Privacy policy

1. Who is responsible for your data

Bidlemon is the data controller for the personal data described in this policy. For any privacy request or question, write to infobidlemon@gmail.com.

2. Data we collect

• Account data: your email address and, if you register with a password, a securely hashed version of it. If you sign in with Google we receive your email and basic profile from Google and never see your Google password.
• Company data you provide at signup: company name, brand name, website domain and main country of operation.
• Billing data: subscriptions are processed by Stripe. We store your subscription plan and status; full card details are handled by Stripe and never reach our servers.
• Monitoring configuration: the keywords, countries and competitor domains you set up. This describes businesses, not individuals.
• Evidence data: search results, advertiser domains and screenshots collected from public Google results pages. This is public web content, not data about you.
• Technical data: server logs (IP address, timestamps, requested URLs) and the emails we send you (delivery and error status).

3. Why we process it and on what legal basis

• To provide the service you contracted — creating your account, running your monitoring, storing evidence, sending alerts and reports (performance of a contract).
• To charge subscriptions and comply with tax and accounting obligations (contract and legal obligation).
• To send you service emails such as alerts, reports, verification and password-reset messages (contract). We do not send marketing emails without your consent.
• To keep the service secure, prevent abuse and debug failures (legitimate interest).

4. Who processes data on our behalf

We do not sell your data. We share it only with the processors we need to run the service, under data processing agreements:

• Supabase — database, authentication and file storage (hosted in the European Union).
• Stripe — subscription payments.
• Brevo — transactional email delivery.
• Vercel and Railway — application hosting.
• DataForSEO — retrieval of public Google results. It receives the keywords and countries to monitor, never your personal data.
• OpenAI — generation of report summaries and, for administrators, blog translations. Inputs are aggregated monitoring data or editorial content, not customer personal data.

Some providers process data outside the European Economic Area. Where that happens, transfers rely on adequacy decisions or Standard Contractual Clauses.

5. How long we keep it

We keep your data while your account is active. When the account is closed we delete or anonymise it within a reasonable period, except what we must keep to meet legal obligations (for example invoicing records) or to defend legal claims. Residual copies may persist briefly in encrypted backups until they rotate.

6. Your rights

You can exercise your rights of access, rectification, erasure, portability, restriction and objection at any time by writing to infobidlemon@gmail.com. We will answer within the terms set by the GDPR.

If you believe we are not handling your data correctly, you can complain to your supervisory authority — in Spain, the Agencia Española de Protección de Datos (aepd.es).

7. Security

All traffic is encrypted in transit. Access to customer data is isolated per account, protected by row-level security in the database and limited to the minimum our team needs to operate the service.

8. Changes to this policy

If we change this policy in a meaningful way we will announce it on the website or by email before it takes effect. The date at the top always reflects the current version.