KEYBID

Privacy Policy

Effective date: August 15, 2026 · Version 2.0

Beta policy. Keybid is in founding-customer rollout, and this page describes what the software actually does with your data today — not what we hope it will do later. Where a protection is not built yet, we say so instead of leaving it out. If any of this stops being accurate, we fix the page. Questions, or want your data out or deleted? ryan@keybid.ai — that address is also our designated request address under Nevada law, and a real person reads it.

1. The short version

Your bid data is your competitive edge. We collect what the product needs to run and not much else. We do not sell it. We do not train shared AI models on it. We never show one contractor's numbers to another. And there is an Export button that hands you everything, any time, so you are never locked in.

Two things worth knowing up front: the public demo board is public (Section 8), and plan-set text is sent to our AI provider to be read (Section 5).

2. Who we are

Keybid is operated by Keybid LLC (in formation), based in the United States and founded by Ryan, a working sitework contractor. Everything runs on servers in the United States.

Designated request address: ryan@keybid.ai. Use it for access, correction, export, deletion, an opt-out of sale, or any question on this page.

3. What we collect

Account information — your name or email, company name, trade, and a hashed password. If a teammate is added to your account, the same for them.
Customer content — bid records, GC names, contacts and phone numbers you enter, values, due dates, notes, plan-set text you paste or PDFs you upload, and the bid emails you paste in or forward to your Keybid intake address (including sender, subject, and body).
Activity records — an audit log for your own account showing who signed in, who added or changed a bid, who approved a draft, who exported. It records that an action happened; it does not record bid contents or pricing. It stores a coarse IP address with the last part removed.
Security records — when a request carries a known attack signature, we store the source IP, the path, the signature type, and the time.
Usage analytics — page views, referring page, and a handful of product events (demo opened, signup, plan uploaded, draft approved, checkout started, multi-seat order, paid-campaign events on our landing page, and basic funnel events on the home and pricing pages — page viewed, which call-to-action was pressed, and whether a signup was begun). This is first-party: it lives in our own database and no analytics company receives it. Instead of storing your IP, we store a one-way hash of your IP and browser, salted with a key that is regenerated every day, so counts work but the hash cannot be tied back to you or followed across days.
Error reports — when the server faults, we store the message, the route, and a stack trace so we can fix it. A stack trace can incidentally contain a fragment of the data being processed.
Feedback — whatever you write in the Support chat, plus a contact detail if you give one.

We do not collect or store payment card numbers — card processing happens on the payment provider's own hosted page. We do not knowingly collect information from anyone under 18. We do not collect location data, we do not buy data about you from anyone, and we do not run advertising pixels.

4. How we use it

To run the Service — store your pipeline, read plan sets, compute win probability, draft follow-ups and replies, deliver email you approve, route mail forwarded to your intake address. To secure it — detect and block attack traffic, throttle abuse, investigate incidents. To bill you. To support you when you write in. And to improve the product using aggregate counts, not by reading your bids.

We do not use Customer Data for advertising, and we do not profile you.

5. Who we share it with

Only the companies that make the Service run. Today that is:

Render, Inc. — hosting. The application and its database run on Render's infrastructure, so Render holds everything at rest.
Anthropic, PBC — AI language-model processing, when the AI engine is switched on for your account. Plan-set text, pasted bid emails, and the context needed to draft a reply are sent to Anthropic's API to be read. Anthropic's commercial terms state it does not train its models on API inputs or outputs. If the AI engine is off, nothing is sent and the product falls back to keyword rules.
Resend — outbound email, when email sending is switched on. When you approve a follow-up or a reply, the recipient address, subject, and body go to Resend to be delivered. Feedback you send the founder is delivered the same way.
Stripe, Inc. — card processing and subscription billing, when billing is live. Stripe receives your email, company reference, seat count, and your card details directly; we receive back a customer reference and a status. If we are invoicing you through a hosted payment page instead, that provider receives the same kind of billing information.

These are service providers acting on our instructions, not customers of your data. We may disclose information if the law requires it, and we will tell you about a legal demand where we are lawfully allowed to.

We do not sell personal information, and we never share your bids, pricing, or win rates with other customers, general contractors, or data brokers.

One thing that is not a subprocessor but is worth telling you: most pages on our marketing site load a web font from Google's font servers. That means your browser asks Google for a font file and, like any web request, tells Google your IP address and browser type in the process. No Keybid data goes with it, no cookie is set by us for it, and this page and the Terms page do not load it at all. We would rather serve the font ourselves and intend to.

6. How long we keep it, and how to get rid of it

Straight answers, including where our retention is a cap on volume rather than a clock:

Customer content — kept while your account is active.
Your account's activity log — kept up to about 5,000 entries per company; past that the oldest are deleted automatically. There is no fixed time period, and there is no way for anyone, including us through the app, to edit or selectively delete entries.
Security records — kept up to about 5,000 entries in total across the whole service; past that the oldest are deleted automatically. On a service seeing real attack traffic that is a short window, not a year.
Analytics and error reports — kept in our own database with no fixed deletion schedule today. We will set one and say what it is.
Database snapshots — the service takes a routine snapshot of its database and keeps only the most recent handful, so a snapshot ordinarily ages out within a couple of hours. This is a restore-from-disaster measure, not an archive.
Billing records — kept as long as tax and accounting law requires.

Export any time. The Export control in the app gives you a complete JSON file of your company's data. No request, no waiting, no charge.

Clear your own board. There is a reset control in the app that deletes your company's bids, drafts, follow-ups, inbox items, plan reads, and activity feed. It only ever touches your own company.

Deletion on request. Email the address in Section 2 and we will delete your company's data, including the account itself. We will confirm the request came from someone on the account, complete it within 30 days, and write back to tell you it is done. Two honest caveats: recent database snapshots will contain your data until they age out on their own, and we may keep a minimal billing record where the law requires it.

7. Security

What is actually in place:

HTTPS/TLS on all traffic, with HSTS.
Security headers on every response — content security policy, frame-deny, no-sniff, a no-referrer policy, and a permissions policy that switches off camera, microphone, and location.
Passwords hashed with scrypt. Session tokens stored hashed, so a copy of the database does not hand anyone a live login. Session cookies are HttpOnly and same-site.
Every database query is scoped to one company, so one customer's board cannot return another's rows.
Automated screening of every request for known attack signatures, with automatic short-term blocking of a source that trips it repeatedly.
Rate limits on API routes, with tighter limits on the expensive ones for anonymous callers. The uptime health check is deliberately not rate-limited.
A per-account throttle on failed sign-ins, to stop password guessing.
PDF parsing runs in a separate, memory-capped, time-limited process, so a hostile or broken file cannot take the service down.
Your email intake address only accepts mail forwarded by mailboxes you have locked in; anything else is held for your approval rather than written to your board. You can rotate the address at any time, and the old one dies immediately.

What is not in place, so you are not guessing: we do not encrypt the database at rest beyond what our hosting provider does at the disk level, we do not hold a SOC 2 report, and we have not had a third-party penetration test. A small number of people — currently the founder — can access customer data for support and operations.

No system is perfectly secure. If a breach affects your personal information, we will notify you in the most expedient time possible and without unreasonable delay, consistent with Nevada's breach-notification law (NRS 603A.220) and any other law that applies.

8. The public demo board

If you are not signed in, you are on a shared demo board that every visitor can read, write to, and export. Anything you paste there — a real invitation to bid, a GC's contact, your pricing — is visible to strangers. Create an account before you put anything real in. Your own board is walled off from every other company, and a signed-in account gets a private intake address that the demo board cannot have.

9. Reviewing and changing your information

You can see and change most of your information inside the product: company details and trade in Settings, bids on the board, teammates on the team screen, your password from your account, and everything at once through Export. For anything you cannot reach yourself — including correcting an email address or deleting the account — write to the address in Section 2 and we will do it. We do not charge for this and we do not treat you any differently for asking.

10. Third-party tracking across other websites

Nevada law asks us to say this plainly, so: no third party collects information about your online activities over time and across other websites through Keybid. We run no advertising trackers, no cross-site cookies, no session recording, and no third-party analytics. The only third-party request our pages make is the web font described in Section 5.

11. Cookies

Two, and here is what each one does.

The session cookie, named keybid_session, keeps you signed in. It is HttpOnly, same-site, and lasts 30 days, extending while you keep using the product. Signing out clears it. The copy we keep on our side is stored hashed, so a stolen copy of our database does not hand anyone a live login.
A first-party attribution cookie named kb_attr, set only on our marketing pages, and only on your first visit. It records how you arrived — the campaign tags on the link you clicked, if there were any (the standard utm_source, utm_medium, utm_campaign, utm_content and utm_term values); the host of the page that referred you — google.com, never the full URL, because a full referrer URL can carry your search terms or a private link; and the path of the page you landed on, without its query string. It is same-site, lasts 90 days, and holds no name, no email, and no identifier for you. Its entire job is to let us answer one question at the moment you sign up: which of the things we tried actually brought a contractor here. It is read once, at signup, and never again. It is not a tracking cookie: it is first-party only, it is not readable by anyone else, no third party receives it, and it cannot follow you to any other website. Blocking or clearing it costs you nothing in the product.

That is the complete list. Your browser may also keep interface preferences in local storage on your own machine; that never leaves your device.

12. Your rights

Everyone. Whatever state you are in, you may ask us for a copy of your information, ask us to correct it, ask us to delete it, or ask us to stop. Use the address in Section 2.

Nevada. Under NRS 603A.300 to 603A.360, a Nevada consumer may direct an operator not to sell their covered information. Our answer is that we do not sell covered information to anyone and have no plans to. If you want that on the record anyway, send the request to the designated address in Section 2 and we will confirm it in writing within 60 days.

California. Being straight with you: the CCPA and CPRA apply to businesses that clear at least one of three thresholds — annual gross revenue above roughly $26.6 million, buying, selling, or sharing the personal information of 100,000 or more California consumers or households in a year, or making half or more of revenue from selling or sharing personal information. Keybid is nowhere near any of them, so we are not a "business" subject to the CCPA today. We are telling you that rather than posting a rights notice that implies otherwise. That said, we will honor a California resident's request for access, correction, deletion, or portability exactly as if it applied, and we do not sell or share personal information, so there is nothing to opt out of. If Keybid grows past a threshold, we will update this section and comply.

No retaliation. We will never degrade your service, change your price, or treat you worse for exercising any of this.

13. Changes to this policy

If we change this policy in a way that affects you, we will post a notice in your board's activity feed and update the effective date at the top of this page at least 14 days before the change takes effect. Minor corrections — fixing a name, adding a subprocessor we already disclosed in substance — go in immediately with a new date. Past versions are available on request.

14. Contact

Questions, requests, complaints, or something on this page that does not match what you are seeing in the product: ryan@keybid.ai. Keybid · United States.

← Back to Keybid · Contact · Terms of Service