PRIVACY POLICY

BidExchange (bidexchange.org) is a prelaunch waitlist for an AI agency marketplace, operated from Miami, Florida. The marketplace is not open and no work is being bought or sold here yet. This policy explains what we collect through this site, why, and what you can do about it.

We are in the middle of incorporating. As soon as that completes this page will name the company and give a postal address. Until then the fastest way to reach a human about anything on this page is bmiller@bidexchange.org, which goes straight to the founder.

This site is for people acting for a business, and you need to be 18 or older to join the waitlist or hold an account. It is not directed at children and we do not knowingly collect anything from them. If you believe a child has given us information, email bmiller@bidexchange.org and we will delete it.

Your first and last name, your email address, whether you are a business or an agency, your agency name if you give one, the kind of AI work you are interested in, how you heard about us, and attribution such as the campaign, the specific ad, or the referring site that brought you here. If you arrived from an advertisement, that means we record which ad it was, so we can tell which advertising is worth paying for. We do not keep the per click identifier the ad platform adds to the link.

We also store a salted hash of your IP address so we can rate limit signups and block bots. It is a one way hash — we do not keep your raw IP address, and the hash cannot be turned back into one.

We record which version of this policy was in force when you signed up, and when you submitted, so that what you were told at the time is not a matter of anyone's memory.

Agencies we invite receive a single use invitation code tied to one email address. Redeeming it creates an account for that address. We store the email, an authentication record held by our identity provider, the invitation code that was redeemed, and which version of our terms you accepted and when.

We never see or store your password. It is handled and hashed by our identity provider, Supabase Auth.

Inside an account you may add profile details about your agency: name, tagline, description, services, industries, certifications, website, location, team size, year founded, a self declared minimum project size, named clients, written case studies, named team members, and logo, cover and portfolio images you upload. You choose what to put there.

Agency profiles are private. They are not published, not listed, and not readable by other account holders or by anonymous visitors. Only you and the BidExchange team can see your profile while the marketplace is not live. We will not make any profile public without telling you first.

A profile lets you name members of your team, with their role and an optional link to their professional profile, and to name clients you have worked with. That is information about them, not about you.

Please only list people who are content to be listed, and only name a client you are permitted to name. If someone you have listed asks us to remove them, we will remove them and let you know. There is more detail on the GDPR page, and the obligation itself is in our Terms of Service.

For the waitlist, we rely on your consent, given when you submit the form, together with our legitimate interest in operating and protecting the site. For accounts, we process what is necessary to provide the early access arrangement you entered into by redeeming an invitation. Security records such as hashed IP addresses and rate limiting data rest on our legitimate interest in keeping the site usable.

You can withdraw consent at any time by asking us to remove you. That does not undo processing that has already happened.

To contact you about early access and launch, to understand which channels bring signups, and to operate and protect the site. We do not sell your personal information, and we do not use it to make automated decisions about you.

Nonessential cookies and analytics load only if you accept them in the consent banner. If you decline, the site works normally without them, and you can change your mind at any time using the Cookie settings link in the footer. Full detail is in our Cookie Policy.

We use service providers, and we do not sell or rent your information to anyone. Waitlist data, agency accounts and uploaded images are stored with Supabase, which also provides authentication. The site is hosted by Vercel. Account email such as password resets is delivered by Resend. Bot checks on our forms are performed by Cloudflare Turnstile. If you consent to analytics, those tools receive usage data as described in the Cookie Policy.

If you accept advertising cookies and then sign up, our server also tells Meta that a signup happened, and includes a one way hash of your email address so Meta can recognise the conversion as theirs. Your actual email address is never sent to them, and if you decline in the banner we send them nothing at all. We still record the signup ourselves either way, because we need to know which advertising works whether or not you let us tell Meta about it.

We may also disclose information if the law requires it, or to establish or defend a legal claim.

Our providers store and process this information in the United States. If you are in the United Kingdom or the European Economic Area, that means your information is transferred outside your home country, and you should read the GDPR page alongside this one.

Waitlist entries are kept until the marketplace launches or for 24 months from signup, whichever comes first, unless you ask us to remove yours sooner. Account and profile data is kept for as long as the account exists. Rate limiting records are kept for 12 months.

If you ask us to close an account we delete the profile and its uploaded images. We keep a minimal record that an invitation was issued and redeemed, because we need it to run the founding cohort honestly.

If this project is wound up rather than launched, we will delete the waitlist and all account data rather than transfer or sell it, and we will email account holders before we do.

Access to the database is restricted at the row level, so the public site can add a signup but cannot read the waitlist back. Uploaded images sit in private storage readable only by the account that owns them. IP addresses are hashed before they are stored. Passwords are hashed by our identity provider and never reach us. Our sign in, password reset and invitation forms deliberately give the same answer whether or not an account exists, so they cannot be used to find out who has one.

No system is perfect. If a breach affects your information we will tell you and the relevant regulator without undue delay, and we will say what happened rather than what is convenient.

You can ask us for a copy of what we hold about you, ask us to correct anything wrong, ask us to delete it, or object to how we are using it. Email bmiller@bidexchange.org from the address the request concerns. There is no charge and we will tell you when it is done. If you hold an account you can also edit your profile, email and password yourself at any time.

We will update this page as the product develops. The version number and date are at the top. If a change materially affects account holders, we will email them rather than rely on anyone noticing a new date.

Questions about this policy, or to exercise any of the choices above, email bmiller@bidexchange.org. It reaches the founder directly.