1. Scope and responsible business
Devection Consulting Group, Inc., doing business as BidSentryX, is responsible for the personal information described in this notice. This notice applies to the public website, hosted application, customer support, and related business operations. It does not govern a customer's own use of information exported from BidSentryX.
2. Information we collect
- Account and organization information, such as name, email address, organization, role, membership, and authentication identifiers.
- Customer Content, including solicitation details, deadlines, contacts, notes, documents, workbooks, reminders, exports, and user-entered instructions.
- Billing information, such as plan, subscription, transaction, invoice, and payment status. Paddle processes full payment-card details; BidSentryX does not store full card numbers.
- Technical and usage information, such as IP address, browser and device information, timestamps, request and error logs, security events, feature interactions, and cookie choices.
- Communications and support information, including messages, requests, feedback, and records needed to resolve an issue.
3. How we use information
- Provide, authenticate, secure, maintain, and support the Service.
- Store and process Customer Content according to user and organization instructions.
- Administer trials, subscriptions, entitlements, invoices, payment recovery, and customer communications.
- Detect abuse, investigate incidents, debug errors, preserve availability, and enforce agreements.
- Understand product performance and improve the Service. Optional marketing analytics remain off unless the required consent is provided.
- Comply with law, exercise legal rights, and respond to valid governmental or legal requests.
4. Legal bases
Where a legal basis is required, we process information to perform a contract, pursue legitimate interests in operating and securing the Service, comply with legal obligations, protect vital interests when applicable, and rely on consent for optional activities where required. Consent may be withdrawn without affecting prior lawful processing.
5. When information is shared
We do not sell personal information. We share information only as needed with authorized organization members; service providers operating under contractual restrictions; professional advisers; transaction counterparties in a merger, financing, reorganization, or sale; or authorities and other parties when required by law or necessary to protect rights, safety, and security.
Current service-provider categories include Vercel for application hosting, Clerk for authentication and organization membership, Neon for database hosting, Cloudflare R2 for object storage, Resend and Purelymail for communications, Sentry for error monitoring, and Paddle for billing and merchant-of-record services. OpenAI processing remains disabled; if enabled later, OpenAI will process supported content only when an authorized user invokes an AI feature and the organization's AI controls permit it.
6. Cookies and similar technologies
The Service uses essential cookies and storage for authentication, security, preferences, and core functionality. Optional marketing analytics are not activated until the required consent is present. You can change browser controls, but blocking essential storage may prevent parts of the Service from working.
7. Retention and deletion
We retain account information and Customer Content while the relevant account or organization remains active and as needed to provide the Service. After a verified deletion or offboarding request, we remove or de-identify information from active systems as operationally feasible, subject to contractual obligations, security records, backups, legal holds, tax and accounting requirements, fraud prevention, and other lawful needs. Backup copies are removed through their normal rotation rather than immediately.
Because customers control organization content and memberships, requests from an organization user may be referred to that organization's administrator. We will not claim that deleting an identity-provider account automatically deletes associated organization records or stored files.
8. Security and international processing
We use administrative, technical, and organizational safeguards designed to protect information, including access controls, tenant scoping, encryption in transit, protected storage, monitoring, and backups. No system is completely secure. Service providers may process information in the United States and other countries; where required, we use recognized transfer safeguards.
9. Your choices and privacy rights
Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a copy of personal information, withdraw consent, or appeal a decision. Send a request to support@bidsentryx.com. We may verify identity and authority before acting and may retain information where permitted or required by law. You may also contact the relevant privacy regulator.
10. Children, changes, and contact
The Service is intended for business users and not for children under 18. We may update this notice and will change the effective date above when we do. Privacy questions and requests may be sent to support@bidsentryx.com.