Data Processing Agreement
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Brian Pasfield (ბრაიან ფასფილდ), Individual Entrepreneur registered in Georgia (the country), registration number 305874809 (the “Processor”) and the customer organisation (the “Controller”). It governs our processing of personal data contained in the content your organisation puts into its workspace.
1. Roles
Your organisation is the controller of its workspace content and determines the purposes and means of its processing. We process that content only on your organisation’s instructions, which are given through its use of the platform and any written instruction it sends us. For the personal data of the individuals who use our site and sign in, we are the controller and our Privacy Policy applies.
Questions asked of the in-app Guide are processed on your organisation’s instructions to answer them. The stored copy of each question and answer described in §6 is an exception: we keep and read it for our own purpose of improving the product, as a controller under our Privacy Policy. Your organisation authorises that use by having the Guide switched on for its workspace.
2. Subject matter, duration, nature and purpose
Subject matter. Provision of the BidAngel procurement intelligence and proposal platform.
Duration. For as long as your organisation has a workspace, plus the post-termination retention period in §8.
Nature and purpose. Hosting, storage, indexing, retrieval, AI-assisted extraction and drafting, answering questions asked of the in-app Guide, workflow orchestration, and audit recording.
Categories of data subject. Your organisation’s staff and contributors; individuals named in content your organisation uploads, such as staff named in past-performance narratives or CVs; buyer-side contacts appearing in published procurement records.
Categories of personal data. Names, business contact details, job roles, employment and qualification details where your organisation includes them in proposal content, platform activity records, and questions asked of the in-app Guide with their answers. The platform is not intended for special-category data; do not upload it.
3. Our obligations
- Process personal data only on your documented instructions, including for transfers, unless required otherwise by law — in which case we will tell you unless prohibited.
- Ensure personnel with access are bound by confidentiality and have access only where needed.
- Implement appropriate technical and organisational measures — see §5.
- Engage subprocessors only under §4.
- Assist you in responding to data-subject requests, and in your data-protection impact assessments and consultations, to the extent the platform makes that assistance possible.
- Notify you without undue delay, and in any event within 72 hours, on becoming aware of a personal-data breach affecting your content, with the information you need for your own notification duties. Where not all of that information is available at once, we will provide it in phases as it becomes available. Our incident-response process is a documented runbook, not an ad-hoc reaction.
- On termination, delete or return your content per §8.
- Make available the information needed to demonstrate compliance, and permit audit on reasonable notice, subject to confidentiality and to not compromising other customers.
4. Subprocessors
Your organisation gives general authorisation for us to engage the subprocessors listed below. We impose data-protection obligations on each that are no less protective than those in this DPA, and we remain liable for their performance. We will give notice of an intended addition or replacement, and your organisation may object on reasonable data-protection grounds.
This list is the authoritative one. The Privacy Policy points here rather than restating it, so there is no second copy to drift.
| Subprocessor | Purpose | Data processed | When engaged |
|---|---|---|---|
| OpenRouter | AI inference routing — requirement extraction assistance, evidence-sufficiency assessment, drafting, faithfulness checking, and answering questions asked of the in-app Guide. OpenRouter forwards each request to one of the model hosts in the next row; it is a router, not the model provider | The requirement being answered and the approved content-library excerpts selected as evidence for it, sent as prompt context, and the generated output. For the in-app Guide: the question, the asking user’s role and screen, the fields of the record they have open that the Guide reads to answer it, and the answer | Always, for AI features, unless your organisation supplies its own provider credential. Every request is restricted to endpoints that neither retain request data nor use it for training, and to United States endpoints, with no fallback: a request no such endpoint can serve fails rather than being sent elsewhere |
| Amazon Web Services (Amazon Bedrock) and Google Cloud (Vertex AI) | AI model execution (Anthropic Claude models), reached through OpenRouter. OpenRouter selects between the two per request | As above, in transit and in memory while the request is served; not retained | Always, for AI features, as above. Regions: Amazon Bedrock United States, and Google Vertex AI us-east5 (Columbus, Ohio, United States) |
| A customer-supplied AI provider | AI inference under the customer’s own account and credential | As above | Only where your organisation supplies its own provider credential. Your organisation, not us, selects that provider and accepts its terms |
| Voyage AI | Text embeddings for semantic retrieval over your content library, where cross-pursuit answer search is enabled over your submission drafts, and, where the in-app Guide is switched on, to find the user-guide sections closest to a question asked of it | Content-asset text; where cross-pursuit answer search is enabled, submission-draft text together with the question it answers; the text of each search; and, for each question asked of the in-app Guide, the question as typed, the name of the screen it was asked from and the previous question in the conversation as stored (with values read from your records replaced by placeholders). Nothing the Guide reads from your records is sent. All of it is submitted for embedding | Only where semantic retrieval is enabled for your workspace, or where the in-app Guide is switched on for it. Guide questions are sent whichever AI provider your organisation uses, including its own provider credential. Submission-draft text is sent only where cross-pursuit answer search is also enabled |
| WorkOS | Single sign-on and directory integration | Email address and identity-provider profile of signing-in users | Only where your organisation configures SSO |
| Sentry (Functional Software, Inc.) | Error monitoring — reports of unexpected errors in the API and the web application, so we can find and fix them | The error message and stack trace, the path of the failing request or page, the browser and operating system for web-application errors, and the pseudonymous identifier of the signed-in user. Before anything leaves our systems we strip authorization and cookie headers, tenant identifiers, IP addresses, request bodies, query strings, email addresses and credential-shaped strings. No session recordings, and no performance traces | Always, in the hosted environment. Region: United States. Retained for up to 90 days |
| Resend | Transactional email — password-reset links, workspace invitations, reviewer notifications and digests, and multi-factor enrolment reminders | Recipient email address, display name, and the subject and body of the message sent, which may name the pursuit or artefact the notification concerns | Always, for any email the platform sends |
| Fly.io | Application hosting — the marketing site, the web application, and the API | All customer content in transit through the application, and in memory while a request is served | Always, in the hosted environment. Region: iad (Ashburn, Virginia, United States) |
| Neon | Managed PostgreSQL — the primary system of record | All customer workspace content and platform activity records at rest | Always, in the hosted environment. Region: us-east-1 (United States) |
| Cloudflare R2 | Object storage for uploaded solicitation documents, extracted document text, and generated submission packages | Uploaded and generated documents at rest | Always, in the hosted environment. Buckets are created in the default jurisdiction, which is United States |
| Amazon Web Services | The append-only audit sink, and nightly backups of the database and document storage — S3 with Object Lock, each under its own customer-managed KMS key, in the United States (us-east-1) | Exported audit records (who did what, when, and to which record); and full backup copies of the database and uploaded documents, which include workspace content | Always, in the hosted environment. Audit records are write-once and cannot be deleted before their retention term expires, by design. Backups are locked against deletion for 35 days and then expire automatically |
Every row above names a vendor. The rows describe the hosted environment as it is provisioned at the version date of this document; the platform is not yet generally available.
5. Security measures
Measures in place include per-tenant data isolation enforced at the data-access layer; role-based access control with explicit permission checks on state-changing operations; multi-factor authentication and enforceable single sign-on; brute-force protection and account lockout; per-route rate limiting on authenticated surfaces; encryption of customer-supplied AI provider credentials at rest; an append-only audit ledger covering reads as well as writes; and scrubbing of credentials, headers and request bodies from error telemetry before dispatch.
Agent access is not a side door: first-party agents, external agents connected over a tool protocol, and human members all reach the platform through the same typed tool registry with the same tenant isolation, role gating, approval requirements, and audit recording. See our security page and trust page for detail.
6. AI processing
Content your organisation has approved is sent as prompt context to the inference subprocessor in §4 in order to extract requirements, evaluate criteria, draft sections, and check drafted sentences against the sources they cite. A question asked of the in-app Guide is sent with the asking user’s role and screen and with the fields of the record they have open that the Guide reads to answer it, which need not be approved content. Every such request is restricted, in the platform’s code and in our provider account settings, to model endpoints that neither retain request data nor use it for training, and to endpoints in the United States. We do not train models on your content. Model output is generated into an advisory state and becomes part of your approved record only when a member of your organisation approves it.
Where your organisation configures its own provider credential, the content goes to the provider your organisation chose, under that provider’s terms. We encrypt the credential at rest and never log it.
Stored Guide questions. Where the in-app Guide is switched on for your workspace, we store each question asked of it, recorded against the asking user and your workspace, with the answer, the screen it was asked from, the sources the answer used, its outcome and the user’s feedback. Before the question and answer are stored, each name, title, description or note of four characters or more that the Guide read from your records to answer that question is replaced, wherever it appears word for word, by a placeholder naming the field, such as <pursuit.buyerName>. A value the answer words differently is not replaced, and text a user types that the Guide did not read from your records is stored as typed; the Guide asks users not to paste confidential content. The stored copies are readable by our platform administrators and not by other members of your workspace. They are deleted 180 days after the question is asked, or sooner if the workspace is deleted, as set out in the Data Retention Schedule. They are not included in a workspace export.
7. International transfers
Processing takes place in the United States. Application hosting, the primary database, document storage, the audit sink and AI model execution are all located in US regions, named per subprocessor in §4. Where your organisation supplies its own AI provider credential, the region is the one your organisation’s provider account uses. Where a transfer of personal data outside the UK or EEA occurs, we rely on an adequacy decision where one applies, and otherwise on the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, incorporated by reference, with the parties’ details taken from this DPA and the transfer details from §2 and §4. We do not currently offer an EU or UK data-residency option; if your organisation has a residency requirement, raise it with us before relying on the platform.
8. Retention, return and deletion
On request while its workspace is active, your organisation can obtain an export of its content; a self-service export is not yet available. On termination, content is retained for a limited window to permit export and then deleted from live systems. Copies in backups are not deleted individually; they expire with the backups, within 37 days of deletion from live systems. Audit records are retained for their own defined period, because their evidential value depends on their not being selectively removable; where a deletion obligation and an audit-retention obligation conflict, we will tell you which applies and why.
Export timing. Where your organisation makes a verified request for an export during an active workspace or within the 30-day post-termination request window, we target delivery within 10 business days of verifying the request, subject to documented technical, security or legal impediments communicated without undue delay. We will not defeat a timely request by performing routine deletion while the export is being prepared. We will restrict and securely retain only the data necessary to fulfil the export and will then delete that temporary copy in accordance with the Data Retention Schedule. Statutory retention and preserved immutable audit records remain subject to their separately stated rules.
Liability. Liability arising under this DPA is governed by the single collective aggregate liability regime in §10 of the Terms of Service, except to the extent a signed negotiated document expressly supersedes that regime or applicable law prohibits limitation. This DPA does not establish a separate or cumulative cap. This does not reduce our stated responsibility for subprocessors, which remains subject to that collective liability regime.
9. Signed and negotiated copies
This page publishes our standard DPA. Where your organisation needs a countersigned copy, a negotiated variant, or a specific transfer instrument executed, write to [email protected] or use our contact page. A signed agreement prevails over this page to the extent of any conflict.