Privacy Policy

Company information: registrations, licences, certificates, financial records, personnel and project history that a customer records about its own company.

Tender and procurement documents that a customer uploads for analysis.

User details: name, email address, interface language, role within the customer's organisation, and the time of last activity.

Assessment records: extracted requirements, evidence matches, decisions, reviewer actions and the audit events describing them.

To provide the service to the customer whose organisation the data belongs to: extracting requirements, comparing them with that customer's evidence, producing an assessment and an action plan, and keeping those results reproducible.

To operate and secure the platform, and to support the customer when asked.

Customer documents are not used to market to third parties, and are not sold.

Each customer's data belongs to its own organisation. Separation is enforced at the database layer on every query, not by application logic alone, and uploaded documents are held in private storage readable only by members of the owning organisation.

The platform is designed so that knowledge generalised from working on procurement documents is kept separate from any individual customer's source material.

Bidixo uses the following providers, each bound by its own contractual confidentiality and security terms:

Supabase — database, authentication and document storage. Hosting region: West Europe (Netherlands).

Vercel — application hosting. Hosting region: European Union.

OpenAI — used only for the explanatory layer of a decision. Where that layer is used, frozen requirement text and matched evidence excerpts are sent to the OpenAI API. The deterministic extraction and the decision itself do not depend on it.

Bidixo will give written notice of any change to this list.

Customer data is held with the providers named above, in the European Union and the Netherlands.

Per-customer data residency inside Qatar is a deployment decision that may be discussed for particular customers. It is not offered or promised by this policy.

Data is retained for as long as the customer's organisation is active on the platform.

Deletion is performed by a Bidixo operator on the customer's written request. It is not an automatic background process, and no automatic purge runs during a pilot. Bidixo's current proposal is to complete such a request within 30 days.

Two exceptions are stated openly. First, immutable audit records and AI run records are retained for reproducibility and dispute support; today no automatic purge policy exists for AI run records, and this policy does not claim otherwise. Second, encrypted backups expire in the ordinary course of the hosting provider's operation. [Pending confirmation: backup expiry periods, to be stated once confirmed with the hosting provider.]

Removing a user does not delete data. The data remains with the organisation.

A customer may request an export of its organisation's data at any time while its organisation is active, and for a period after termination as set out in its agreement.

Individuals whose details are held as platform users may ask their organisation's administrator, or Bidixo directly, to correct or remove those details, subject to the audit-record exception above.

Access requires authentication. Authorisation is enforced in the database on every request, uploaded documents are held in private storage, and assessment and review actions are recorded as append-only events.

Bidixo does not currently hold an ISO 27001 or equivalent certification. This policy describes practice, not certification.

If Bidixo becomes aware of a security incident affecting a customer's data, it will notify that customer without undue delay and describe what is known, what is affected, and what is being done.

[Pending confirmation by Qatari counsel: the precise application of Qatar Law No. 13 of 2016 on Personal Data Privacy Protection to Bidixo's processing, and the resulting rights and notification obligations. Bidixo's practice in the meantime is described above and will be aligned with that advice.]

Privacy questions and export or deletion requests: support@bidixo.ai, or Bidixo Consulting and Artificial Intelligence Solutions, Zone 53, Street 989, Building 63, Floor 1, Unit 7, Doha, State of Qatar, P.O. Box 1542.