Privacy Policy

1. Information We Collect

• Account data: name, email, password hash, role, company, status, and session records.
• Company data: company name, address, phone, country, plan, billing state, users, modules, and administrative settings.
• Project data: project titles, descriptions, folder IDs or URLs, files, metadata, statuses, sync history, processing results, notifications, and audit or activity records.
• Connected-source data: Google account email/profile data, OAuth scopes, encrypted access and refresh tokens, Drive folder metadata, file metadata, exported content, downloaded content, and permission diagnostics needed to operate the integration.
• Processed data: extracted text, OCR output, fragments, embeddings, summaries, classifications, previews, search indexes, error logs, processing events, and AI-assisted answers.
• Billing data: Stripe customer, checkout, subscription, invoice, plan, payment status, and webhook identifiers. Full card data is handled by Stripe, not stored by Data2Bids.
• Technical data: IP address, device/browser data, cookies, authentication events, logs, performance metrics, request metadata, and security diagnostics.
• Support data: contact form messages, support requests, email content, and information you provide when reporting issues.

2. How We Use Information

• Create accounts, authenticate users, rotate sessions, manage roles, and protect company-scoped access.
• Connect Google Drive, list folders, index files, export or download supported files, and keep project metadata synchronized.
• Run OCR, parsing, document classification, fragmenting, embeddings, vector search, previews, AI-assisted Q&A, notifications, and processing status workflows.
• Operate billing, trials, checkout, subscription status, usage limits, invoices, and account access gates.
• Provide support, troubleshoot errors, send transactional emails, improve reliability, prevent abuse, and secure the service.
• Comply with legal, tax, accounting, security, and contractual obligations.

3. Google API and Drive Data

Data2Bids uses Google OAuth so authorized users can connect Drive folders for company projects. Google user data is used only to provide and improve user-facing features that you request, such as folder selection, file indexing, document processing, project synchronization, and status diagnostics.

• We do not sell Google user data.
• We do not use Google user data for advertising.
• We do not use Google user data to train generalized or public AI models.
• We do not allow humans to read Google user data except where needed for security, support requested by you, debugging with appropriate controls, legal compliance, or abuse investigation.
• You can disconnect Drive in Data2Bids or revoke access from your Google Account permissions page.

4. AI Providers, Processing Vendors, and Subprocessors

Data2Bids may use cloud infrastructure, storage, queueing, OCR, parsing, vector search, model hosting, AI providers, email providers, observability tools, and payment processors to operate the service.

• Customer documents and extracted content may be sent to subprocessors only as needed to provide the service, secure it, troubleshoot it, or comply with law.
• Data2Bids does not use your company documents to train public AI models.
• Third-party providers process data under their own security and privacy terms, and Data2Bids uses contractual, technical, and access controls where appropriate.

5. Cookies and Sessions

The web application uses cookies and local browser storage for authentication, refresh sessions, language preference, theme preference, and user experience.

• Access tokens are short-lived. Refresh sessions are stored server-side as hashed tokens and may rotate over time.
• Some browser storage is required for language, theme, and application behavior.
• The contact form uses Google reCAPTCHA to prevent spam and abuse. This sets a strictly necessary security cookie and is not used for tracking or advertising.
• Blocking required cookies may prevent sign-in or core product features from working.

6. Sharing and Disclosure

• Within your company workspace, according to roles and permissions configured by administrators.
• With service providers and subprocessors that help operate hosting, storage, AI/OCR, email, analytics, security, support, and billing.
• With Stripe and related payment systems for checkout, subscriptions, invoices, payment status, fraud prevention, and billing support.
• When required by law, court order, subpoena, regulator request, tax requirement, or to protect rights, safety, security, and platform integrity.
• In connection with a merger, acquisition, financing, restructuring, or sale of assets, subject to appropriate confidentiality protections.

7. Security

Data2Bids uses safeguards designed for business data, including encrypted transport, encrypted token storage, role-based access, company scoping, logging, worker isolation patterns, and managed cloud infrastructure.

• No online system can guarantee absolute security.
• You are responsible for managing authorized users, protecting credentials, and maintaining secure access to your own Google, email, and company systems.
• Notify us promptly if you suspect unauthorized access to your account or company workspace.

8. Retention and Deletion

We retain information for as long as needed to provide the service, maintain business records, comply with legal obligations, resolve disputes, enforce agreements, prevent abuse, and maintain backups.

• Project deletion or reset may remove processed records, fragments, embeddings, and stored payloads from active systems, subject to backup and legal retention limits.
• Disconnecting Google Drive stops future access using that connection but does not automatically delete previously processed project data.
• You may request deletion or export assistance by contacting us, subject to authentication, company-admin approval, legal requirements, and technical limitations.

9. Your Choices and Rights

• You may update account and company information in the product where available.
• Company administrators may add, disable, or remove users and manage company integrations.
• You may disconnect Google Drive or revoke Google permissions.
• Depending on your location, you may have rights to access, correct, delete, restrict, or receive information about personal data processing.
• Submit privacy requests to support@data2bids.com. We may need to verify identity and authority before acting.

10. Children, International Use, and Changes

• Data2Bids is intended for business users and is not directed to children under 13.
• Data may be processed in the United States and other locations where Data2Bids or its service providers operate.
• We may update this Policy as the service, providers, laws, or practices change. The updated date will show when the policy was last revised.

11. Contact

Privacy questions, deletion requests, and legal notices can be sent to support@data2bids.com.

Mailing address: 8504 NW 6th St, Miami, FL 33166.