Privacy Notice

01Information we collect

From the website. If you ask us to contact you, we collect your name, work email, company, the approximate size of the portfolio, property details, and the type of service you need.

From people who use the Service. We collect the name and work email of property managers, asset managers, reviewers, and other people your organization invites. We use those addresses to send sign-in links, one-time codes, approval requests, and related messages. We do not ask for your staff's home address, government ID, or personnel file.

Property and project records your organization puts in the Service. That includes property names and addresses, building and unit identifiers, work descriptions, categories, photos, cost and approval records, invoice or general-ledger comparisons you upload, and contractor bids and quotes. A bid may be a PDF, a photo, or another document, and it may contain the contractor's own contact details if those are printed on it.

Records the Service creates. When a bid is parsed or compared, we store the resulting summary with that request. We also keep an activity record of actions on a request, such as who submitted, commented, approved, or marked a cost paid.

Vendor feedback. After a job is completed, a user at your organization, typically the on-site manager, may rate the contractor and add a comment. We store the rating and comment with the request, along with the name and work email of the person who submitted it.

Records we derive for the market. From bids, we create Benchmark Data, described below, with identifying details removed. It is how we show whether a bid is above, below, or in line with a market. From completion feedback, we create Vendor Ratings, described below, which are how we suggest a vendor to another user.

Contractor details we look up. To show a phone number, website, or public rating for a contractor, we may query Google with the contractor's business name and the property's market. We show those public business details with a vendor suggestion, and we store them only as far as the provider's terms allow.

We do not ask for resident names, leases, Social Security numbers, government IDs, or payment card numbers, and we do not seek investor or resident personal information. Do not put that information in a description, a photo, or a bid file. A property photo can incidentally include a person; avoid photographs that identify residents.

We do not use third-party advertising or analytics cookies in the Service. The Service uses only the cookies and similar storage needed to keep you signed in. Our hosting providers receive standard technical data, such as IP address and browser or device information, when you visit the website or use the Service. Our website loads fonts from Google Fonts, so your browser sends a request, including your IP address, to Google when a page loads.

02How we use information

We use information to:

• provide, secure, and support the Service, including sign-in, approvals, and email notices
• parse and compare contractor bids, and show those results to the people your organization has authorized
• keep a record of spend, approvals, and property condition for your organization
• build and keep anonymized market pricing benchmarks
• collect completion feedback on contractors, and suggest vendors to your users and to users at other customers based on that feedback
• respond to a request you send us from the website
• protect the Service, investigate misuse, and meet a legal obligation

We do not sell personal information. We do not share it for cross-context behavioral advertising.

We do not use your bids or property records to train or fine-tune AI models. We also do not allow OpenAI to use them to train its models: content sent to OpenAI goes through OpenAI's API, which OpenAI does not use for training by default, and we have not opted in.

03Benchmarks and vendor suggestions

We use bid prices to learn what work typically costs in a market, so we can show whether a bid is above, below, or in line with it. We use completion feedback to suggest vendors.

A benchmark may include the trade, the market, a price or a range, a unit, a generalized scope, a period, and how many bids support the figure. It does not include your organization's name, the vendor's name, a property name or street address, a unit, the bid file, a photo, or a person's name. We show a benchmark only when it rests on at least three bids from at least two different customers, so a figure cannot be traced to one customer or one bid.

A Vendor Rating is a rating or comment a user submits about a contractor after a job. A vendor profile may include the vendor's business name, trade, market, a public business phone, website, or public rating, and a summary of Vendor Ratings from users of the Service: an average rating and the number of ratings. We may show that profile to other users of the Service so they can consider the vendor. Written comments stay with the customer that submitted them and are not shown to other customers. If the vendor is a sole proprietor, the business name may be a person's name. We show it as the name of the business being suggested. A vendor that wants to ask about or correct its profile can email privacy@bedrockap.com.

We do not put your organization's name, the property, or your staff's names on a rating or a suggestion, and we do not give another customer the bid file. To recalculate benchmarks, we keep a stripped copy of each bid's price, trade, market, scope, and date. The stripped copy does not include the vendor's name.

We keep Benchmark Data and the stripped bid data behind it after your organization stops using the Service and after we delete your identifiable records, because the benchmarks depend on them. We keep Vendor Ratings your users submitted the same way, without your organization's name, the property, or the submitter's name. If a signed agreement says we will not use your bids or ratings this way, we follow that agreement.

Individual contact details printed on a bid, such as a salesperson's personal mobile number, are not copied into a vendor profile or a benchmark. A phone number or website we show with a suggestion comes from the vendor's public business listing.

04Who else processes information

We use service providers to run the Service. They may process the information described above only to perform the service they provide to us.

Your organization's authorized users can see your organization's records. We separate each customer's account from other customers' accounts. We do not give one customer access to another's account. Other customers can see market benchmarks and vendor suggestions that do not identify your organization.

We may also disclose information if the law requires it, or to protect Bedrock, our customers, or someone else from harm. If we are required to disclose customer records, we will tell the customer unless the law forbids that notice.

05How long we keep information

While your organization uses the Service, we keep the records the Service needs for that account.

When the relationship ends, we delete identifiable customer records from production within 60 days after the relationship ends, or sooner if you ask in writing. Identifiable records include the account, property and unit records, photos, bid files, approvals, invoice and general-ledger files, the user list, activity on those requests, ratings and comments your users submitted, and bid comparisons stored on the request. We also delete or de-identify personal information once we no longer need it for the purpose it was collected, for a dispute, or to meet a legal duty.

We keep Benchmark Data, the stripped bid data behind it, and de-identified Vendor Ratings after that deletion. Before we do, we remove your organization's name, property identifiers, and any person's name or contact details from them.

We may also keep copies we need for a legal duty or a dispute, and backups that expire on their normal cycle of 60 days. OpenAI may keep bid content after the request for abuse monitoring. Website inquiries are kept long enough to respond and to keep a record of the conversation, and then deleted or reduced to a non-identifying note if we no longer need the contact details.

06Your requests

Email privacy@bedrockap.com to:

• correct a name or work email
• close a user's access
• ask us to delete business contact information we hold about you
• ask us to delete your organization's identifiable records when the relationship ends
• ask us to limit use of your own name and work email to operating your account
• ask us to correct or remove a business listing or rating, if you are a contractor we have profiled

If you are asking about an organization's records, we may need the organization to confirm the request. We will not use a privacy request as a reason to deny service, other than where we can no longer provide the Service without the information.

Stopping use, or deleting identifiable records, does not require us to erase Benchmark Data or de-identified Vendor Ratings, because they do not identify the organization, a property, or a person. Benchmarking applies to bids submitted while the organization uses the Service and is not a separate setting that can be switched off. An organization that wants a different rule can negotiate it in a signed agreement.

07Children

The website and the Service are for businesses and their staff. We do not direct them to children under 16, and we do not knowingly collect information from children.

08Changes

If we change this notice in a material way, we will post the updated notice, change the date above, and email the customer at least 15 days before the change applies, using the notice address or an account administrator. If we start sending customer records to a new service provider, we will tell the affected customer who the provider is and what they do.