely on your consent.

Support chat (Suportly): the help launcher in the corner is provided by Suportly, operated by [OPERATOR — the Suportly legal entity]. Neither the launcher nor the support page inside it sets cookies or stores anything in your browser. Because the launcher is on every page so help is always one click away, it loads whatever you choose about analytics, and loading it contacts Suportly’s servers, which receive your IP address, browser details and the address of the page, as any web request does. If you write to us through it, your messages, any contact details you give, and the page you wrote from are sent to Suportly so we can reply. They are kept until we delete them; Suportly has no automatic expiry [set a retention period, for example two years after the conversation closes, and delete older conversations].

Error monitoring: when something breaks, the site, the app and our servers can send an error report to Sentry, our error-monitoring provider. Reports contain the error, where in the code it happened, the page path, the browser and operating system, and the software release. Before a report leaves, we strip request bodies, cookies, request headers and query strings, and we attach no user details and no proposal, spec or bid content. We do not use session replay.

If you save a share link: the sheet and its levelled summary are sent to us and stored so that anyone with the link can view them. Links saved without an account are deleted after 30 days.

If you share a levelling from an account: the link shows your company name, and your name, as the person who shared it. If you choose, bidder names are replaced with “Bidder A”, “Bidder B” and so on, and your own estimates are removed, before the shared copy is stored.

If you contact us: your name, email and whatever you write, so we can reply.

If you create an account: your name and email, a hashed password, optional profile details (company, title, phone, time zone), your notification choices, and the content you put into the product: projects, packages, levelling sheets, your subcontractor directory, clarifications and award records.

If you are on a team: the team’s projects, sheets and directory belong to the team. Other members can see them and see your name against the work you do, such as projects assigned to you and entries in the activity history. Team owners and admins can see members’ names, email addresses and roles.

Proposals emailed to a package inbox: each package can have its own email address. When a proposal is sent to it, our inbound email provider, Postmark, delivers the message to us. We read each PDF attachment (or, when there is none, the message text) onto the package’s scope lines with Anthropic, as above. We keep the reading, the sender’s name and address, the subject, the time received, and each attachment’s name, type and size, so the contractor can review and apply it. We do not keep the email body or the attachments: the raw message is discarded once it has been read. [Confirm Postmark’s own retention of inbound messages and set it to the minimum.]

Documents: contractors can store prequalification documents for their subcontractors (insurance certificates, W-9 forms, licences, bond letters, safety records), and subcontractors can upload their own, through their bid link, a document request link, or their account. Each file is kept, with its name, type, size and expiry date, in object storage on Railway, encrypted at rest (Railway’s buckets run on Tigris), in the United States. Files are never public: they are opened through signed links that expire after five minutes, and only by the account that owns them and, for a subcontractor’s own documents, the contractors that have invited that subcontractor. We also record prequalification details a contractor enters, such as bonding capacity, EMR and licence number.

If you are a subcontractor invited to bid: the general contractor who invited you gave us your company name and email so we could send you the invitation. What you submit through the bid link (your prices, notes and any proposal you upload to fill the form) goes to that contractor and is stored in their account. We process it on their behalf; for requests about it, contact the contractor, or us and we will pass the request on. A contractor may also add your phone number; that alone never lets us send you a text message (see below).

If you create a subcontractor account: your name, email, a hashed password, and the profile you fill in: company, trades, regions, phone, website, description, certifications, bonding capacity, EMR, licence details and documents. We send a code to each email address you add, to verify it; any invitation sent to a verified address, by any contractor using GeneralBid, is linked to your account, and you see its project, package, due date, your own submission and, once awarded, whether you won. You never see other bidders’ names or prices. A contractor that has invited you can see your profile, your documents and whether your email is verified. If your profile is listed (the default, which you can turn off), contractors on paid plans can find it in the GeneralBid network, with your invitation count and win rate onGeneralBid, and a public profile page shows your company, trades, regions, description, website, certifications and those counts. Subcontractor accounts are free.

Text messages: a subcontractor can choose to receive bid reminders by text, on their bid link or in their account. We only send a text after that opt-in, and a contractor cannot opt anyone in. We record the phone number, the time of consent and the exact wording that was agreed to. Messages are sent through Twilio, which receives the phone number and the message text (the contractor’s company, the package, the due date and the bid link). Reply STOP to any message to opt out of all reminders by text; we keep the number on an opt-out list so it is never texted again unless you reply START.

Cost history and benchmarks: in an account, the priced lines on your levelling sheets form your team’s cost history, used to suggest estimates and flag unusual prices. It is visible only to your team. If a team admin turns on benchmark sharing (it is off by default), your priced lines also join an anonymous pool. Figures from the pool are only ever shown aggregated from at least five companies, and never with the name of a company, project, person or bidder. Turning sharing off removes your data from the pool going forward.

Webhooks: if a team admin sets up a webhook, we send data about the team’s packages (such as bids submitted, awards and change orders, which can include bidder names and amounts) to the web address the admin configured. From that point the recipient, not GeneralBid, is responsible for it. We keep a log of the last 50 deliveries to each address.

If you pay for a plan: payments are handled by Stripe. Your card details go to Stripe directly and never reach our servers. We keep the subscription status, plan, number of seats and billing dates that Stripe reports to us.

Automatically: server logs containing IP address, user agent and request path, retained for 30 days for security and debugging.

Why we are allowed to hold it

We rely on performance of a contract (to give you the service you asked for), legitimate interests (to keep the service secure and working), and consent where the law requires it — which you can withdraw at any time.

Who we share it with

Only the providers needed to run the service: Railway, which hosts our API and database, Vercel, which serves this site and the app, Stripe for payments, Resend for transactional email (invitations, reminders and digests), Postmark for receiving proposals emailed to package inboxes, Anthropic for reading proposals and specs you choose to have read, Railway for document storage, Twilio for text messages to subcontractors who opted in, and Sentry for error monitoring. We also send data to webhook addresses a customer configures, as described above. They process data to provide their service to us, under written terms [confirm a data processing agreement is in place with each]. Stripe also acts on its own account for some purposes, such as fraud prevention and meeting its legal obligations, as described in Stripe’s privacy policy. We do not sell data to anyone. We disclose data to authorities only when legally compelled, and will tell you unless prohibited.

How long we keep it

Account data for as long as your account is open, then 30 days. Server logs for 30 days. Product events for 400 days. Error reports for [SENTRY RETENTION, e.g. 90 days]. Emailed proposals: the raw message only until it has been read, usually minutes; the reading stays with the package. Documents until their owner deletes them or the account closes; files uploaded but never attached are removed within a day. Text message consent and opt-out records for [SMS RECORD RETENTION, confirm what carrier rules and TCPA practice require]. Billing records for as long as tax law requires, typically seven years.

Your rights

You can ask for a copy of your data, correct it, delete it, restrict or object to processing, or take it elsewhere in a portable format. Email hello@generalbid.com and we will respond within 30 days. If you are in the UK or EU you may also complain to your local supervisory authority.

Security

Data is encrypted in transit with TLS and at rest. Access is limited to staff who need it, logged, and reviewed. We will notify affected users and regulators within 72 hours of confirming a breach that presents a risk.

Cookies

Strictly necessary, always on: when you sign in to the app, your session is kept in your browser’s local storage, and the free tool keeps your working sheet there too; your privacy choice is kept there as gb.consent. These stay on your device and are cleared when you sign out, press Clear, or clear your browser’s site data. We set no cookies of our own for these.

Analytics, only with it switched on: the anonymous id for our product events (gb.anon, local storage), the campaign parameters of the link you arrived by (session storage, cleared when you close the tab), and SingleAnalytics’ sa_uid (a first-party cookie and local-storage entry, kept for a year), sa_sid and sa_sts (local storage, for the current visit) and sa_identified (local storage). Session recordings add no further cookies.

Stripe’s checkout and billing pages, which open on Stripe’s own site, set their own cookies under Stripe’s policy.

International transfers

Our API and database run on Railway in the United States (US West, Oregon), and this site and the app are served by Vercel from the United States. Anthropic, Stripe, Resend, Postmark, Twilio and Sentry process data in the United States. SingleAnalytics runs on Railway and MongoDB Atlas [confirm its region], and Suportly [confirm its hosting and region]. Where data leaves its region of origin, transfers are covered by Standard Contractual Clauses or an adequacy decision [confirm for each provider].

Children

This service is not directed at children under 13, and we do not knowingly collect their data. Contact us if you believe a child has given us information and we will delete it.

Contact

Privacy questions go to hello@generalbid.com.