Privacy Policy

BidBook is invoicing, estimating, and contract software with built-in e-signature, made for trade contractors — masons, plumbers, electricians, HVAC techs, general contractors, and remodelers. This policy explains what we collect, why, who we share it with, how long we keep it, and how to get your data out or deleted. It covers getbidbook.com, the BidBook web app, and the BidBook mobile apps for Android and iOS.

BidBook is a product of Swiss Masonry LLC, 4974 Beechwood Rd, Cincinnati, OH 45244. For any privacy question or to exercise a right, email business@swissmasonry.org.

Who's who in your data

BidBook is multi-tenant. A contractor's account is their own workspace. That matters for who controls what:

• The data a contractor types in about their own clients — names, phone numbers, email addresses, job-site addresses, line items, photos — belongs to that contractor. The contractor decides what goes in and what comes out. BidBook stores and processes it on the contractor's behalf. If you're a homeowner or a contractor's customer and you want something changed or removed, ask the contractor you hired first; we'll help them do it.
• The data about the contractor's own account — sign-up details, billing, how they use the app — is controlled by BidBook, and this policy governs it directly.

What we collect

You give us:

• Account data: your name, email, password (stored hashed, never in plain text), and phone number.
• Business profile: company name, business address, logo, license or tax details you choose to add, and your default estimate/invoice settings.
• Customer and job data you enter: your clients' contact info, job addresses, estimates, invoices, change orders, contracts, line items, and notes. You control this; we hold it for you.
• Job-site photos: images you attach to an expense, such as a photo of a receipt taken with your phone's camera through the file picker.
• Support messages: anything you send us when you ask for help.

Stripe handles your payment data, not us:

• Payments (card and ACH) run through Stripe. Full card numbers and full bank account numbers go straight to Stripe — they never touch BidBook's servers and we never store them. We receive only payment and payout status (paid, pending, failed) and the identifiers Stripe gives us to match a payment to an invoice.

We collect automatically:

• Server logs: our servers record the requests they serve — the page or endpoint, your IP address, the browser and device the request came from, the time, and any error. We use these to run BidBook, keep it secure, and fix what breaks. We do not collect device location.
• Document activity: we record when one of your documents is viewed, signed, or paid, and show it back to you as that document's activity feed. That record is produced by the app doing its job, not by a tracking tool.
• E-signature evidence: when someone signs a document, we capture the signer's name and email, IP address, device and browser, and the timestamp of each action — plus the signature bytes themselves (the typed text or the drawn strokes). See "E-signature records" below.

We don't run third-party advertising trackers, and we don't sell your data.

Cookies, local storage, and PWA storage

• We use strictly necessary cookies to sign you in and keep your session secure. Turn these off and sign-in breaks.
• BidBook is an installable Progressive Web App (PWA). Its service worker caches the public pages and the app's own files so BidBook opens and can tell you that you are offline. It does not keep your account data, your customers' data, or your drafts on the device, and signing out clears the cache. You can also clear it from your browser or by removing the app.
• We run no product analytics and no advertising trackers. There is no analytics, advertising, or crash-reporting SDK in the website or the apps — nothing measures what you click, and no third party receives your activity.

Processors and subprocessors

We rely on a short list of vendors to run BidBook. Each is under a written contract with confidentiality and security obligations. We'll update this list before adding or swapping any vendor that handles personal data.

Apple and Google operate the app stores you may download a mobile app from; their own privacy terms cover what they collect at download and install. BidBook does not send push notifications, so no push service handles your data.

E-signature records and audit trail

BidBook's e-signature is native — there's no third-party signing vendor in the loop. When a document is signed:

• We capture the signature itself (typed name or drawn strokes) and retain those signature bytes.
• We record an audit trail: signer name and email, IP address, device and browser, and the date and time of every signing action.
• We generate an audit certificate and store it alongside the signed document so the signature can be reproduced and verified later.

We retain signed documents, signature bytes, and audit certificates so they hold up as legal evidence. Because they're legal records, we keep them longer than ordinary account data, and we may keep them after an account closes to defend or prove an agreement. See the E-Sign Consent disclosure shown to signers for the full ESIGN/UETA terms.

Why we use your data

• To provide, run, and secure the service and keep tenants isolated from each other.
• To process payments and payouts through Stripe.
• To send transactional email — signature requests, receipts, reminders, and security notices.
• To generate estimates, invoices, contracts, and branded PDFs.
• To answer support requests.
• To detect and prevent fraud and abuse.
• To meet legal obligations and enforce our agreements.

How long we keep it

We keep personal data only as long as we need it, then delete or anonymize it. As a guide:

• Account and profile: for the life of the account, then deleted within about 30 days after closure.
• Contractor-entered records: per the contractor's instructions; deleted on request or after account closure.
• Signed contracts, signature bytes, and audit certificates: retained as legal records, typically at least 7 years, and sometimes longer where a dispute or law requires.
• Billing and tax records: as long as the law requires, typically about 7 years.
• Usage and diagnostic logs: a limited, rolling window, generally 12–24 months.
• Backups: rolling, overwritten on a regular cycle.

Getting your data out, or deleted

You can export and delete your data.

• Export: request a copy of your account and business records by emailing business@swissmasonry.org, or use in-app export where available.
• Delete: ask us to delete your personal data at business@swissmasonry.org. We'll verify it's really you first. We may need to keep some records (for example, signed contracts and tax records) where the law requires it.
• Homeowners and contractors' customers: if a contractor entered data about you, that contractor controls it. Ask them first; we'll support their response.

We honor Global Privacy Control (GPC) signals where the law requires.

Your privacy rights

Depending on where you live (for example, California, Colorado, Connecticut, Virginia, and other U.S. states with privacy laws), you may have the right to know what personal data we hold, to access or correct it, to delete it, to opt out of "sale" or "sharing" (we do neither), and to not be discriminated against for exercising these rights. To make a request, email business@swissmasonry.org. We'll respond within the time the applicable law requires.

Children

BidBook is a business tool. It is not directed to children, and we don't knowingly collect data from anyone under 18. If you believe a minor has given us personal data, contact business@swissmasonry.org and we'll delete it.

Security

We isolate each tenant's data at the database layer using row-level security, encrypt data in transit and at rest, limit access to a need-to-know basis, and route all payment capture to Stripe so full card and bank numbers never reach us. No system is perfectly secure and we can't promise absolute security, but we work to protect your data.

International users

BidBook is operated from, and stores data in, the United States. If you use BidBook from outside the U.S., you understand your data is processed in the U.S.

Legal and corporate disclosures

We may disclose data to comply with the law, respond to lawful requests, protect people's rights and safety, or in connection with a merger, acquisition, or sale of the business — in which case this policy continues to apply.

Changes to this policy

We may update this policy. When we do, we'll change the effective date at the top and, for material changes, tell you by email or an in-app notice.

Contact

Email business@swissmasonry.org for any privacy question or to exercise a right. Mailing address: Swiss Masonry LLC, 4974 Beechwood Rd, Cincinnati, OH 45244.