Privacy policy

byAUTO Pty Ltd (ABN 71 678 061 642) operates BidNomy and handles personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. This page says what we collect, why, and what you can ask us to do about it.

What we collect

• Account information — your name, work email address, organisation name and role. Provided by you at sign-up.
• Authentication data — a hashed credential or an OAuth identifier, held by our authentication provider, not by us in readable form.
• Organisation and team — the organisation name, who is in it, each person’s role, and who invited whom. An invitation holds the invitee’s email address and who sent it for 14 days.
• Workspace content — alerts, bids, tasks, tags, custom fields, notes, automations and their runs, notification channels, and the files you upload with the text extracted from them.
• Billing — a Stripe customer id and subscription id, the billing email, the plan and its status, and a log of the events Stripe sends us. Never card numbers: those go to Stripe and never reach us.
• Usage records — pages viewed, searches run, exports taken and AI requests made, kept for security, billing accuracy and product decisions.
• Device and sign-in signals — the browser and system you sign in with (“Chrome on macOS”), roughly where from (city, region and country, from your network address, never a precise location), when, and a random device id kept in a cookie on that browser, of which we store only a scrambled form. We use them for account security: your trusted devices, the device limit of your plan, and noticing when a login looks shared or taken over (for example, sign-ins from places too far apart to travel between). Your browser’s rough coordinates are rounded to about 11 km before they reach us. The automatic steps all have a way back you take yourself (signing other sessions out, a warning email, asking each device for a code again). Only a person on our team can make an account read-only, until you contact support.
• Visits to the public site — which public pages a browser opened, and when, through the HubSpot and LinkedIn tags described under Cookies. Never the signed-in workspace.
• Where you signed up from — the campaign tags on the link you signed up from (for example utm_source=linkedin), and LinkedIn’s or Google’s click id when you came from a LinkedIn or Google ad, and the first page you landed on with the site that sent you there, kept with your organisation.
• Records you open — which published records you opened and when, so Home can show your Recently viewed list and what your organisation follows. Your organisation sees these only as totals (“opened by 3 people on your team”), never who opened what, and never another organisation’s. You can turn it off, or clear it, on your account page; when you leave an organisation your opens stay in its totals without your name.

What we do not collect

We do not build profiles of individual public servants, and there is no people-search feature. We show no contact names, phones or emails from tenders or plans; the only people we name are ministers, from the PM&C Ministry list.

We show the names, titles and portfolios of Commonwealth ministers exactly as the Department of the Prime Minister and Cabinet publishes them in its Ministry list, with a link to that list, and we never collect or show their contact details.

Why we hold it

• to give you access to the service and keep the account secure, including checking a new device and noticing unusual sign-ins;
• to run your organisation, its seats and its invitations;
• to send the alerts and reports you asked for;
• to apply the limits of your plan and to take payment;
• to answer support requests;
• to decide what to build next, using aggregate figures;
• to follow up people who contact us, and to measure our own advertising.

Government records are not personal information about you

The procurement records in the product are published by Australian Government agencies as open data. They are subject to their publishers’ terms, not this policy. This policy covers information about you as a user of the service.

Who else sees it

These are the processors we use. Each is bound by contract to use the data only to provide its service.

Your workspace is held in Sydney. Three disclosures leave Australia: the text of an AI request goes to a model provider in the United States, payment goes through Stripe, which also operates in the United States, and a visit to the public site and the fact that you signed up are seen by LinkedIn. Under Australian Privacy Principle 8 we take reasonable steps to see that an overseas recipient handles the information consistently with the Australian Privacy Principles. We do not sell personal information. The only things shared for advertising are a visit to the public site, through LinkedIn’s tag, and the fact that you signed up: a one-way hash of your email address and, if you came from a LinkedIn ad, LinkedIn’s own click id. Never your name, your organisation or anything in your workspace.

Data you send elsewhere

Some features send workspace data wherever you point them. A notification channel posts bid and task details to a webhook, a Microsoft Teams or Slack channel, an email address or a Jira project of your choosing. An API key lets your own script or AI client read what you can read, through the API or the Model Context Protocol server. Those are disclosures you have directed, to a destination you control, and we cannot see what happens to the data once it arrives. Revoke the key or switch the channel off to stop it.

AI features

The question you ask, the records the agent reads to answer it and any document you attached are sent to the model provider to generate the answer. Prompts and uploaded documents are not used to train models. AI and your data sets out exactly what is sent, what is never sent, and where your words are kept.

How long we keep it

Deleting a conversation, a file or a bid removes it when you press delete. Closing the account removes the rest within 30 days, except where a record must be kept by law.

Your rights

You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Write to support@bidnomy.com and we will respond within 30 days. If you are not satisfied with our response you can complain to the Office of the Australian Information Commissioner.

Cookies

Signing in sets the Supabase authentication session cookie, so you stay signed in from page to page, and bn_device, a random id that tells us this browser is one of your trusted devices. If you pick a light or dark theme, that choice is kept in your own browser under govai-theme, which is local storage rather than a cookie and is never sent to us. The public site (not the signed-in workspace) uses Cloudflare Web Analytics to count page views; it sets no cookie and collects no personal data.

The public pages (home, pricing, about, the guide and these legal pages, and, before you sign in, the workspace pages open to visitors in Opportunities, Market intelligence and Government) also carry two tags that set cookies:

• HubSpot records which of those pages a browser opened. If you later contact us or sign up, the visits are joined to your contact record, so we know what you read before getting in touch.
• LinkedIn’s Insight Tag tells LinkedIn a browser visited, so we can count which of our LinkedIn ads led to a visit or a sign-up and show our ads to past visitors. LinkedIn reports these to us only as totals.

Neither tag runs on the sign-in and sign-up pages or anywhere in the workspace once you are signed in. When you create an account, our server tells LinkedIn once, with a hash of your address, so we can count which ads led to sign-ups; LinkedIn reports these to us only as totals. Nothing you do inside BidNomy after that reaches HubSpot or LinkedIn. To stop them, block cookies for this site in your browser, or turn off LinkedIn’s use of off-site data in your LinkedIn ad settings.

The public pages keep, in our own cookie bn_ad_click for 90 days, the first page you landed on and the site that sent you there (its address without the query string), and, when you arrive from a Google ad, Google’s click id and the link’s campaign tags. If you sign up, these are kept with your organisation so we can see which pages and ads led to sign-ups; Google Ads is told only the click id and when, never your name or email address.

Changes

If this policy changes materially we will tell account holders by email before the change takes effect. The current version always sits at /legal/privacy.