Privacy Policy

BidCloud helps Ugandan businesses find and win government tenders. This policy explains what personal information we collect when you use BidCloud, why we collect it, and the choices you have. We follow the Data Protection and Privacy Act, 2019 of Uganda.

Who we are

BidCloud is based in Kampala, Uganda. For anything about your data, email us at info@bidcloud.org.

What we collect

• Account details: your email address and a password (stored securely, never in plain text), or your Google sign-in if you use it.
• Company profile: your company name, type of business, the categories and regions you work in, turnover and contract size bands, and which compliance documents you hold.
• What you set up in BidCloud: tenders in your pipeline and your notes on them, the entities you follow, your keyword alerts, and the documents you record in My documents with their expiry dates. We do not ask you to upload the documents themselves.
• Payments: the plan you chose, the amount, how you paid (mobile money or card), the date, the payment reference and the email address used. Your card number and mobile money PIN go only to our payment provider, Flutterwave; we never see or store them.
• Survey answers: the features you are interested in, your suggestions, how you find tenders today, and how you heard about us.
• Basic usage data: technical logs such as pages visited and errors, and anonymous visit statistics, used to keep the service running and improve it.

How we use it

• To run your account, your free month and your plan.
• To match open tenders to your business and email you alerts and deadline reminders about them.
• To show which requirements and documents a tender needs compared with your profile.
• To take payments and keep the records the law requires.
• To decide what to build next, using survey answers in aggregate.
• To keep BidCloud secure and working.

We use your information to provide the service you signed up for and because you gave it to us. You can withdraw your consent at any time by deleting your account.

Who we share it with

We never sell your information. We share it only with the service providers that run BidCloud for us:

• Supabase stores your account, profile and everything you set up.
• Vercel hosts the website and provides anonymous visit statistics.
• FastAPI Cloud and GitHub run our tender data service and the jobs that send daily alerts.
• Resend delivers our emails.
• Flutterwave processes your payments.
• Google (Gemini) reads public tender documents to summarise their requirements. We do not send your personal information to it.

These providers may store data on servers outside Uganda. We only use providers that protect data to a high standard. We may also disclose information if the law requires it.

Cookies

We use cookies to keep you signed in. If you reach BidCloud from one of our emails, a cookie may record that, so we know the email worked. Our visit statistics do not use cookies to track you across other websites.

Public procurement data

Tender notices, contract awards and bidder information shown in BidCloud come from public government sources such as eGP Uganda. This is not personal information you give us.

How long we keep it

We keep your information while you have an account, including while it is paused after your free month or plan ends. When you delete your account in Settings, we delete your profile and everything you set up straight away. Payment records are kept for as long as tax and accounting law requires, without a link to your account. If you ask us by email to delete your information, we do so within 30 days.

Your rights

Under the Data Protection and Privacy Act you can:

• get a copy of the personal information we hold about you. You can download it yourself in Settings, under Your data;
• correct information that is wrong, most of it in Settings;
• delete your account and information, in Settings or by asking us;
• stop alert emails: turn off profile matches in Settings, and remove the keyword alerts, followed entities or pipeline tenders behind any other alerts.

For anything else, email info@bidcloud.org and we will respond within 30 days. If you are not happy with our response, you can complain to the Personal Data Protection Office of Uganda.

Security

We use encrypted connections, access controls and reputable infrastructure providers to protect your information. No system is perfectly secure, so please use a strong password and tell us straight away if you think your account has been accessed without your permission.

Changes to this policy

If we make important changes, we will update the date above and let you know by email.