Privacy Policy

BidsPilots Ltd. ("BidsPilots", "We", "Us", or "Our") respects the privacy of our users ("User", "You"). This Privacy Policy explains our practices regarding the collection, storage, processing, and protection of information when you access our website, applications, APIs, or tender alert services at bidspilots.in.

This policy is published in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 of India.

We collect only the minimum necessary information required to deliver high-performance tender intelligence, maintain secure authentication, and dispatch verified alerts:

• Account Profile Data: Business email address, primary mobile number, secondary mobile number (optional), and company name provided during registration.
• Procurement Search Preferences: Saved tender search filters, target product/service categories, BOQ keywords, ministry preferences, and geographical state/city dimensions.
• Bid Tracking & Notes: Tenders marked as favorite, submitted bid statuses, and internal notes recorded by you in your dashboard.
• Technical Telemetry: IP address, browser user-agent, operating system, and session timestamps used solely for session security, rate-limiting, and fraud prevention.

The personal and business data collected is utilized strictly for legitimate operational purposes:

• To run algorithmic matching against newly published Government e-Marketplace (GeM) tenders.
• To dispatch real-time tender match summaries and critical deadline notifications to your WhatsApp and email.
• To verify your identity through dual-channel OTPs during sign-up, login, and password recovery.
• To manage subscription billing, process payment receipts, and maintain enterprise audit trails.
• To optimize query speeds, system responsiveness, and platform uptime (targeting sub-15ms search execution).

When you register with BidsPilots, you authorize us to send:

• Authentication OTPs: Single-use 6-digit verification codes valid for 10 to 15 minutes.
• Instant Tender Notifications: Structured summaries of GeM bids matching your active business filters.
• Critical Expiry Warnings: Reminders when saved tenders reach final submission windows.

Messages are delivered asynchronously using pre-formatted, verified message templates. Users may modify their alert preferences or mute tender notifications at any time via Account Settings.

All digital subscription transactions on the BidsPilots website are facilitated securely through Razorpay Software Private Limited ("Razorpay").

BidsPilots does NOT collect, store, or process sensitive financial credentials—such as credit/debit card numbers, CVVs, expiry dates, net banking passwords, or UPI MPINs. All payment inputs are entered directly into Razorpay's encrypted checkout modal. Razorpay is certified PCI-DSS Level 1 compliant and governed by the regulations of the Reserve Bank of India (RBI).

Upon payment completion, BidsPilots only receives a tokenized transaction reference (`razorpay_payment_id`, `razorpay_order_id`, and `razorpay_signature`) to activate and record your subscription tier.

BidsPilots uses standard, lightweight client-side storage technologies strictly for functional and security purposes:

• Session Cookies: HTTP-only, secure session cookies to verify authenticated user sessions and protect against Cross-Site Request Forgery (CSRF).
• Local Storage: Keys such as `bp_logged_in`, `bp_sub_expired`, and `bp_theme` to maintain active navigation states and avoid redundant layout re-renders.
• Zero Third-Party Advertising Trackers: We do NOT employ intrusive cross-site advertising pixels or tracking beacons that monitor your browsing behavior across other websites.

To operate our infrastructure efficiently, we partner with reputable, privacy-compliant service providers who process data strictly on our instructions:

• Resend SDK: For transactional verification emails and password reset OTP deliveries.
• WhatsApp Business API / Sidecar: For delivering authenticated OTPs and live bid match alerts.
• Razorpay: For secure payment gateway aggregation and GST invoice generation.
• Cloud Infrastructure: High-performance server environments with hardened firewalls and regular vulnerability patches.

We enforce strict contractual data protection agreements with all third-party vendors prohibiting them from using your personal data for any purpose other than facilitating BidsPilots services.

We implement industry-grade technical and organizational security controls to safeguard your data against accidental loss, unauthorized access, alteration, or disclosure:

• Cryptographic Password Protection: User passwords are never stored in plaintext and are hashed using salted BCrypt encryption.
• Hashed OTP In-Memory Storage: 6-digit OTPs are hashed using SHA-256 in ephemeral memory storage with an automatic 15-minute expiration cycle and eviction limits.
• Encryption in Transit: All web traffic is strictly encrypted using TLS 1.3 / HTTPS encryption.
• Data Retention: We retain account data for the duration of your active subscription and as required by statutory taxation and corporate auditing laws.

Under the Digital Personal Data Protection Act and applicable Indian regulations, you possess important rights concerning your personal information:

• Right to Access: You can review your account profile, registered numbers, and saved filters directly in your user dashboard.
• Right to Rectification: You may update or correct your company details, mobile numbers, and contact preferences at any time.
• Right to Erasure: You can request permanent deletion of your account and associated filter history by writing to our Grievance Officer.
• Right to Withdraw Consent: You may opt out of non-essential communications without terminating your active platform account.

We may periodically update this Privacy Policy to reflect enhancements to our platform features, changes in regulatory statutes, or evolving industry security standards.

When material changes occur, we will update the "Last Revised" date at the top of this page and, where appropriate, post an alert notice on your account dashboard or via WhatsApp notification.

If you have any questions, concerns, complaints, or data deletion requests regarding this Privacy Policy or our data handling practices, please contact our designated Grievance Officer: