Privacy Notice

1. Who operates BidGreat

BidGreat LLC operates BidGreat. Contact [email protected] about privacy, account closure or information associated with a request or review. This notice describes the current marketplace, not integrations or advertising tools that have not been activated.

2. Information we collect and why

We collect account and business details, service requests and answers, bids, messages, reviews, optional uploads, sign-in/security information and marketplace activity to operate BidGreat, communicate about activity, protect accounts, review abuse and understand how the service is used. We also receive source material for opportunities discovered outside BidGreat. Such material can concern someone who has not registered. Contact [email protected] about an unwanted or incorrectly attributed request.

Account information can include your name, email, phone number, business profile, selected services, service-area preferences and optional logo. Job and transaction records include requirements, prices, proposal revisions, appointments, selection and completion records, private messages and support reports. Avoid submitting sensitive information that the service does not request.

Technical records can include IP address information used for rate limiting or security, browser/request information, cookie identifiers, timestamps, activity events and email delivery status. We keep authentication secrets in protected forms such as password hashes and hashed one-time tokens rather than treating them as public profile data.

Agreement records contain the authenticated user ID, the version accepted, a server-recorded timestamp, the acceptance method and a link to the preserved policy copy and its integrity hash. The acceptance ledger does not collect a separate copy of your IP address or browser fingerprint. General security logs may still contain request information. These records support account administration, demonstrating agreement and resolving disputes.

3. Public information and restricted information

Published request descriptions, broad location, designated job photos and bidding information may be visible on the public marketplace. Approved reviews, their display names and photos, business replies, and associated business information are public. Exact-address fields, email addresses, source captures, private proposals, job-to-provider identity mappings and messages are restricted according to the feature and your role. Authorized operators may review them for marketplace operations and safety. Contact details are shared with the other participant when the selected bid or approved visit connection completes the required confirmations and, where applicable, payment or valid credit/waiver settlement. Contact details from an existing completed visit connection remain available while a later bid awaits confirmation. Public content can be copied by others; access restrictions cannot retrieve copies already made.

A provider's public business profile may show the business name, services and designated profile or review information. The public job-to-bid view limits competing provider identity and proposal visibility; this is separate from the existence of a public business profile. Account holders should review each form's audience description before submitting. Operators may access restricted information as needed for support, moderation and lawful operations; it is not confidential from the platform itself.

4. Photos and uploads

Photo submission is optional. We process supported uploads and remove embedded image metadata where supported by the upload pipeline. This does not remove identifying information visible inside a picture. Storage in a private bucket does not mean a photo designated for publication stays private: approved/published photos are served through the relevant public feature. Draft claim and pending-review photos remain restricted.

5. Service providers and AI

We use hosting, database/object-storage, security, transactional-email and AI-processing services. AI may help sanitize request text, suggest service categories/questions or prepare operator drafts. It can make mistakes; people should review the result. Where possible we limit information supplied to a service to what its task needs. Entering a ZIP code may send that ZIP to Zippopotam.us for location suggestions, using GeoNames data. Third-party websites you choose to open have their own practices.

We may disclose information when reasonably necessary to comply with legal requirements, respond to valid legal process, investigate misuse or protect rights and safety. Information may be handled in a business transfer subject to applicable law and appropriate notice; a transfer is not permission to disregard existing privacy obligations.

Operational providers may receive information needed to perform hosting, storage, delivery, security or AI-processing tasks. Your counterpart receives information needed for the marketplace action you request, including contact release after confirmed hiring or a visit. We do not currently sell personal information or share it for cross-context behavioral advertising. Optional measurement and masked session replay are described in the next section; third-party advertising tools are not active.

6. Cookies and marketplace measurement, updated October 3, 2026

BidGreat uses essential sign-in and security storage, an anonymous first-party visitor identifier, and internal marketplace-event records. We also use Microsoft Clarity session replays to find confusing steps and improve BidGreat. Recording preferences are separate from accepting our marketplace terms.

For visits identified as being in the United States, session recording starts automatically if you have no saved recording choice and your browser does not send a privacy signal. Choose Necessary only in the cookie notice or use Cookie settings in the footer to turn it off. Saved rejections stay off, and older or expired permissions require a new choice. Outside the United States, including the European Economic Area, United Kingdom and Switzerland, recording starts only after you choose to allow it. We also require that choice when we cannot determine your country. A default setting is not saved as your consent.

Replays can cover public and signed-in customer and pro pages, including the steps for posting jobs, bidding, messaging and confirming contact sharing. They show page layout, navigation, clicks, scrolling and visible page content. Text and photos displayed on a page can appear in recordings, including job details, messages, names, email addresses, phone numbers and job addresses. Clarity masks form inputs and dropdown selections; information displayed elsewhere on the page is not protected by that form masking. Do not submit sensitive information unnecessarily. Clarity also receives permitted page URLs and technical information such as IP address, browser and device details. Admin sessions, View as customer sessions and the live support chat page are excluded. Pages or links containing sign-in, verification, invitation, claim or unsubscribe credentials, or contact details in their URL, are excluded too.

Google Analytics is separate and stays off until you allow it. It is limited to anonymous public landing and policy pages and receives fixed public-page paths rather than query strings or fragments. Advertising storage, Google signals and advertising personalization stay disabled. Clarity advertising storage also stays disabled. We honor Global Privacy Control and Do Not Track by keeping both tools off.

Use Cookie settings in the footer at any time to turn recordings off or change your choices. We keep these preferences in first-party browser storage. Permission expires after 180 days; a saved rejection is not changed to permission when it expires or when this notice changes. Earlier rejections remain in effect while the saved preference is available. Clearing browser storage or using a different browser may remove that preference. Optional identifiers may include Google's _ga cookies and Clarity's _clck and _clsk cookies.

Turning recording off stops it immediately and clears accessible first-party measurement cookies. When your choice is saved, the page reloads to unload the scripts. If your browser cannot save it, recording stops on that page, we attempt to preserve the rejection for the current browser session, and a warning explains that the permanent preference was not saved. Turning recording off does not erase information already processed by providers; contact [email protected] about access or deletion requests. Google and Microsoft process information under their applicable service and privacy terms, potentially outside your state or country.

This updated feature notice describes recording from October 3, 2026 onward. It does not change archived marketplace agreements, rewrite recorded acceptances, override saved rejections or authorize new uses of previously collected private information.

7. Retention and your requests

We keep information while needed for the service and relevant security, dispute and legal purposes. A form draft's availability window is not a promise that every associated backup or upload is physically deleted at the same time. Contact [email protected] to request access, correction or deletion, or account closure. We may verify your identity and retain information where reasonably necessary or legally required. We will explain any applicable limitation on a request.

Depending on applicable law, additional privacy rights may apply. We use access controls and security measures, but no system or transmission can be guaranteed completely secure.

Retention depends on whether your account or request remains active, the sensitivity and purpose of a record, outstanding transactions, disputes, security investigations and applicable legal requirements. Sign-in links and sessions expire, but expiry is not the same as immediate deletion from all logs and backups. Ordinary cleanup removes certain expired authentication and draft records; other marketplace and acceptance records may remain needed for the purposes above.

Account closure and deletion are reviewed separately from cancelling a job or service agreement. We may need to retain limited transaction, abuse-prevention or agreement records, and shared conversations or public reviews may implicate another person's rights. We will assess deletion requests under applicable law rather than promise that closing an account instantly erases every copy. When restoring a backup, applicable deletion restrictions should continue to be honored.

8. Your choices and applicable privacy rights

You can update available account and business fields, choose whether to upload photos, decline optional invitations, and use browser cookie controls. Required authentication cookies support signed-in features. You can contact [email protected] to request access to, a copy of, correction of, or deletion of your personal information. State the request clearly without emailing passwords or verification links.

Depending on where you live and whether the relevant law applies, you may have additional rights such as portability, restricting certain processing, opting out of sale, targeted advertising or certain consequential profiling, or appealing a denied request. We do not currently operate those advertising uses. We will evaluate requests and applicable deadlines under the law that applies rather than assume all laws provide identical rights.

We may need proportionate information to verify your identity or an authorized agent's authority before releasing or changing private records. We will explain a denial or applicable limitation and you may ask us to reconsider by emailing support with the original request. We will not retaliate for exercising legally protected privacy rights. You may also contact the appropriate privacy regulator.

9. Security and processing locations

We use measures such as access controls, restricted storage, authentication and monitoring appropriate to the features we operate. No online service can guarantee perfect security. Protect your own devices and email access and contact support promptly about suspected unauthorized activity. Do not submit financial account numbers, government ID documents or other unnecessary sensitive data in ordinary job or review fields.

BidGreat is operated in the United States. Our infrastructure and service providers may process information in the United States or other locations where they operate. Applicable safeguards and legal requirements still apply to processing and transfers. Using the service does not waive rights that cannot lawfully be waived.

If a security incident triggers a legal notification duty, we will provide the notices required by applicable law. A security report or routine login notice is not a promise that every event will be detected immediately.

10. Communications, children and updates

We send requested sign-in and service-related emails. Review-request emails have an opt-out that does not disable essential account/security messages. Accepting the Terms is not blanket consent to unrelated marketing or text messages. The service is for adults, not directed to children. Contact us about suspected use by a child so it can be reviewed.

We will update this notice when practices materially change and provide notice or request consent where required. The date and version at the top identify this notice.

11. Optional Sign in with Google

When available, you may choose Google instead of an email sign-in link or password. Google authenticates you on its own website; we do not receive your Google password. We request only your basic identity, email address and profile (openid, email and profile scopes). Google returns an account identifier, email and verification information and, when provided, a display name. We use this information to authenticate you, create or connect your BidGreat account and protect against unauthorized account linking. A Google profile photo may be included in Google's identity response, but this login integration does not save or display that photo.

We store the Google account identifier associated with your BidGreat account, along with account details such as email and name and connection timestamps. Temporary authentication records support completing and securing sign-in. Google access and ID tokens are processed transiently to verify sign-in and are not retained as long-term account credentials; this login flow does not request offline access or store a Google refresh token. Account and connection records remain while needed for the account, subject to the retention and deletion practices above.

Google receives the sign-in request and technical information needed to authenticate you. Our hosting, database and security service providers process the resulting account information only as needed to operate and protect BidGreat. We do not sell Google user data, use it for advertising or send Google authentication data to AI services. BidGreat's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements where applicable.

Signing in with Google does not grant BidGreat access to Gmail, Google Drive, your contacts or Google Business Profile reviews or management. It does not verify your professional qualifications or automatically make you a provider. The optional Business Profile connection requires separate authorization as described below. Sign-in alone does not authorize it.

You can remove BidGreat's access in your Google Account's third-party connections settings at https://myaccount.google.com/connections. Revoking Google access does not automatically delete your BidGreat account or sign out an existing BidGreat session. Sign out on BidGreat as well if needed; email-link and password methods remain available. Contact [email protected] to request removal of a Google account connection or deletion of associated data. We verify such requests and handle them under the retention and privacy-rights practices above. Google's privacy policy is available at https://policies.google.com/privacy and its API Services User Data Policy at https://developers.google.com/terms/api-services-user-data-policy.

Optional Google Business Profile connection, September 25, 2026

If you connect a Google Business Profile you manage, BidGreat uses the permission you grant to list your businesses, retrieve the selected business details and Google reviews, and publish or edit a review reply only when you explicitly confirm it. Connecting is optional and separate from Google sign-in. We do not change your Google listing automatically.

Your selected business’s Google reviews, reviewer attribution, rating and review count can appear on its BidGreat review page, identified as Google content and kept separate from BidGreat reviews. Business name and phone suggestions are saved to your BidGreat profile only after you review and submit them. Google does not provide us with your business email through this connection.

We encrypt the authorization credential used for daily background review refreshes. Cached Google content is refreshed or removed within 29 days. Disconnect in the Google business screen to revoke the connection, remove its cached content and stop sync. Previously confirmed BidGreat profile details and native BidGreat reviews remain. You can also remove BidGreat access in your Google Account permissions.

Live support chat, October 2, 2026

Live chat is optional and works without a BidGreat account. Chatwoot loads when you open live chat. It processes your support messages, attachments, browser and connection information, and any contact details you choose to provide. If you are signed in, we also identify your BidGreat account by its name, email and account identifier so support can recognize you.

Our support chat uses a separate BidGreat workspace on our Chatwoot service hosted at chat.serviceinsync.com. Support conversations are for BidGreat support, not messages to a customer or pro. The widget runs on a separate support page so we do not automatically send your job-page URL, sign-in links or verification codes to Chatwoot.

Chat uses first-party storage to remember your conversation and protect account identity. This is separate from optional analytics and session replay. Signing out clears the local chat session. You can also contact us by email or phone without opening chat. Never send passwords, sign-in codes, payment-card details or unnecessary sensitive documents.

Address suggestions, feature notice updated September 27, 2026

When you type in a street-address field with Google suggestions, including when confirming contact details to accept a bid or approve a visit, Google Maps receives the address text and technical connection information, such as your IP address and browser details, to suggest matching US addresses. Google is not contacted just by opening or focusing the field. You can enter your address manually without selecting a suggestion.

Only the address you select or enter, including its city, state and ZIP code, is saved when you submit the form. We do not save suggestion lists, Google place details or coordinates, and we do not send Google your claim link, email, job details or messages. Your street address is not displayed publicly; it is shared with the selected pro after the applicable bid or visit connection completes its required confirmation and settlement steps. This feature is separate from optional analytics and does not enable Google Analytics or Clarity.

Suggestions are provided under the Google Maps/Google Earth Additional Terms of Service and Google Privacy Policy. Check the address before confirming your request. This supplemental feature notice does not change the archived September 9 marketplace agreement or your recorded acceptance.

Business identity and introductory-benefit security, October 22, 2026

BidGreat assigns an internal business identity to a provider profile. After review, more than one authorized account can be associated with the same operating business for introductory-benefit accounting. This association does not merge accounts or grant access to another account’s jobs, drafts, messages or sign-in methods. Browsing jobs and placing free bids do not require new identity documents.

We use submitted business details, existing verified account associations and proportionate account-security records to review possible duplicate promotional claims and related-account transactions. A Google sign-in identifier identifies a Google account, not necessarily an operating business. A submitted phone number is not treated as verified merely because it appears in a profile. We do not copy Google Business Profile content into a permanent promotional-abuse database or use Google data outside its authorized purpose and applicable retention restrictions.

We reuse the essential first-party bidgreat_anon browser identifier for a separate security purpose. Purpose-specific keyed hashes may identify recent relationships between signed-in accounts using the same browser. We do not use an authentication-session token as a permanent business identifier. This security processing is separate from optional advertising, Google Analytics and session replay; it does not enable those tools. We do not collect canvas fingerprints, invasive device fingerprints or cross-site identifiers for this purpose.

A shared browser, household, IP address, business name or computer is not proof of abuse. Supporting clues may prompt a human eligibility review; they do not automatically merge businesses, suspend an account or label someone fraudulent. A validated sign-in link opened in the wrong account is recorded for security troubleshooting, not as proof of common business ownership. You can contact support to correct an association or explain a shared-device situation. Unverified suspicions alone do not block ordinary introductory-benefit enrollment; active verified-email pro accounts qualify automatically, with established business associations sharing a package.

Transient supporting-signal hashes, possible-relationship cases and account-switch security events are normally removed after 90 days without relevant renewed activity. Confirmed business associations and the minimum grant/redemption history needed to prevent repeat benefits are kept while the relevant program or outstanding benefits require them. Accounting and dispute records may be retained for legal obligations; we restrict access and minimize retained evidence. Contact support for access, correction, deletion or review, including applicable retention exceptions. We do not require every provider to submit an EIN or government documents.

Optional visit appointments and updates

After a visit connection, either participant may propose an exact date, start time, optional end time and timezone. We store canonical UTC times, the chosen IANA timezone, proposal and confirmation records, revisions and cancellation history. A proposed appointment is confirmed only after both participants agree to that revision. General availability and ordinary messages are not automatically converted into confirmed appointments.

Appointment details are available to the participants and authorized operators. We send transactional notices when a time is proposed, confirmed, changed or canceled; requested reminders apply only to mutually confirmed current times. A brief follow-up may ask whether a visit happened. A passing date does not establish that it happened. Scheduling is optional and is not required to receive contact details otherwise permitted by a completed connection.

We use event/status records to understand visit-to-bid conversion, including whether an estimate was reported, requested or submitted and whether no new bid appears after 7, 14 or 30 days. These metrics do not copy private messages or contact details and are not automatic fraud findings. Appointment history follows the job/account retention and lawful deletion practices described above.

Platform payments, credits and financial records

When you use a paid platform-fee confirmation after billing is activated, Stripe processes the payment. Card-entry information goes directly to Stripe through its payment interface; BidGreat does not store full payment-card numbers or card security codes. We retain necessary Stripe customer, transaction, payment-method, refund and dispute identifiers and permitted limited payment metadata to the extent provided for the transaction. Stripe processes information under its privacy information and our applicable service arrangement.

We keep selected-offer fee bases, express agreement versions and timestamps, disclosed fee breakdowns, credit grants/reservations/redemptions/restorations, payment/refund results and necessary audit records to administer fees, prevent duplicate benefits, resolve disputes and meet legal obligations. Records distinguish the provider business/billing state, job state, applicable tax jurisdiction and treatment, credits, waivers and amount charged. Permitted payment identifiers, when available, may support a proportionate business-relationship review; a shared payment method alone is not an automatic fraud finding.

Financial and agreement records are retained for applicable accounting, tax, dispute and legal requirements, ordinarily seven years after settlement or closure where justified, with limited introductory-redemption evidence while needed to administer the continuing program. Access/deletion rights and lawful exceptions remain as described in this notice. Publishing this notice does not itself activate card collection or introduce device or payment-card fingerprint collection.