GDPR

If you are in the European Economic Area or the United Kingdom, this page explains your rights over the personal data BidExchange (bidexchange.org) collects, and how to exercise them. It covers both the public waitlist and founding agency accounts.

We are in the middle of incorporating. Until that completes the controller is Bennett Miller, who runs BidExchange personally from Miami, Florida, and data requests go to bmiller@bidexchange.org. This page will name the company and give a postal address as soon as it is issued. We are not established in the EEA or the UK and do not currently have an Article 27 representative there; if that becomes required as the founding cohort grows, we will appoint one and name them here.

Your name, email, whether you are a business or an agency, an optional agency name, what kind of AI work you are interested in, how you heard about us, and basic attribution such as the campaign that referred you. We also store a salted hash of your IP address to prevent abuse, never the raw address.

If you redeem an invitation and create an account, we additionally hold the email the invitation was issued to, a hashed password, a record of which version of our terms you accepted and when, and a session token stored in your browser while you are signed in. We never store your password itself.

Your agency profile holds whatever you choose to put in it: agency name, tagline, description, website, location, team size, year founded, services, industries, certifications, named clients, a self declared minimum project size, written case studies, and any logo, cover or portfolio images you upload. Uploaded files are held in private storage that only your account can read.

The profile lets you name members of your team, with their role and an optional link to their professional profile. That is personal data about them, not about you. You are responsible for having a lawful basis to share it and for telling them you have — please do not list anyone who has not agreed, and do not name a client you are not permitted to name.

If someone you have listed contacts us and asks to be removed, we will remove them and tell you we have.

For the waitlist, our lawful bases are your consent, given when you submit the form, and our legitimate interest in operating and protecting the site. For accounts, we process what is necessary to perform the arrangement you entered into by accepting an invitation, and we keep security records such as hashed IPs and rate limiting data on the basis of legitimate interest.

We use processors rather than selling or sharing data: Supabase for the database, authentication and file storage, Vercel for hosting, Resend for account mail such as password resets, and Cloudflare Turnstile for the bot check on our forms. They process it on our instructions only. Analytics and advertising tools load solely if you consent.

All of them process and store this information in the United States, so your data leaves the UK or the EEA when you use this site. We rely on the standard contractual clauses our providers offer for that transfer, and we will name the mechanism precisely once the company is incorporated and the processor agreements are signed in its name.

Waitlist entries are kept until the marketplace launches or for 24 months from signup, whichever comes first, unless you ask us to delete them sooner. Rate limiting records are kept for 12 months. Account data is kept while the account exists. If you ask us to delete your account we remove the profile, the uploaded files and the account itself; we may keep a minimal record that an invitation was issued and redeemed, which we need to run the founding cohort honestly.

If this project is wound up rather than launched, we delete the waitlist and all account data rather than transfer or sell it, and we email account holders before we do.

You can request access to your data, correction of anything inaccurate, deletion, a copy in portable form, and restriction of or objection to processing. You can also withdraw consent at any time without affecting processing that already happened.

Some of these you can do yourself: your profile is editable at any time, and your email and password are changeable in your account settings.

Email bmiller@bidexchange.org from the address the request concerns, and say which right you are exercising. We will action verified requests within the period the law allows, and we will tell you when it is done. There is no charge.

You also have the right to complain to your local data protection authority.

Data requests and any question on this page: bmiller@bidexchange.org.