Bid Banana Privacy Policy
1. Our Role
Information in your uploaded content. The information you submit to the Services (“User Content”) may contain personal information about your personnel, clients, or other third parties. We process that content to provide the Services to you, and we also use it for our own business purposes described in this Policy, including to develop and improve our products and services and to train and improve artificial-intelligence models; for those purposes, we act as a business / controller. You are responsible for providing any notices and obtaining any consents required for you to upload that content and for us to process it as described in this Policy and the Terms. Before using User Content to train artificial-intelligence models, we remove or de-identify personal information contained in it where reasonably practicable.
2. Personal Information We Collect
(a) Identifiers and account information — name, company name, email address, phone number, username, and password. Source: you.
(b) Payment information — billing details and payment-card information, processed by our payment processors (Stripe and Braintree). We do not store full payment-card numbers. Source: you, via our payment processors.
(c) Company profile information — any details you add to a company profile in the Directory, which is publicly discoverable by other Directory users. Source: you.
(d) User Content — company descriptions and preferences you provide for matching, saved searches, company profile details, support messages, and other content you submit to the Services. This may include personal or confidential information you choose to include. Source: you.
(e) Communications — messages, support requests, and feedback you send us. Source: you.
(f) Internet and device activity — IP address, browser and device type, device identifiers, pages viewed, referring/exit pages, timestamps, and information about your interactions with the Services and our ads, collected via log files, cookies, pixels, and similar technologies. Source: automatic; advertising and analytics partners.
(g) Inferences — matching signals and inferences we or our systems derive from your profile, activity, and opportunity interactions to suggest relevant opportunities, partners, or matches. Source: derived.
3. How We Use Personal Information
- provide, operate, maintain, and secure the Services;
- create and manage your Account and process subscriptions;
- detect, prevent, and investigate fraud, abuse, and violations of our Terms (including unauthorized scraping or access);
- process opportunity data and your inputs through artificial-intelligence systems to provide matching, similar-opportunity, and summarization features;
- monitor your use of the Services, including User Content and AI Output, to enforce our Terms of Use, detect fraud and abuse, and analyze usage for product development and improvement;
- operate, develop, and improve our products and services, including to train and improve artificial-intelligence models (see Section 4);
- deliver, target, and measure advertising, including cross-context behavioral advertising (see Sections 7 and 9);
- communicate with you about your Account, transactions, security, and the Services, and (where permitted) send marketing communications you can opt out of (Section 10);
- provide customer support; and
- comply with legal obligations and enforce our agreements.
4. Artificial Intelligence and How Your Content Is Used
The choices available to you regarding the advertising, analytics, and processing activities described in this Policy are described in Sections 7, 9, and 13. You acknowledge that processing information through artificial-intelligence systems carries inherent risks that cannot be fully eliminated, including potential exposure to AI-system providers and the evolving nature of AI security.
For additional information about how your data and information may be used, please see the Bid Banana AI Use Policy.
5. How We Share Personal Information
Advertising and analytics partners that use cookies and similar technologies to deliver and measure targeted advertising and to analyze usage. Through these technologies, we may disclose identifiers and internet/device- activity information to these partners (see Sections 7 and 9).
Legal and protective recipients — to comply with law, respond to lawful requests, enforce our Terms, or protect our rights, our users, or the public.
Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
At your direction — with parties you choose to interact with through the Directory.
Note on “sale” and “sharing.” Because we use targeted-advertising technologies, our disclosure of personal information to advertising partners may be considered a “sale” and/or “sharing” of personal information as those terms are broadly defined under California and certain other state privacy laws. We do not exchange your personal information for money. You have the right to opt out — see Section 9.
6. Aggregated and De-Identified Information
7. Cookies, Tracking, and Advertising
How we obtain your consent depends on your location. We apply the standard required by your jurisdiction:
Consent-first jurisdictions (opt-in). If you are located in the European Economic Area, the United Kingdom, Switzerland, or any other jurisdiction that requires prior consent, we will not place non-essential cookies or similar technologies (including analytics and advertising technologies) on your device until you have given your prior, affirmative consent through our cookie-consent banner. Strictly necessary cookies — those required to operate and secure the Services — do not require consent and will be used regardless. You may grant, decline, or withdraw consent at any time through our cookie-preferences tool, and declining non-essential cookies will not prevent you from using the Services.
Opt-out jurisdictions. If you are located in the United States or another jurisdiction that permits an opt-out model, we may use these technologies by default and offer you the choices described below to opt out.
Your choices (all users):
- Cookie-preferences tool — you can review and change your cookie choices at any time through the cookie-preferences control available on our website.
- Browser controls — you can block or delete cookies through your browser settings; disabling some may affect functionality.
- Opt-out preference signals — we honor the Global Privacy Control (GPC) and similar opt-out preference signals as a request to opt out of “sale”/“sharing” for the browser or device on which they are enabled.
- Industry opt-outs — you can opt out of many advertising cookies via the Network Advertising Initiative (optout.networkadvertising.org) and the Digital Advertising Alliance (optout.aboutads.info).
- Google — you can opt out of Google Analytics at tools.google.com/dlpage/gaoptout.
- Do Not Track — we do not currently respond to “Do Not Track” browser signals.
For users in consent-first jurisdictions, our cookie-consent banner is the primary mechanism for exercising these choices; the additional controls above are supplementary.
8. Hashed-Email Audience Matching
9. Sale and Sharing of Personal Information; Your Right to Opt Out
Your right to opt out. If you are a resident of California or another U.S. state that provides this right, you may opt out of the sale or sharing of your personal information and of targeted advertising by:
(a) using our “Do Not Sell or Share My Personal Information” control, available through the cookie-preferences tool on our website;
(b) enabling the Global Privacy Control (GPC) in your browser or on your device, which we will treat as a valid request to opt out of the sale or sharing of personal information for that browser or device; or
(c) using the industry opt-out tools described in Section 7.
We will process opt-out requests, including GPC signals, within the timeframe required by applicable law. Opting out of targeted advertising does not prevent you from using the Services.
10. Marketing Communications
11. Data Retention
Account information — retained while your Account is active and for up to 90 days after closure (and may persist longer in routine backups).
Payment and transaction records — retained for approximately seven (7) years to meet tax, accounting, and audit requirements.
User Content — retained while your Account is active and deleted up to 90 days after account closure or upon your request, except that we may retain aggregated or de-identified information derived from it, and we are not required to remove User Content from artificial-intelligence models or datasets already trained or built with it, to the extent permitted by law.
Analytics and advertising identifiers — retained per our and our partners’ settings, typically for a shorter period.
You may request deletion as described in Section 13, subject to our need to retain certain information as required or permitted by law.
12. Security
13. Your Privacy Rights
How to exercise your rights. Submit a request to [email protected] (or use the “Do Not Sell or Share My Personal Information” control for that opt-out). We will verify your identity before responding and may ask for information to do so. You may use an authorized agent to submit a request on your behalf, subject to verification. We will respond within the time required by applicable law.
If a user requests information be deleted from their account, Bid Lab Technologies may assume that the request is made with the permission from the organization and may request from the organization additional information or confirmation that such request is authorized.
Appeals. If we deny your request, you may appeal by replying to our response; we will inform you of the outcome as required by applicable law.
Non-discrimination. We will not discriminate against you for exercising your rights.
California residents (CCPA/CPRA). You have the rights described above, including to know the categories and specific pieces of personal information we collect, the sources, the business or commercial purposes for collecting it, and the categories of third parties to whom we disclose it (described in Sections 2 and 5); to delete and correct; to opt out of the “sale” or “sharing” of personal information; and to limit the use of sensitive personal information.
Nevada residents. Nevada law (NRS 603A) gives you a separate right to opt out of certain sales of covered information for monetary consideration. We do not engage in sales of that kind. If you would like to submit a Nevada opt-out request in an abundance of caution, you may do so using the contact information in Section 19.
Other US states. Residents of states with comprehensive privacy laws (such as Virginia, Colorado, Connecticut, Utah, Texas, and others) have comparable rights, including to opt out of targeted advertising, which you may exercise as described above.
EEA, UK, and Swiss residents. Your rights under the GDPR, the UK GDPR, and Swiss data protection law are described in Section 16.
Note on uploaded content. Where we process User Content on behalf of the customer who uploaded it (Section 1), requests relating to personal information contained in another party’s User Content should be directed to the customer who uploaded it; we will assist that customer as required, including with respect to breach notification and other processor obligations under applicable law.
14. Automated Decision-Making
Where we use artificial intelligence to match or rank opportunities, partners, or profiles for you, this processing supports your own decision-making and does not produce legal or similarly significant effects about you without human involvement. Where required by applicable law, you may opt out of certain profiling used for targeted advertising or for decisions producing legal or similarly significant effects; see Section 13.
15. Third-Party Links
16. International Users and Data Transfers
If you are located in the European Economic Area (“EEA”), the United Kingdom, or Switzerland, the following additional terms apply to our processing of your personal information under the EU General Data Protection Regulation (“GDPR”), the UK GDPR and Data Protection Act 2018, and the Swiss Federal Act on Data Protection, as applicable.
Controller. The controller of your personal information is the Bid Banana entity providing the Services to you (see the introduction to this Policy). You may contact us at [email protected] or at the address in Section 19. Where required by applicable law, we designate a representative in the EEA and in the United Kingdom; their contact details are available on request at [email protected].
Legal bases. We process your personal information on the following legal bases: (a) to perform our contract with you or your organization, including to create and manage your Account, provide the Services, and process payments; (b) our legitimate interests in operating, securing, and improving the Services, preventing fraud and abuse, enforcing our Terms, communicating with business contacts about the Services, and developing and training artificial-intelligence models and other products, where those interests are not overridden by your rights and interests; (c) your consent, for non-essential cookies and similar technologies, targeted advertising, hashed-email audience matching, and marketing communications where consent is required, which you may withdraw at any time without affecting processing that occurred before withdrawal; and (d) compliance with our legal obligations, such as tax, accounting, and record-keeping requirements.
Your rights. Subject to the conditions and exceptions in applicable law, you have the right to access, correct, or delete your personal information; to restrict or object to our processing of it, including processing based on our legitimate interests (such as artificial-intelligence model training) and, at any time, processing for direct marketing; to receive a portable copy of personal information you provided to us; and to withdraw your consent where we rely on consent. To exercise these rights, contact [email protected]. You also have the right to lodge a complaint with the data protection authority where you live or work, including, in the United Kingdom, the Information Commissioner’s Office.
Artificial-intelligence model training. Where we use personal information to train or improve artificial-intelligence models, we rely on our legitimate interests, we remove or de-identify personal information where reasonably practicable, and we honor objections to future use. Where personal information has already been incorporated into a trained model and cannot reasonably be removed, we will take reasonable steps, to the extent required by applicable law, to prevent its further use or disclosure.
International transfers. We transfer personal information to the United States and to other countries where we or our service providers operate. Where those countries have not been recognized as providing an adequate level of protection, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or a recipient’s certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. You may request a copy of the relevant safeguards by contacting [email protected].
17. Children
18. Changes to This Policy
19. Contact Us
Bid Lab Technologies, LLC — 15930 Boeing Court, Wellington, Florida 33414 — [email protected]
20. Subprocessors
| Subprocessor | Purpose |
|---|---|
| Anthropic | AI processing to provide Services features (such as matching, summarization, and extraction) |
| OpenAI | AI processing to provide Services features (such as matching, summarization, and extraction); hashed-email audience matching |
| Stripe | Payment processing |
| Braintree (PayPal) | Payment processing |
| Google / Firebase | Cloud hosting, database, storage, infrastructure |
| Google Ads | Hashed-email audience matching; advertising measurement |
| Loops | Transactional and marketing email |
| Algolia | Search indexing |
| Meilisearch | Search indexing |
| Slack | Internal communications and support |
| Sanity | Content management (support and FAQ content) |
| PostHog | Product analytics |
| Microsoft | Analytics (Clarity) and advertising (Bing UET, pixel-based) |
| Meta | Advertising (pixel-based); hashed-email audience matching |
| Advertising (pixel-based) | |
| HubSpot | Marketing and CRM |
| Enzuzo | Cookie-consent management |
| Cloudflare | Content delivery, DNS, and security for our websites |
Last updated: October 12, 2026