Privacy Policy

BidSquirrel is a service operated by Orcana Ltd, a company registered in England & Wales (company no. 17263330), whose registered office is Beverley Road, Hull, HU6 7JN, United Kingdom.

Orcana Ltd is the data controller for the personal data described in this notice. We have not appointed a Data Protection Officer, as we are not required to. For any privacy question or to exercise your rights, contact us at privacy@bidsquirrel.co.uk.

We are registered with the UK Information Commissioner's Office (ICO), registration no. ZC171438.

• Account data - your email address and authentication details (managed by our auth provider, Supabase).
• Business service line - information you give us about your business (name, sectors, capabilities, contract-value range, locations served, accreditations, insurance, financial standing, growth objectives, website, company number) so we can match tenders to you.
• Usage data - alerts you set, and tenders you save, track, and mark as applied/won/lost.
• Shared procurement references (ITTs) - an ITT is the buyer's common tender pack, issued to every bidder on a procurement. When you add one, we keep its extracted text as a shared reference for that tender, so other bidders on the same tender don't have to re-upload it. This is the buyer's public document, never your bid: your own answers, drafts and Evidence Vault stay private to you (below) and are never shared. Nothing you provide is ever used to train AI models, and we honour takedown requests for a shared reference.
• Evidence Vault documents and saved answers - if you use the Evidence Vault, the documents you upload (such as insurances, accreditations and case studies) and the reusable answers you save are stored in a private, access-controlled store and used only to produce your own results - for example, to build your bids from your own evidence. They are never shared and never used to train AI models. You can delete any document or answer at any time, and they are removed when you delete your account.
• Payment data - handled entirely by Stripe. We never see or store your full card details; we hold only a customer/subscription reference and your plan status.
• Technical data - standard server logs (IP address, browser type, timestamps) used for security and to keep the service running.
• Enrichment data from public sources - see section 3.

Separately, the public procurement notices we collect sometimes contain a buyer's procurement contact details, published by the contracting authority so suppliers can get in touch. Those are not your data as a user of this service, and they have their own notice: public sector buyer contact details.

Most of the personal data we hold is provided directly by you. In addition, to enrich your service line and surface evidence of your track record, we obtain limited information about your business from publicly accessible sources, namely UK Companies House (to confirm company identity/number) and published public-procurement award notices (to match contracts your business has previously won). Where your business is a sole trader, this may include information that relates to you as an individual.

Our teaming / consortium feature also shows you the names of winning suppliers drawn from these publicly-published award notices (released under the Open Government Licence), so you can identify an established prime to approach as a teaming or subcontract partner. Where a winning supplier is a sole trader, that name may relate to an individual; it is shown only because it has already been published publicly by the contracting authority.

• To provide the service - matching, scoring, guidance, tracking and the email digests you request. Lawful basis: performance of our contract with you.
• To take payment and manage your subscription. Lawful basis: performance of our contract; compliance with our legal (tax/accounting) obligations.
• To secure, maintain and improve the service and prevent abuse. Lawful basis: our legitimate interests in running a safe, reliable product.
• To send service messages (e.g. security, billing, important changes). Lawful basis: performance of our contract / legitimate interests.
• To operate and support your account - a small number of authorised BidSquirrel personnel (at present, the founder) can access your account and the personal data in it to answer support requests, investigate and fix problems, prevent abuse, and meet our billing and legal obligations. This access is restricted to authorised staff, and each access, change and export is recorded in an internal log. Lawful basis: our legitimate interests in operating and supporting the service, and performance of our contract with you.

Where we export account data internally for the operational purposes above, that export is access-controlled and logged, the data is kept only as long as needed for the task and then deleted, and it is never shared outside Orcana Ltd except with the sub-processors listed below. We do not sell your data, and we do not use it for third-party advertising.

A core part of BidSquirrel uses AI (our provider is Anthropic) to score your business by service line against published tenders. The logic is, in plain terms: we send your business service line and the relevant tender text to the AI, which assesses how well your stated capabilities, scale, location, eligibility and growth objectives fit each tender, and returns a fit tier (Strong / Fair / Development / not-a-fit) plus written commentary and optional bidding guidance.

This profiling is decision support only. It does not produce a solely automated decision that has a legal or similarly significant effect on you - you decide which tenders to pursue and whether to bid, and the score does not grant, deny or price anything. Its purpose is simply to save you time by ranking opportunities. AI output can be incomplete or wrong (see our Terms). Your data is not used to train AI models, by us or by Anthropic under our business terms. If you have questions about the scoring, or want a human to review a result, contact us at privacy@bidsquirrel.co.uk.

We rely on a small set of trusted providers who process data on our behalf, under contract:

We also call public data services (UK Companies House and postcodes.io) which receive only the specific lookup value (such as a company name or postcode), not your account.

Some providers above are based in the USA. Where your personal data is transferred outside the UK, we rely on the UK's International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses (or an applicable adequacy decision) so that it remains protected to UK standards. You can ask us for details of the safeguard in place.

• Account and service line data - for as long as your account is active.
• Shared procurement references (ITTs) - the buyer's common tender pack, kept as extracted text as a shared reference for that tender (never your bid, never used to train AI models); removed on a valid takedown request.
• Evidence Vault documents and saved answers - kept while your account is active; removed when you delete them or delete your account.
• After you delete your account - your personal data is removed promptly; limited billing/transaction records may be retained where we are legally required to keep them (e.g. for tax, normally up to 6 years).
• Backups containing data may persist for a short rolling period before being overwritten.

Under UK GDPR you have the right to access, correct, delete, restrict, port and object to the processing of your personal data. Where we ever rely on consent (for example, if we later introduce analytics cookies), you can withdraw it at any time.

You can delete your account and associated data yourself at any time from your account settings, and download a copy of your data there too. To exercise any other right, email privacy@bidsquirrel.co.uk. We will respond within one month.

You don't have to give us any personal data, but some is necessary to use the service: we need your email to create and secure your account, and your business service line to match tenders and provide the paid features. Without these we can't provide those parts of the service. Enrichment from public sources (section 3) is optional and helps improve your matches.

We use essential cookies to keep you signed in, to keep the service secure, and to remember your answer to the question below. Those are necessary to provide the service and are set without consent, as the rules allow.

We also use analytics and advertising technologies— Google Analytics and Google Ads, the Meta pixel, and the LinkedIn Insight Tag — but only if you accept them. Nothing loads and no such cookie is set until you click “Accept” on the banner. Decline, or simply ignore it, and none of them run.

If you accept, we may also confirm a completed sign-up directly to those platforms from our servers, using a one-way scrambled version of your email address so they can match it to an advert you saw. If you decline, we do not send it.

You can change your mind at any time using the Cookie settings link in the footer of any page. Withdrawing is one click, exactly like giving it.

BidSquirrel is a business tool intended for users aged 18 or over. It is not directed at children, and we do not knowingly collect data from anyone under 18.

If you are unhappy with how we handle your data, please contact us first so we can put it right. You also have the right to complain to the ICO - ico.org.uk/make-a-complaint, or the ICO helpline on 0303 123 1113.

We may update this notice from time to time. We will post the new version here and update the date above; significant changes affecting you will be notified by email.