Privacy notice
Effective 2026-10-20
Controller and contact
BidCanopy is a trading name of VALTHYR LTD.
- Registered company number
- 15131490
- Registered office
- 12 Aberdovey Way, Stevenage, SG1 2XX, United Kingdom
- Registered in
- England and Wales
- VAT registration
- GB503556214
For service and privacy enquiries: contact@valthyr.com. You can also use Support in your private workspace.
We control account, service security, support and billing information. When you upload personal data on behalf of your organisation, you remain its controller and we process it to deliver the service under our data processing terms.
Information, purposes and lawful bases
Supabase manages email verification and sign-in codes. It supplies a verified account identifier and email; necessary secure cookies maintain your session. We do not store an account password. These identify your private workspace and support the contract with you, or our legitimate interest in serving your employer’s authorised users. Company profiles, procurement records, files, extracted passages and reports are processed to provide the functions you request. Support messages and operational logs help resolve problems, secure the service and prevent misuse under our legitimate interests. Billing references and transaction records are processed for the service contract and legal accounting obligations. Microphone permission is optional; declining it leaves text questions available. We do not sell personal data or use it for advertising.
AI, hosting and payment providers
When you run an AI tool, selected source passages, relevant workspace facts and your instructions are sent to OpenAI. Recordings go to its transcription service; voice questions use a recording of up to 30 seconds. Only the transcript and report are saved by BidCanopy, not the original recording. Browser read-aloud may use your browser or operating system’s speech service. Illustrations send a learning prompt derived from the selected guide. Standard and detailed reviews use the Responses API with response storage disabled. This does not disable OpenAI’s separate abuse-monitoring retention, normally up to 30 days. API inputs and outputs are not used for model training by default. Hosted extended reviews and experimental live conversations are unavailable in the launch offer.
OpenAI provides website hosting, using infrastructure including Cloudflare for stored workspace records and files. Supabase handles email verification and authentication sessions. Stripe handles checkout, billing addresses, tax identifiers and payment methods; BidCanopy never receives your full card number. The operator can access service records when needed for support, security or administration. We disclose information where required by law.
International processing
Providers may process information outside the UK, including the United States. Transfers rely on applicable adequacy decisions or contractual safeguards, including UK-compatible standard contractual terms where required under the provider’s data-processing arrangements. Ask support for details or a copy of the applicable safeguards. Do not upload classified material or data requiring a storage region or contractual arrangement that BidCanopy has not expressly agreed to provide.
Retention
Workspace records, original files, extracted sources and reports remain until you remove them or delete your account content. We keep the latest 20 workspace restore points and up to 500 account activity entries. Deleting an original file does not delete its extracted text or older reports; remove these separately or delete the account content. Closed support requests are eligible for deletion two years after their last update. Open requests remain while unresolved.
Account deletion cancels the subscription and removes workspace content, uploaded files, reports, restore points and support requests. A minimal deleted-account marker prevents interrupted writes from recreating records and remains until you explicitly reopen the account. Financial records are retained for seven calendar years after the transaction date, and longer if required for an outstanding legal or tax matter. Deleted-account payment records use a random reference; invoices and legally required records may remain with Stripe and in the seller’s accounting system. Backups and provider security records follow their own documented retention periods.
Your rights and choices
Use Account & billing to export, correct, restore or delete your content and manage billing. You may request access, correction, erasure, restriction, portability or object to processing where those rights apply. We normally respond to privacy requests within one month; we may verify identity or explain a lawful exception. Where processing relies on consent you can withdraw it without affecting earlier processing. You may complain to the UK Information Commissioner. We do not make legally significant automated decisions about people. You make final procurement decisions.
Account identification is required to provide a private workspace; billing details are required for a paid subscription. We use essential authentication and payment sessions, with no advertising or optional analytics cookies installed by BidCanopy. Authentication and payment providers describe their own cookies in their notices.