Last updated: November 12, 2026
bidstead (“bidstead”, “we”, “us”) operates an online platform connecting clients with construction contractors in Canada. This policy explains what personal information we collect, why we collect it, and how it is used, in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA).
We collect and use personal information only for purposes we identify at or before the time of collection, including to:
By creating an account, you consent to the collection, use, and limited disclosure of your personal information as described in this policy. You may withdraw consent at any time, subject to legal or contractual restrictions, by contacting us using the details below. Note that withdrawing consent for certain data (e.g., contact information) may prevent you from using core features of the platform.
To operate the marketplace, some information is necessarily visible to other users: a contractor’s business name, service categories, portfolio, and rating are visible to clients browsing contractors. A client’s project details are visible to contractors they are matched with. Reviews you submit, including your name and rating, are visible to other users viewing the relevant contractor’s profile. We do not display your email address or phone number to other users without your action (e.g., choosing to share it in a message). If a contractor invites you as a team member, you will have access to that contractor’s business account, and the contractor (as account owner) can see team member activity taken under the shared account.
We use third-party infrastructure providers to operate the platform: Supabase (database, authentication, and file storage), Vercel (application hosting, and cookie-free product analytics - see Section 8), Stripe (payment processing for contractor wallet top-ups and paid plan subscriptions), Resend (transactional email, such as account and notification emails), Anthropic (artificial intelligence used to pre-fill project questionnaires from your description and to power the in-app support chat assistant), and Sentry (error monitoring, to help us find and fix problems with the Platform). These providers process data on our behalf under their own security and privacy commitments, and do not use your information for their own purposes.
Some of the providers listed above may store or process personal information on servers located outside Canada, including in the United States. When information is processed outside Canada, it may be accessible to courts, law enforcement, or regulatory authorities under the laws of that jurisdiction. By using the Platform, you acknowledge this transfer.
We use browser local storage to keep you signed in between visits. We do not use advertising cookies or any cookie-based tracking, and we do not sell or share your information with third parties for their own marketing purposes. We do use cookie-free product analytics (page views and feature usage, via Vercel Analytics) and keep our own permanent internal log of business events (such as signups and project activity) to understand and improve the Platform - never for advertising, and never sold or shared with a third party for their own purposes.
We retain personal information only as long as necessary to fulfill the purposes it was collected for, or as required by law. We use reasonable technical safeguards, including encrypted connections, access-scoped database policies, and rate limiting, to protect your information against unauthorized access, loss, or misuse. If we become aware of a breach of security safeguards involving personal information that creates a real risk of significant harm, we will notify the Office of the Privacy Commissioner of Canada and affected individuals as required by law, and keep a record of the breach.
Under PIPEDA, you have the right to access the personal information we hold about you, request correction of inaccurate information, request deletion of your account and associated personal information, and challenge our compliance with this policy. You can permanently delete your account at any time from Settings (“Danger zone” → “Delete account”): this immediately and permanently removes your account and virtually all data associated with it - including your projects, quotes, messages, reviews, matches, calendar events, saved leads and searches, verification documents, support chat history, push notification subscriptions, wallet and transaction history, team member relationships, and any other record tied to your account. The one exception is our internal, permanent business-metrics log (Section 8): those records are kept for aggregate analysis, but the link identifying them as yours is removed, not the records themselves. We may also retain and disclose information as required by law even after an account is deleted. To make any other request, contact us using the details below. If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada.
We may disclose personal information without further consent where required or permitted by law, including to comply with a subpoena, court order, or other legal process, to investigate or prevent fraud or a security incident, or to protect the rights, property, or safety of bidstead, our users, or the public.
bidstead is not directed at individuals under the age of 18, and we do not knowingly collect personal information from minors.
We may update this policy from time to time. Material changes will be reflected by updating the “last updated” date above.
For privacy questions, access requests, or complaints, contact our privacy officer at privacy@bidstead.ca.