Privacy Policy

1. Introduction

KonBid ("we," "our," or "us") operates the website at konbid.com and the KonBid web application (the "Service"), a construction estimating and takeoff tool used by companies to build, manage, and export project bids. This Privacy Policy explains what personal information we collect, where it goes, how long we keep it, and the choices and rights you have. We have written it to describe what the application actually does, not what a template says.

By creating an account or using KonBid, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.

2. Information We Collect

Account and company information

When you create an account, we collect your full name, email address, and password. Your password is never stored by us in readable form; it is hashed by our authentication provider, Supabase. When you create a company workspace, we also collect the company name, and, if you provide them, the company's contact phone number, contact email address, and mailing address. Depending on how the account admin configures the company's bid documents, the workspace may also store a logo image, brand colors, custom quote terms, and a sales tax percentage. Each individual member of a company workspace also has a profile with a display name, initials, and an assigned role (admin, senior estimator, estimator, or viewer) that determines what they can view and edit.

Payment and billing information

When your company subscribes to a paid plan, payment information is provided directly to Stripe, our payment processor. Stripe collects the billing contact's name, billing address, card or bank details, and the IP address of the transaction. We never see or store card numbers, CVV codes, or bank account numbers. We store your company's Stripe customer ID, subscription details (plan, status, and billing dates), invoice references, and records of the billing event notifications Stripe sends us, which we retain for accounting, tax, and fraud-prevention purposes.

Company data and uploaded files

The projects, estimates, change orders, templates, bid document presets, and cost database entries (labor, equipment, material, and vendor resources, crews, and assemblies) that your company creates are stored in our database, hosted on Supabase, and are visible only to members of your own company workspace. Your uploaded PDF construction drawings, together with the takeoff measurements, quantity counts, cut/fill and grading data, and markups you create from them, are stored in Cloudflare R2, our cloud object storage provider, with related metadata kept in our database. Files are kept in a storage bucket/folder scoped to your company and are never accessible to another company's workspace. This information is often commercially sensitive (for example, internal labor rates, vendor pricing, and bid strategy), and we do not access, use, or share it except as necessary to provide, maintain, and support the Service, or as required by law.

Support requests

When you submit a feature request, support ticket, or bug report from inside the app, your message, its subject line, your company, and your user account are recorded directly in our own database. We do not use any third-party helpdesk or ticketing tool to handle support requests.

Automatically collected information

We collect a limited amount of technical and usage information through these channels:

• Google Analytics: We use Google Analytics 4 on our marketing and application pages to understand traffic and how the Service is used, including page views, session data, and traffic sources. This runs for all visitors by default. See Section 3 for the cookies this sets.
• Server and authentication logs: Our hosting provider (Vercel) keeps standard, short-lived request logs, including IP address, browser type, and pages requested, and our authentication provider (Supabase) keeps its own security logs of sign-in activity. These are used for security monitoring and operations. We do not maintain a separate internal analytics database of your in-app activity.

3. Cookies and Browser Storage

KonBid uses a small number of cookies and browser storage entries, all described below. We do not use advertising cookies, trackers, or data brokers, and we do not currently show a cookie consent banner because every cookie we set is either essential to running the Service or is a standard analytics cookie used across the site.

• Authentication (essential): Our authentication provider (Supabase) sets first-party cookies and browser storage entries to keep you signed in. These are required for the Service to work and are removed when you sign out.
• Cloudflare Turnstile (essential, security): Our authentication forms (signup, sign in, and password reset) use Turnstile for bot detection. It may set tokens in your browser during verification, used solely to distinguish humans from automated access. Supabase Auth verifies the resulting token on our behalf.
• Stripe (essential for payments): When your company reaches Stripe Checkout or the Stripe Customer Portal, Stripe sets its own cookies to secure the billing session and prevent fraud.
• Google Analytics (analytics): Google Analytics sets first-party cookies, including _ga and _ga_*, to distinguish visitors and persist session state, with a requested lifetime of up to two years (browsers may cap this sooner). These are analytics cookies, not advertising cookies. You can block or clear these cookies using your browser's settings, or use Google's opt-out tools, without losing access to the Service.
• Working data (essential): The app uses your browser's local storage for functional purposes only, such as remembering your view preferences (for example, which panels are collapsed or which display mode you last used) so pages load the way you left them.

4. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the KonBid service
• Authenticate your identity and manage your account and company workspace
• Store and serve your company's cost database, projects, estimates, takeoffs, and uploaded construction drawings
• Process payments, manage your subscription, and handle billing matters, including invoicing, failed-payment recovery, tax calculation, and refunds where applicable
• Send transactional emails about your account (email verification, password reset, security alerts, and billing notices)
• Understand how the Service is used, through Google Analytics, so we can prioritize improvements
• Detect and prevent fraud, abuse, and unauthorized access
• Answer your support requests and communicate about changes to the Service

We do not sell, rent, or trade your personal information. We do not use your data for advertising. We do not use any artificial intelligence or machine learning features to process your data, and we do not share your company data with any third party except the service providers listed in Section 5, which are necessary to operate the Service.

5. Third-Party Service Providers

These are all of the third-party services that receive personal data in order to run KonBid, and what each one receives:

• Supabase (authentication and database): your account credentials, company and profile information, cost database, projects, estimates, takeoff measurements, and support requests.
• Cloudflare R2 (file storage): your uploaded PDF construction drawings and related markup files, stored in a company-scoped storage bucket that other companies' workspaces cannot access.
• Stripe (payments): your company's billing details, collected by Stripe directly. Stripe is a PCI-DSS Level 1 certified processor, calculates applicable sales tax and VAT via Stripe Tax, and may retain billing records for up to seven (7) years to comply with tax and accounting law.
• Cloudflare Turnstile (bot protection): browser signals on our authentication forms, used to distinguish humans from automated access.
• Vercel (hosting): standard web request logs (IP address, browser type, pages requested) as an unavoidable part of serving the site.
• Google Analytics (website analytics): page views, session data, and traffic sources for visitors to our site and application.

Each provider operates under its own privacy policy and, where it processes personal data on our behalf, under a data processing agreement with us. We do not use any advertising pixels, session recording, heatmaps, AI processors, or data brokers, and we do not use any support ticketing tool other than our own database.

6. Where Your Information Is Processed

KonBid is based in the United States and provides the Service from the United States. Our service providers (Supabase, Stripe, Cloudflare, Vercel, and Google) likewise process data on infrastructure located in, or operated from, the United States. If you access KonBid from outside the United States, you understand that your information will be transferred to and processed in the United States.

7. Data Retention and Deletion

We retain your company's data for as long as your subscription is active. Once a paid subscription ends — whether by cancellation, a failed-payment lapse, or termination by us — your data is guaranteed to be retained for at least three (3) months from the date the subscription ended, and may be deleted at any time after that window if you have not re-subscribed. If your company completes the free trial and never starts a paid subscription, your account and all associated data are instead subject to deletion beginning three (3) months after the trial ends. Both policies are described in full in our Terms of Service. KonBid does not currently offer a self-service "delete my account" control inside the product. To delete your company's account and all associated data, an authorized admin of your company workspace must contact us at [email protected] and request deletion. Once we verify the request, we permanently remove your company's data, including:

• Company and profile information
• All projects, estimates, change orders, templates, and cost database entries
• All uploaded PDF drawings, takeoff measurements, and markups stored in Cloudflare R2
• All member accounts associated with your company workspace

This process is irreversible and cannot be undone once completed. If your company has an active paid subscription at the time of deletion, the subscription is canceled as part of that process, and no refund is issued for the unused portion of the billing period. Billing records (the payment event notifications described in Section 2) are retained separately, because tax, accounting, and fraud-prevention law requires keeping transaction history; Stripe likewise retains its own billing records for up to seven (7) years. We recommend exporting any estimates, cost database entries, or bid documents you need (via the in-app PDF and CSV export tools) before requesting deletion.

8. Emails

KonBid sends transactional email only: account verification, password reset, security alerts, and billing-related notices. These emails are sent by our authentication provider, Supabase, through our configured SMTP connector. We do not currently send marketing, newsletter, or promotional email. If that changes in the future, we will update this policy and provide an unsubscribe mechanism for any non-transactional email before sending it.

9. Data Security

We take reasonable measures to protect your information from unauthorized access, alteration, disclosure, or destruction, including:

• Encryption of all data in transit using TLS/HTTPS
• Row Level Security policies on our database so a company can only access its own data, and Cloudflare R2 storage buckets/folders scoped per company so uploaded files cannot be reached by another company's workspace
• Secure authentication with password hashing, handled by Supabase Auth
• Bot detection on our authentication forms via Cloudflare Turnstile
• Payment data handled exclusively by Stripe, a PCI-DSS Level 1 certified processor; we never store card numbers
• Restricted internal access: our own staff access to customer data is limited to a single authorized platform-operator account, gated behind mandatory multi-factor authentication, with every administrative action recorded in an audit log

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we ever learn of a breach affecting your personal information, we will notify you and the relevant authorities as applicable law requires. If you discover a security vulnerability, please report it to [email protected].

10. Your Rights

Regardless of where you live, you can:

• Access: Request a copy of the personal information we hold about you. Most account and company information is already visible in your account settings, and we will provide the rest free of charge within one month of your request.
• Correction: Update inaccurate account, profile, or company information at any time through your account settings, or ask us to correct it.
• Deletion: Request deletion of your company's account and all associated data as described in Section 7, subject only to the legal retention of billing records described there.
• Portability: Export your cost database, estimates, and bid documents using the in-app PDF and CSV export tools, or email us for a copy of your data in a portable format, free of charge.

To exercise any of these rights, email [email protected]. We respond to all requests within one month.

California residents

KonBid does not currently meet the thresholds that make a company a "business" regulated by the California Consumer Privacy Act (CCPA), such as annual gross revenues above the statutory threshold or buying, selling, or sharing the personal information of 100,000 or more California consumers or households each year. We do not sell or share personal information as the CCPA defines those terms. Even so, we voluntarily extend the rights listed above (know, access, correct, delete, and no retaliation for exercising them) to all users, wherever they live. If we ever meet the CCPA's thresholds, we will update this policy and adopt the full set of processes the law requires.

11. Governing Law

This Privacy Policy is governed by the laws of the Commonwealth of Massachusetts, without regard to conflict of law principles. Any disputes regarding privacy matters will be resolved in the state or federal courts located in Massachusetts, consistent with the Terms of Service.

12. Children's Privacy

KonBid is a professional tool intended for use by adults in the course of business. No one under the age of 13 may use the Service, and you must be at least 18 years old to be the billing owner of a subscription, as described in our Terms of Service. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will delete that information promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the "Last updated" date at the top of this page. For changes that materially affect how we collect or use your personal information, we will give you at least thirty (30) days advance notice by email and in-app notice before the change takes effect. Continued use of the Service after changes are posted constitutes acceptance of the revised policy.

14. Related Policies and Contact Us

A separate Terms of Service governs your use of KonBid and is available at https://konbid.com/legal/terms. If you have questions about this Privacy Policy or how we handle your data, contact us at [email protected]. We answer every privacy question and request within one month.