LEGAL · VERSION 1.2

Privacy Policy

Version: 1.2
Effective date: September 27, 2026

1. Who we are and what this policy covers

SubbaSubba Enterprises, LLC, doing business as SubzBid ("SubzBid," "we," or "us"), provides construction project discovery, document analysis, and bid workflow software. This policy explains how we handle personal information through our website, application, account setup, integrations, and support. Contact us at privacy@subzbid.com or 2404 Heather Hill Ln., Plano, TX 75075, United States.

For account administration, security, support, and our own communications, we determine how information is used. When we process project documents and workspace information for a business customer, we also act on that customer's instructions and under our agreement with it. Your employer or workspace administrator may have its own privacy practices and obligations. This policy does not replace them or the policies of third-party services you choose to connect.

2. Information we collect

• Account and profile information: name, work email, mobile number, authentication and verification records, job title, optional profile photo, and account preferences. Our authentication provider handles password and verification credentials.
• Company and office information: business name, office address, website, parent-company information you provide, service area, trade preferences, staffing information, branding, and workspace membership and permissions. We use office and project locations to estimate distance; this feature does not require live device location.
• Project and business information: plans, drawings, specifications, addenda, project contacts, bid dates, assignments, annotations, estimates, proposals, correspondence you submit, and generated analysis. Documents and directories may contain names, professional contact details, signatures, or other personal information.
• Connected-service information: the connected provider and account identifier, email address, permissions granted, encrypted access and refresh credentials, connection status, and information retrieved for the feature you use. Section 5 explains the current mailbox features.
• Communications and consent records: support requests, chat messages, report descriptions, screenshots and files you submit, invitation details, service communications, Terms acceptance version and time, and separate email and SMS marketing choices.
• Technical and security information: IP address and request information available to our hosting and security providers, browser or device characteristics, session identifiers, access and error logs, timestamps, and activity needed to operate and protect the Service. We may use account and verification records to detect abuse and repeated free-trial claims. Identifiers derived from personal information are not automatically treated as anonymous information.
• Subscription records: trial dates, usage records, and any agreed subscription, invoice, and payment-status information.

We receive information from you, your workspace's authorized users and administrators, connected services you authorize, project owners and plan centers, available project listings, and providers that help operate the Service. Do not submit personal information unrelated to legitimate project work, such as government identification numbers, personal financial account details, medical records, or credentials in project documents.

3. How we use information

We use information to create and administer accounts; verify contact details and source eligibility; manage company and office access; deliver project discovery, document analysis, citations, proposals, and collaboration; operate authorized integrations; answer support requests; communicate about the Service; administer trials and agreed subscriptions; diagnose errors and improve reliability; prevent abuse and unauthorized access; maintain consent records; and comply with legal obligations or resolve disputes.

We may send product news or offers according to your choices and applicable law. Accepting the Terms, providing a phone number, or starting a trial does not itself subscribe you to marketing texts or emails. We do not use personal information to make decisions about credit, employment eligibility, housing, insurance, or similar legal or significant personal interests.

4. Project analysis and AI processing

Authorized project materials, relevant excerpts, document images, questions, and other inputs needed for analysis may be processed by automated systems and hosting, document-processing, and AI service providers. These inputs may contain personal information present in the project material. Authorized SubzBid personnel and reviewers may inspect project material and results for quality, source verification, support, and security, subject to access restrictions.

We use this processing to provide the requested project features. SubzBid does not operate a general-purpose AI model-training program using customer content or source materials. We use third-party AI services for analysis. Provider handling, retention, and any use for model improvement depend on the provider's terms, account type, and settings; we have not verified a universal provider-training exclusion across all processing paths and do not promise one. Contact privacy@subzbid.com before submitting material whose confidentiality or source restrictions require a specific provider-data-use commitment. Google user data is subject to the stricter limits in Section 5. The Service may use indexing and retrieval to find relevant information for authorized project work; this is distinct from general-purpose model training.

Your nonpublic estimates, prices, proposals, and internal annotations are not sold or made available to unrelated customers. Project-source information and common project results may be available to other independently authorized customers, subject to applicable source rights. That does not grant them access to your private bid work.

When you use AI Help, your messages and relevant conversation context are sent to our AI service to produce replies. The chat is held in the browser page rather than saved as a support ticket unless you review and submit a report. Submitted reports, replies, and optional screenshots are stored for authorized support staff and may generate service-notification emails. AI-assisted report drafting processes the information you supply for that feature. Avoid including passwords, tokens, or unnecessary confidential bid information in Help.

5. Gmail and Microsoft mailbox connections

Mailbox connections are optional and require a separate authorization with Google or Microsoft. Selecting an integration during onboarding only records your interest; it does not connect a mailbox. Provider authorization can grant read permissions broader than the information the current preview feature retrieves.

When you connect an available mailbox, we retrieve its account identity and store the connection metadata and encrypted access and refresh credentials. When you request a preview or browse available folders or labels, we retrieve folder or label names and identifiers and up to ten message previews containing message identifiers, subjects, senders, and received dates from the selected folder or label, or the inbox by default. The on-demand preview does not retrieve message bodies or attachments. A connection used only for intake requests read access. If you choose project email, we also request draft creation permissions. Google’s draft permission includes permission to manage drafts and send messages; Microsoft’s permission includes reading and writing mailbox messages. SubzBid prepares drafts for you to review and send in your mailbox. Monitoring and approved imports are separate features described below.

Preview information passes through our servers to your browser and is held in the current page's memory rather than saved as mailbox content in our database or browser storage. Connection status and last-check information are retained. Clearing the preview removes the displayed preview. Disconnecting removes the stored connection and credentials from our active connection store; it does not delete messages at the provider. You can also revoke SubzBid's permission in your Google or Microsoft account settings. Routine backup retention is addressed in Section 8.

If available and you enable monitoring, we periodically check new messages in your selected folder or label for bid opportunities. This retrieves message identifiers, subjects, senders, dates, and short text previews. We retain detected-opportunity details, monitoring progress, and your sender preferences so you can review notifications. If you approve an import, we retrieve and store the selected message text and supported attachments in your authorized workspace. Where extraction is enabled, imported material can pass through the project-analysis workflow and its AI providers. Pausing monitoring stops future scans; disconnecting does not automatically delete previously approved imports or project records. You can request their deletion as described in Section 8.

On-demand mailbox previews are not sent to AI providers. Approved imports used for analysis are subject to Section 4 and the Google-specific restrictions below. Before introducing materially different mailbox access or uses, we will update the relevant disclosures and obtain any required authorization.

SubzBid's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. Google user data is used only for authorized, visible mailbox, opportunity-detection, and approved project-import features. It is not sold, used for advertising or credit decisions, or used to train general-purpose AI models. Transfers are limited to delivering the authorized features with user consent, security, legal obligations, or a business transfer with explicit prior user consent. Human access is limited to specific user-authorized assistance, necessary security or legal purposes, or permitted aggregated internal operations. These limits also apply to data derived from Google user data and take priority over broader provisions in this policy.

When you start an RFI, bid email, or other email from a project, we create a draft in your selected mailbox, including the saved proposal PDF for a bid email. We periodically read the linked conversation to confirm sends and retrieve replies. We store message identifiers, subjects, sender and recipient details, timestamps, and message text in that project’s contact history, visible to authorized project users in your office. Reply notifications go to the user who started the conversation. This does not activate general inbox intake. Disconnecting stops future access and deletes saved mailbox credentials; previously recorded project history remains subject to the retention and deletion provisions below.

6. When we disclose information

• Your workspace: authorized coworkers and administrators can access information needed for their company and office roles, including shared project work, profile identity, assignments, and proposals. A personal mailbox connection does not automatically share its preview with coworkers.
• Service providers: providers of application hosting, databases, storage, authentication, email and verification-message delivery, document processing, AI processing, and technical support receive information needed for their work. We require appropriate confidentiality, security, and use restrictions. Provider access depends on the feature and deployment; contact us for current provider information.
• Recipients you authorize: we disclose information when you direct us to share it or use an available collaboration or export feature. Copies you distribute are subject to the recipients' practices and applicable source restrictions.
• Legal and security purposes: we may disclose information as reasonably necessary to comply with law or valid legal process, protect rights and safety, investigate abuse, or resolve disputes.
• Business transactions: information may be disclosed under appropriate confidentiality protections during a merger, acquisition, financing, reorganization, or sale of relevant assets. Any successor remains subject to applicable privacy commitments, law, and the additional Google-data limits above.

We do not sell personal information or share it for cross-context behavioral advertising. Mobile information, text-message opt-in information, and consent records are not shared with third parties or affiliates for their marketing or promotional purposes. Providers may process that information to deliver our authorized communications and support them.

7. Cookies, browser storage, and choices

We use cookies and similar session technologies for sign-in, authentication, security, and connection authorization. Browser storage may retain interface preferences, such as appearance and document-view settings, and local demo or setup state. Clearing or blocking these technologies can sign you out or prevent features from working. Avoid entering confidential project information in a shared browser's demo workspace.

The application does not use third-party advertising pixels or cross-site behavioral advertising. We do not currently alter application behavior in response to a browser's generic Do Not Track signal. We honor legally required opt-out preference signals where applicable; because we do not sell personal information or share it for targeted advertising, there is currently no such sale or sharing to opt out of.

You may update available profile and account preferences, disconnect integrations, unsubscribe using marketing email links, or contact privacy@subzbid.com. If a marketing text program is offered, you may reply STOP to opt out and HELP for assistance. Message and data rates may apply. Essential account and security notices are separate from marketing preferences.

8. Retention and deletion

We retain information for as long as reasonably needed for the purposes described here, considering active accounts and projects, customer instructions, source permissions, support needs, security, legal obligations, and disputes. Different categories have different retention needs. Trial expiration does not automatically erase the workspace or all account information.

Account and workspace records are generally retained while needed to provide and administer the Service. Consent and agreement history, limited trial-abuse prevention records, billing records, and information required for legal or security purposes may be retained after an account closes. Project-document retention also depends on source rights and the relevant storage and processing workflow; the Service is not a permanent document archive.

You may request deletion at privacy@subzbid.com. After verifying the request and any workspace authority, we will delete or deidentify information as required by applicable law and our customer obligations, or explain the applicable reason for retaining it. Deletion from active systems may precede removal from routine backups; retained backup information remains protected and is not used for unrelated purposes. We do not promise that all data is deleted at trial expiration or within a single fixed period.

9. Access requests and privacy rights

Depending on your location, our role, and applicable law, you may have rights to confirm processing, access or obtain a copy of personal information, correct inaccuracies, request deletion, withdraw consent, or object to or restrict certain processing. Some laws provide rights to opt out of sale, targeted advertising, or specified profiling. We will not unlawfully discriminate against you for exercising applicable rights.

Send a request to privacy@subzbid.com with the subject "Privacy request" and enough information to identify your account or the relevant record. Do not send passwords or unnecessary identification documents. We may ask for proportionate verification and, for an authorized agent, proof of authority. Requests involving a business customer's project records may need to be directed to or coordinated with that customer. We respond within the period required by applicable law and explain permitted extensions or denials.

Where an appeal right applies, reply with the subject "Privacy appeal" and explain why you disagree. We will review the decision and provide the explanation and complaint information required by applicable law. You may also contact your relevant privacy regulator or state attorney general. Business-context information and some organizations or processing activities may be exempt from particular laws; this policy does not imply that every statutory right applies to every request.

10. Security and processing locations

We use safeguards designed to protect information, including account authentication, access restrictions, and encryption of stored mailbox credentials. No system or transmission is completely secure. Protect your account, use your own individual login, and promptly report suspected unauthorized access to accounts@subzbid.com.

SubzBid operates from the United States. We and our providers may process information in the United States and other locations where they operate, subject to applicable legal requirements and contractual protections. Privacy laws may differ from those in your location. This policy does not itself replace any transfer mechanism required by applicable law.

11. Adults and external services

SubzBid is intended for business users aged 18 or older and is not directed to children. We do not knowingly collect children's personal information for account use. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.

Third-party websites, plan centers, and connected services have their own privacy policies. We are not responsible for their independent practices. Review those policies before providing information or granting access.

12. Policy updates and contact

We will identify the effective date and version of this policy and notify users of material changes through a prominent notice or account communication as appropriate. We will obtain consent when required before materially changing how previously collected information is used. Prior published versions will remain available.

For privacy questions or complaints, account support, or legal notices, use the applicable contact below:

SubbaSubba Enterprises, LLC — SubzBid
2404 Heather Hill Ln.
Plano, TX 75075, United States
Privacy questions, requests, and complaints: privacy@subzbid.com
Account support and unauthorized access: accounts@subzbid.com
General support: support@subzbid.com
Legal notices: legal@subzbid.com