Your documents are yours. Here is what we do with them.

Bidlora processes the data described below on its own behalf, from Switzerland. For any question or request, write to [email protected].

Account: email address, hashed password, language, the organisation you belong to.

Company: legal name, country, public identifiers you enter yourself.

Documents: the files you upload (specifications, certificates, accounts, references) and the text extracted from them.

Usage: dossiers, analyses run, orders, alert preferences. These records keep your workspace running and support billing.

Payment: handled by Stripe. We receive a customer identifier, the amount and the status. We never see your card number.

To deliver the service you ask for: compare a tender's requirements with your documents, produce a report, write a dossier when you order one.

For billing and accounting, and to meet our legal retention obligations.

For security: detect abnormal access and prevent one account from reading another's documents.

We do not use your documents for advertising, and we never sell them.

The analysis reads your documents to produce your report. To do so, the necessary excerpts are sent to a contracted language-model provider, which processes them for that purpose only.

Your documents are not used to train a model, are not resold, and are never visible to another client.

Every finding quotes the page and sentence of the source document: that is how you check what the machine understood.

Per-organisation isolation is enforced inside the database itself: a request that does not come from your organisation is refused, even if it guesses a file address.

Internally, only the people preparing your dossier have access, and only after your order. Without an order, your dossier stays private.

Database and storage: Supabase, hosted in the European Union.

Payments: Stripe.

Service email delivery: a transactional email provider.

Document analysis: a language-model provider under a processing agreement.

Our processors and recipients: Supabase Inc. (database, authentication, files, functions — hosted in the European Union, Frankfurt), Stripe Payments Europe Ltd (payments and invoices — Ireland), Resend, Inc. (transactional email — United States), Cloudflare, Inc. (site delivery, DNS and Turnstile anti-robot protection — global network), OpenAI (language model producing the tender analysis; tender documents and the necessary excerpts are transmitted — United States), Lovable AB (application hosting — European Union), Hostinger (operations server used for support and quality control — Germany) and the operator's assistance model, used only on instruction, for dossiers whose drafting or review has been ordered. Each provider is bound by a data-processing agreement or terms: confidentiality, purpose limitation, retention, security measures. Transfers outside the European Union and Switzerland rely on the European Commission's standard contractual clauses. The data-processing agreement (DPA) can be downloaded at bidlora.com/legal/conditions-bidlora-2026-10-28.pdf.

Your documents and dossiers remain while your account exists. Deleting a dossier removes its files; deleting your account removes your documents.

Accounting records tied to payments are kept longer, as required by law.

Accounts whose email address is not confirmed within thirty days are deleted, together with the documents uploaded. Confirmed accounts left inactive for more than twelve months are deleted after two reminders; an account with an active subscription or an open order is never deleted.

Technical logs are kept for a limited period, for security and troubleshooting.

Data and file hosting happens in the European Union. When a provider processes data elsewhere, the transfer relies on the contractual safeguards designed for that purpose.

You can request access to your data, its correction, its deletion, restriction of a processing, or object to it. You can also ask for a copy of what you entrusted to us.

Ask at [email protected]. We answer within the legal deadlines. If the answer does not satisfy you, you can contact the competent data protection authority — in Switzerland, the Federal Data Protection and Information Commissioner.

Deleting your account is permanent: it cannot be undone.

Traffic to the site is encrypted. Files live in a private space, reachable through signed, expiring links.

Access rules are enforced server-side on every request, not only in the interface.

Administrative access is restricted and logged.

Bidlora only uses the cookies needed to sign you in and secure your session. No advertising cookies, no data brokers.

If this page changes materially, we tell you inside your workspace. The last update date is shown at the bottom of the page.