Last updated 24 October 2026
This explains what personal information BidWrap holds, why, who helps us look after it, how long we keep it, and your rights. We have kept it in plain words. If anything is unclear, email hello@bidwrap.app.
BidWrap is run by Rob Durston, a sole trader based in Northern Ireland, trading as Rob Durston Photography. For the information about you as a BidWrap user, we are the data controller under UK data protection law (the UK GDPR and the Data Protection Act 2018). Contact: hello@bidwrap.app.
Information about you as a user: your name, email address, login, the business details you enter in Settings, and messages you send us. We decide how this is used, so we are its controller.
Information you put into BidWrap about your own clients and work: clients, contacts, jobs, estimates, invoices, payments, receipts and kit. This belongs to you. You decide what goes in and why, so you are its controller and we look after it on your behalf as your processor. The terms of use set out how we do that. If one of your clients asks about their information, they should contact you, and we will help you answer.
| What | Why | Lawful basis |
|---|---|---|
| Name, email address, password (stored only as a secure hash by our login provider) | To create your account and let you sign in | Contract: we need it to provide BidWrap to you |
| Business details you enter: names you trade under, addresses, tax and bank details for your invoices | To print them on your documents | Contract |
| Problem reports: your message, email address, business name, the page you were on and your browser | To fix what went wrong and reply to you | Legitimate interests: keeping BidWrap working |
| Invite requests and emails you send us | To set you up and answer you | Legitimate interests, or steps before a contract |
| Basic technical records: when you sign in, error logs, the internet address a request came from | Security and fixing faults | Legitimate interests: keeping BidWrap and your data safe |
We do not sell your information, show you adverts, or use it to build a profile of you. We make no decisions about you by automated means alone.
When you email an estimate or invoice from BidWrap, your client gets a private link. BidWrap records when that link is first and last opened, and how many times, so you can see it has been seen. It does not record who opened it or where they were.
These companies process information for us, under written agreements that require them to keep it secure and use it only as we instruct:
| Company | What they do | Where the data is kept |
|---|---|---|
| Supabase | The database, logins, and storage for receipts and logos, including daily backups | Stockholm, Sweden (EU) |
| Vercel | Hosts the BidWrap website and app | App requests are handled in Stockholm, Sweden; Vercel is a US company |
| Resend | Sends emails from BidWrap: invites, password resets, estimates, invoices and reminders | Ireland (EU) |
| Anthropic | Reads receipts you upload, to fill in the supplier, date and amounts. The receipt image is sent for reading only. | United States. Anthropic deletes the receipt and the reading from its systems within 30 days, apart from the limited exceptions in its own policy. |
| Squarespace | Our domain name, and forwarding of emails sent to bidwrap.app addresses | United States |
| Our own business email, where your emails to us arrive | United States and elsewhere |
Where information goes outside the UK, it is protected by the safeguards UK law requires, such as UK adequacy regulations or the standard contract terms approved for UK transfers, which these companies include in their agreements.
We will tell you here before adding a new company that handles your information.
BidWrap uses only the cookies it needs to work: one that keeps you signed in, and one that remembers which of your businesses you are working in. There are no advertising or tracking cookies, so we do not ask you to accept any.
Your invoices and receipts are your business records, and the law may require you to keep them for several years. Before closing your account, download a full copy from Settings, under Backups.
Information travels encrypted. Each business can only ever see its own data: the database itself enforces this, not just the app. Logins use a specialist provider, passwords are never stored in readable form, and admin keys are kept out of the app. We back up every business every night.
You can ask us to:
Email hello@bidwrap.app. We will reply within one month. There is no charge.
If you are unhappy with how we have handled your information, please tell us first. You can also complain to the Information Commissioner’s Office, the UK regulator, at ico.org.uk/make-a-complaint.
If we change this page in a way that matters, we will tell you by email or in BidWrap before the change takes effect.