Privacy Policy

BiddingView is run by High Rally Enterprises Private Limited (CIN U62010KA2026PTC222598), a company incorporated in India with its registered office at Shop No. 3, Sirsi Road, Near Honda Bike Showroom, Mundgod, Uttara Kannada, Karnataka 581349, India. Under the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the company is the Data Fiduciary for the personal data described here, and it is responsible for what follows.

The product indexes Karnataka Public Procurement Portal (KPPP) tender data and gives contractors tools to work with it — search, alerts, bill-of-quantities lookup, a contract book, and paperwork.

Questions about this policy, requests about your own data, and complaints all go to support@biddingview.com. That address reaches the person the company has made responsible for them, and our Grievance Officer.

Tender data itself is public information published by KPPP. It is not personal data. Everything below is about you. We collect it to provide the service you sign up for, and use it for nothing else.

We do not collect contacts, calendar, microphone, camera roll or advertising identifiers. The mobile app opens the camera, the photo picker or the file picker only at the moment you choose to attach a document, add a picture to your paperwork, or set a profile picture. It receives only what you pick, and uses it for nothing else.

Location is never sent to us. Tapping “near me” on the tenders map asks the phone where it is, so the map can sort tenders by distance; that coordinate is used on the device and discarded. Refusing the permission costs you nothing else.

The website sets no cookies and runs no advertising or analytics trackers. It keeps a few things in your browser’s own storage — your sign-in, your theme, drafts of forms you have not submitted, and the usage record above until it is sent. The cookies page lists them.

Account records, contracts and bills are held in a PostgreSQL database on Amazon Web Services in the Mumbai region (ap-south-1). Uploaded files are held in a private Amazon S3 bucket in the same region, encrypted at rest, with public access blocked, and served to you through links that expire in five minutes.

Some of the services listed below process a limited part of your data outside India: email delivery (Resend, a US company), crash reports (Sentry, in its German data centre), push notifications (Google), App Store purchases (Apple) and map tiles (the OpenStreetMap Foundation, in the United Kingdom). We send personal data only to countries the Government of India has not restricted under section 16 of the DPDP Act.

We do not sell your data, and we do not share it with advertisers. It is disclosed only to the services that run the product, and only as far as they need:

• Amazon Web Services — hosting, database and file storage (India).
• MSG91 — sends the one-time code to your phone by SMS. Receives your phone number and the code (India).
• WhatsApp (Meta) — if your one-time code is sent over WhatsApp instead of SMS, it receives your phone number and the code.
• Resend — delivers our emails: codes, alerts, the daily brief, receipts. Receives your email address and the message.
• Razorpay — takes payments on this website. Your card or UPI details go to Razorpay directly; we receive only the outcome and a reference.
• Apple — takes payments in the iPhone app. Apple tells us which plan was bought, when it renews or ends, and an identifier for the purchase; your payment details stay with Apple.
• Google Firebase Cloud Messaging — delivers push notifications to your phone, if you allow them. Receives the device token and the notification.
• Sentry — crash and reliability reports, as described above. Receives your IP address.
• OpenStreetMap — the tile servers that draw the map receive your IP address when a map is shown.
• OSRM — the app asks the public OSRM routing server for road distances to a tender. It receives the tender’s location (not yours) and your IP address.
• Our chartered accountant — receives the monthly GST report, which lists each invoice: the buyer’s name, GSTIN, state and the amounts.

We would also disclose data where the law requires it, for example to a court or a tax authority acting under its powers.

• Your account and everything in it: for as long as the account exists. Delete the account and it goes — see below.
• Sign-in attempt records: for security, and deleted when the account is deleted.
• Crash reports and email delivery records: kept by Sentry and Resend for the limited period their service keeps them, then deleted by them.
• GST invoices and payment records: eight years, as tax and company law require, even after the account is deleted.
• Database backups are kept for seven days. Deleted data can remain in an encrypted backup until it rolls off, and is then gone.

Tender data is public and stays indexed regardless; it is KPPP’s, not yours or ours.

Under the DPDP Act you can:

• See what we hold about you — most of it is already on your account page; ask and we will send a summary of the rest, and of who we have shared it with.
• Correct or complete it — in your account, or by asking us.
• Have it erased — by deleting your account, as above.
• Withdraw consent — by deleting your account, or for emails by switching them off in Account → Emails or with the unsubscribe link in any email. Withdrawing does not undo what was lawfully done before.
• Nominate someone to exercise these rights for you if you die or become unable to.
• Complain — to our Grievance Officer, below, and then to the Data Protection Board of India.

Write to support@biddingview.com from the email address on your account, so we know the request is yours. We answer within 30 days.

Complaints about how we handle your data, or about anything on BiddingView, go to our Grievance Officer:

We acknowledge a complaint within 24 hours and resolve it within 15 days, as the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 require. If you are not satisfied with the outcome, you may take it to the Data Protection Board of India.

Data travels over HTTPS, and the database, its backups and your files are encrypted at rest. Passwords are hashed with bcrypt; files are reached only through short-lived signed links. If a breach affects your personal data, we will tell you and the Data Protection Board of India, as the DPDP Act requires.

BiddingView is a tool for contractors bidding on government work. It is not directed at children, and we do not knowingly collect data from anyone under 18. If you believe a child has given us data, write to us and we will delete it.

When this policy changes, the date at the top changes with it, and if the change affects what we collect or who we share it with we email account holders before it applies. We will not use your data for a new purpose without asking you first.

See also the Terms of service.