BidGlory privacy notice

1. Who handles what

BidGlory is business software licensed to a company (the "Customer"). The bid, job, product and client records inside a BidGlory instance belong to that Customer, who decides what goes in and who may see it. ProjectThunder Systems operates the hosted service and processes those records on the Customer's behalf. If you are an estimator using BidGlory at work, your employer is the Customer.

2. What the app sends to our servers

• Your sign-in. The user name or e-mail address you type and your password, sent over HTTPS to obtain a session token. The password is not stored on the device. The token is held in the iOS Keychain and expires.
• The records you open and edit. Bids, bid items, rooms, jobs, job log entries, purchase orders and product data.
• Client and contact details. Company name, contact person, phone and mobile numbers, fax, e-mail address, and postal and ship-to addresses.
• Photos and files you attach to a bid, including photos you take with the device camera from the bid screen.
• A sign-in audit record. Date and time, the user name presented, whether the attempt succeeded, the IP address it came from, and the browser or app identifier. It exists to detect password guessing and account misuse.

3. What we do not do

BidGlory contains no advertising or analytics SDK and no advertising identifier. We do not track you across other companies' apps or websites, we do not sell or share your information with data brokers, and we do not use your data or your Customer's records to train models. The app does not ask for your location, your device's address book, your photo library, your microphone or your calendar. The only device-sensor permission it requests is the camera, and only for a photo you deliberately take to attach to a bid.

4. What stays on the iPad

So the app keeps working without signal, the iPad keeps three things inside the app's private storage:

• your session token, in the iOS Keychain;
• a read cache of answers the server has already given, so screens still open offline;
• an outbox of edits you made while offline that have not yet reached the server.

The two local database files are marked so that iOS keeps them encrypted at rest — unreadable until the first time the iPad is unlocked after it restarts — and excluded from iCloud and iTunes backups. One consequence is worth stating plainly: restoring a backup onto a replacement iPad does not carry unsent edits across.

Signing out deletes the token and erases the read cache. It deliberately does not delete the outbox. Those are your own edits that have not been sent, and deleting them would destroy your work. They stay on that iPad under your account, are sent the next time you sign in on it, and cannot be read or sent by anyone else who signs in on that iPad. An unsent edit is never quietly sent long after the fact — past a fixed age it is shown to you for a decision instead.

5. Your controls

• Sign out on the device, which clears the token and the read cache as described above. If you have unsent edits, the app tells you before it signs you out and lets you stay signed in to send them first.
• Change your password from the account screen.
• Deactivation and deletion. BidGlory accounts are created and closed by your organisation's BidGlory administrator, not by self-service, so there is no in-app "delete my account" button. To have your account closed, or to ask what personal data is held about you, contact your administrator or write to us at the address below, and we will act on the Customer's instruction. We would rather say this plainly than offer a button that does not do what its label promises.

6. How long we keep it

Business records live for as long as the Customer's instance does; the Customer decides when they are removed. Server-side records of individual device edits are kept for a bounded period after the edit and are then purged. Sign-in audit records are retained for security investigation.

Questions about this notice? Email support@bidglory.com. See also the licence agreement.