Privacy Policy

Effective date: 22 August 2026

Orange Chair Corporation, operating as Bucket 6 Inc., provides BidParser. This policy explains what we collect, why, who we share it with, and what you can do about it.

1. What we collect

You give us:

data	why
Name, email address	account identity, sign-in, support
Organisation / company name	tenant identity, billing
Password or Google sign-in	authentication (see below — we never see a password)
Payment details	subscription billing (see below — we never see a card number)
Estimates, projects, saved searches	the product working as intended
Support correspondence	answering you

Collected automatically:

• Log data — IP address, browser type, pages requested, timestamps, error traces. Used for security, debugging, and abuse prevention.
• Usage analytics — see section 4.
• Cookies — see section 5.

We never see two things. Authentication is handled by Clerk and payment by Stripe, each on their own infrastructure. Your password and your card number never reach our servers.

2. Why we process it

• To provide the service and keep your account working
• To bill you and prevent payment fraud
• To answer support requests
• To secure the service and investigate abuse
• To understand aggregate usage and improve the product
• To comply with legal obligations

Where GDPR applies, our bases are: performance of a contract (providing and billing the service), legitimate interests (security, abuse prevention, aggregate product analytics), consent (marketing email and non-essential cookies, where required), and legal obligation.

3. Sub-processors

We do not sell your personal information. We share it only with providers who run part of the service:

provider	role	what it receives
Clerk	authentication and identity	name, email, credentials, session data
Stripe	payments and subscription billing	name, email, billing address, payment method
Resend	transactional email delivery	name, email, message content
Google Cloud Platform	hosting, database, file storage	all service data, at rest and in transit
Google Analytics	aggregate usage analytics	pseudonymous usage events — see section 4

Each is bound by its own agreement to process data only as instructed. We may also disclose information where required by law, to enforce our Terms, or to protect rights and safety.

If we ever transfer the business, account data may transfer with it; you will be notified.

4. Analytics, and what we deliberately do not send

We use Google Analytics 4 (property G-QHFSMY3XQ4) to understand aggregate usage — which features are used, where people get stuck.

We deliberately exclude personal and business-sensitive data from analytics. We do not send names, email addresses, organisation names, or user identifiers. We also strip query strings before they reach Google, because this application puts pay item codes, contract numbers, and record identifiers in URLs — and those reveal what you are bidding on. Your competitive activity is not shared with an analytics provider.

If Google Ads conversion tracking is enabled, conversion events carry only an opaque identifier for deduplication — never an email or a name.

You can opt out with Google's browser add-on, or by blocking analytics cookies.

5. Cookies

• Essential — session and authentication cookies set by us and by Clerk. The service cannot function without them.
• Analytics — set by Google Analytics, described above.

Most browsers let you block or delete cookies. Blocking essential cookies will prevent sign-in.

6. Retention

• Account and service data: for the life of your account, and retained after cancellation so you can reactivate without losing work. We do not currently delete it on a fixed schedule. You can request deletion at any time and we will action it.
• Billing records: as long as tax and accounting law requires, typically seven years. Held by Stripe and by us in summary form.
• Application and access logs: 30 days, then automatic deletion by our hosting provider. Separate infrastructure audit logs recording administrative actions on our own cloud account are retained longer by the provider; those record our staff's actions, not your use of the service.
• Support correspondence: as long as needed to provide support and resolve disputes.

7. Security

Data is encrypted in transit (TLS) and at rest. Credentials are never stored by us. Database credentials and API keys are held in Google Secret Manager rather than in application configuration. Access to production data is limited to personnel who need it.

No system is perfectly secure, and we cannot guarantee absolute security.

8. Your rights

Depending on where you live you may have the right to access, correct, delete, port, or restrict processing of your personal information, to object to processing, and to withdraw consent.

California (CCPA/CPRA): you may request disclosure of the categories and specific pieces of personal information collected, request deletion, and opt out of "sale" or "sharing". We do not sell or share personal information as those terms are defined. We will not discriminate against you for exercising a right.

EEA/UK (GDPR): in addition to the above, you may lodge a complaint with your supervisory authority. Data is processed in the United States; transfers rely on appropriate safeguards.

Exercise any of these via https://bidparser.com/contact. We will verify your identity and respond within the time the applicable law requires.

9. Children

BidParser is a business tool and is not directed to anyone under 18. We do not knowingly collect information from children. If you believe a child has provided information, contact us and we will delete it.

10. Changes

We may update this policy. Material changes will be notified by email or in-product before taking effect. The effective date above always reflects the current version.

11. Contact

https://bidparser.com/contact Orange Chair Corporation d/b/a Bucket 6 Inc. 117 Logan Avenue, Geneva, Illinois 60134

---