Template — requires attorney review before commercial use.
Privacy Policy
Effective July 6, 2026
LotBid (“LotBid,” “we,” “us”) is a procurement platform for residential homebuilders: builders issue bid packages to trade subcontractors, compare submissions, and award work. This policy explains what data we handle to provide that service, and the rules we hold ourselves to. The short version: your data is yours, we don’t sell it, and we only share it with the service providers needed to run the product.
1. Data we process
- Builder account data — your name, work email, company name, team members and roles, and authentication credentials (passwords are handled by our auth provider and never visible to us in plain text).
- Procurement data — communities, house plans, bid packages, scopes of work, internal budgets, bid submissions, Q&A threads, awards, and contracts your organization creates in the product. Internal budget figures are never shown to vendors.
- Vendor information — subcontractor company details, contact names, emails and phone numbers, trade classifications, and compliance documents vendors or builders upload, including W-9 forms and certificates of insurance. We treat W-9s as sensitive: they are stored in access-controlled storage and are visible only to the builder organization that requested them.
- Usage data — standard logs (IP address, browser, pages viewed, timestamps) and product events (e.g., portal views, document downloads) used for security auditing and to make the product work, such as showing a builder which vendors have opened a bid package.
2. How we use data
- To provide the service: managing bid packages, vendor portals, comparisons, and awards.
- To send transactional email: bid invitations, deadline reminders, Q&A notifications, award confirmations, and team invites. We do not send third-party marketing.
- To power optional features you invoke: AI-assisted bid review and market sales-comps lookups (see subprocessors below).
- To secure the platform: fraud prevention, abuse detection, audit trails, and debugging.
We do not sell your data. We do not use your procurement data to train AI models, and we do not share one builder’s data with another unless you opt in to anonymized pricing benchmarks (below). Vendors see only the packages they were invited to, through individually tokenized portal links.
Anonymized pricing benchmarks (opt-in, off by default). In Settings → Privacy you can turn on “Share anonymized pricing benchmarks.” While it is on, trade-level aggregates (median and percentile figures) of your submitted and awarded bid amounts from the last 12 months are pooled with those of other builders who have also turned it on, and you can view that pool on your Analytics page. Only builders who are sharing are pooled; no figure is shown to anyone until at least three sharing builders contribute to it; and a line-item price is shown only when at least three sharing builders priced the same item. Vendor names, package and community identity, scope documents, and internal budgets are never part of the pool. Turning sharing off removes your data from the pool immediately, and you see benchmarks only while you are sharing.
3. Subprocessors
We rely on a small set of infrastructure providers, each processing data only as needed to run LotBid:
| Provider | Purpose | Data touched |
|---|---|---|
| Vercel | Application hosting and delivery | All traffic transits Vercel infrastructure |
| Supabase | Database, authentication, file storage | Account, procurement, and vendor data; uploaded documents (W-9s, COIs, plans) |
| Resend | Transactional email delivery | Recipient email addresses and message content |
| Anthropic | Optional AI bid-review analysis | For each package you run AI review on: the package’s internal budget, description, scope items, exclusions, lot count and bid format, and every submitted bid’s vendor company name, total and per-lot amount, and pricing/scope flags (which may quote line-item text). Sent only when you run an AI bid review, never by Award recommendation (rules only); not used to train models. |
| RentCast | Optional market sales comps | Community location (address/city) used for comps lookups |
We will update this list before adding a new subprocessor that handles customer data.
4. Vendor participants
Vendors access LotBid through secure, expiring portal links — no account required. A vendor’s bids, documents, and W-9 are visible only to the builder organization that invited them. Vendors may contact that builder, or us directly, to correct or remove their information.
5. Your data is yours
- Ownership — builders own the procurement data they create in LotBid.
- Export — the product exports a package’s awarded-bid data as CSV. A complete export of your data (packages, bids, vendors, Q&A, contracts) is available on request: email support@lotbid.ai and we will prepare it manually. There is no self-serve full-account export yet.
- Deletion — deletion of your account and data is handled on request, not through a self-serve control: email support@lotbid.ai. We complete deletion within a commercially reasonable period after the request, except where retention is legally required.
6. Security
Data is encrypted in transit. Tenant isolation is enforced at both the database layer (row-level security) and the application layer. Vendor portal access uses signed, expiring, revocable tokens. Compliance documents are stored in private buckets served only through short-lived signed URLs. No system is perfectly secure — if we learn of a breach affecting your data, we will notify you without undue delay.
7. Retention
We retain data for as long as your account is active. Audit records (e.g., document-download logs, bid-review runs) are retained for the life of the account to preserve the procurement audit trail your organization relies on.
8. Changes and contact
We will notify account owners by email of material changes to this policy. Questions or requests: support@lotbid.ai.