GDPR

If you are in the European Economic Area or the United Kingdom, this page explains your rights over the personal data Bidex (bidexchange.org) collects, and how to exercise them. It covers both the public waitlist and founding agency accounts.

Your name, email, whether you are a business or an agency, an optional agency name, what kind of AI work you are interested in, how you heard about us, and basic attribution such as the campaign that referred you. We also store a salted hash of your IP address to prevent abuse, never the raw address.

If you redeem an invitation and create an account, we additionally hold the email the invitation was issued to, a hashed password, a record of which version of our terms you accepted and when, and a session token stored in your browser while you are signed in. We never store your password itself.

Your agency profile holds whatever you choose to put in it: agency name, tagline, description, website, location, team size, year founded, services, industries, certifications, named clients, a self declared minimum project size, written case studies, and any logo, cover or portfolio images you upload. Uploaded files are held in private storage that only your account can read.

The profile lets you name members of your team, with their role and an optional link to their professional profile. That is personal data about them, not about you. You are responsible for having a lawful basis to share it and for telling them you have — please do not list anyone who has not agreed, and do not name a client you are not permitted to name.

If someone you have listed contacts us and asks to be removed, we will remove them and tell you we have.

For the waitlist, our lawful bases are your consent, given when you submit the form, and our legitimate interest in operating and protecting the site. For accounts, we process what is necessary to perform the arrangement you entered into by accepting an invitation, and we keep security records such as hashed IPs and rate limiting data on the basis of legitimate interest.

We use processors rather than selling or sharing data: our hosting and database provider, and an email provider that delivers account mail such as password resets. They process it on our instructions only. Analytics and advertising tools load solely if you consent, and are not currently enabled.

Waitlist entries are kept until the marketplace launches or you ask us to delete them, whichever comes first. Account data is kept while the account exists. If you ask us to delete your account we remove the profile, the uploaded files and the account itself; we may keep a minimal record that an invitation was issued and redeemed, which we need to run the founding cohort honestly.

You can request access to your data, correction of anything inaccurate, deletion, a copy in portable form, and restriction of or objection to processing. You can also withdraw consent at any time without affecting processing that already happened.

Some of these you can do yourself: your profile is editable at any time, and your email and password are changeable in your account settings.

Email bmiller@bidexchange.org from the address the request concerns, and say which right you are exercising. We will action verified requests within the period the law allows, and we will tell you when it is done. There is no charge.

You also have the right to complain to your local data protection authority.

Data requests and any question on this page: bmiller@bidexchange.org.