Privacy policy

The short version

• No ads and no tracking. BidCoat has no advertising or analytics tools. We don't track you across apps or websites, and we don't sell or share personal information.
• Jobs stay on the phone. A painter's jobs, room scans, rates and settings stay on their phone. Only proposals a painter sends as a link reach our servers.
• We never touch the money. Clients pay deposits straight to the painter's own payment service. BidCoat never sees or processes a payment.
• No cookies. bidcoat.app sets no cookies and loads no third-party scripts.

Who we are

BidCoat is run by Ville Pitkänen, Viipurinkatu 12 L 270, 00510 Helsinki, Finland ("BidCoat", "we", "us"). Write to us at support@bidcoat.app.

• For painters' accounts and the app, we decide how data is used, so we're the controller.
• For the client details a painter puts in a proposal, the painter decides, so the painter is the controller. We store and deliver that data for the painter, to run their proposal, and for nothing else.

What stays on the painter's phone

BidCoat works without an account, and without signal. Your jobs, room scans and measurements, photos, rates, paints, business details and the PDFs you make are kept on your phone. We don't receive them, sync them or back them up. Your iPhone's own backups, such as iCloud Backup, may include them, under Apple's terms.

The app uses the camera and the LiDAR scanner to measure rooms and take photos. Scans are processed on the phone and never uploaded.

What we collect from painters

• Your account. You sign in with Apple, or with a code sent to your email. We keep your email address and an account ID. With Sign in with Apple, the email can be Apple's private relay address. We don't receive your name.
• Proposals you send as a link. When you're signed in and send a proposal, the app uploads it exactly as sent: your business details (name, phone, email, website, address, license numbers and logo), your client's details, the rooms, options, prices and terms, any photos in it, the payment details printed on it, and the PDF.
• Your phones. Each phone signed in to your account registers a push notification token and the app's language, so we can send you alerts in your language.
• Settings for a proposal, such as whether reminder emails go to the client.
• A founding painter code, if you enter one, and when.
• Your subscription. Apple takes the payment and doesn't give us your payment details. RevenueCat, our subscription service, keeps your purchase history (which plan, trial and renewal dates) linked to your account ID. Our server asks RevenueCat whether your account is subscribed, to decide whether to send reminder emails for your proposals, to confirm founding painter places, and to see your plan when you contact support.
• Support messages. See Support messages.

We don't collect your location, contacts, advertising identifiers or how you use the app.

What we collect from clients

A painter who uses BidCoat sent you a link to their proposal. We hold this about you, for the painter:

• What the painter entered: your name, the job's address, and your phone number and email, as printed on the proposal.
• What you do on the proposal page: when you open it (at most once every 10 minutes is recorded), agree to sign online, sign, decline (with any reason you give), ask for a paper copy, say you've paid the deposit, or stop reminder emails. With each, we record the time, your IP address and your browser's user agent (which browser and device type). The painter is told what happened and when.
• When you agree to sign online: the wording you agreed to, that you ticked "I can open and read PDF files like this proposal. I agree to use electronic records and signatures for this job.", and whether you opened the PDF of the proposal before agreeing.
• When you sign: the name you type or the signature you draw, your email address, the option you chose, the date and time, your IP address and browser, the date your right to cancel ends, and a fingerprint (a SHA-256 code) of the exact proposal you saw. We seal this record with its own fingerprint and print it on the certificate at the end of the signed copy, which you and the painter both get. The signed contract is kept at least 7 years after signing, even if the painter deletes their account (see How long we keep it).

Photos in a proposal load from our storage provider, Supabase, through links that expire after an hour, so Supabase also sees your IP address.

When you tap Pay deposit, you go to the painter's own payment service, such as PayPal or Venmo. Its privacy policy applies there. We don't pass it the address of the proposal page, and we never see the payment.

Emails and alerts

We send email through Resend, from BidCoat's own address, named "the painter's business via BidCoat". Replies go to the painter.

• The signed copy. When a client signs, the client gets the signed copy by email: the proposal as sent, the signing certificate, and the notice of cancellation. The painter gets a note with the client's name and email, the option, the total, the deposit and the last day to cancel.
• Reminders. If the painter turns them on, a client who hasn't signed or declined gets at most three short reminders, 2, 5 and 10 days after the proposal was sent, between 9 am and 6 pm in the painter's time zone. Each has the link to the proposal, the painter's name and address, and a link to stop them. Mail apps can also offer a one-click unsubscribe button.
• When reminders stop: when the client signs, declines, asks for a paper copy or stops them; when the proposal expires or a newer version replaces it; when the painter turns them off or marks the job won, lost or archived; and when the painter's subscription has ended.
• Sign-in codes go to painters from Supabase, through Resend.
• Alerts on the painter's phone go through Apple's push notification service. They say what happened, for example "Ana Díaz signed proposal #12" with the option and amounts, or the reason a client gave for declining (up to 180 characters).

Support messages

There are two ways to reach us, and both arrive in the founder's Telegram:

• In the app (Setup → Contact support): we receive your message, the email to reply to, and, so we can help faster, the app version, the iOS version, the phone model, the app's language, your account's email (or your account ID if it has no email), and your plan. The app shows this list before you send. No jobs or client details go with it. Our server passes all of it to a private Telegram chat.
• By email to support@bidcoat.app: your email goes through Forward Email (forwardemail.net), which forwards it to the founder's inbox and to our server. Our server passes the sender, subject and text to Telegram, but not attachments.

Support messages are kept for at most 12 months, wherever they are: our server deletes its copy automatically after 12 months, and the copies in the founder's inbox and Telegram are deleted by then too. Messages sent while signed in are also deleted from our server when the account is.

Who helps us run BidCoat

These services process data for us, only to run BidCoat:

• Supabase (United States, East US region): database, sign-in and file storage.
• Contabo GmbH (Germany): rents us the server in the United States that runs bidcoat.app.
• Resend (United States): sends email.
• Apple: Sign in with Apple, push notifications, and in-app purchases and subscriptions.
• RevenueCat (United States): subscription status and purchase history, linked to the account ID.
• Telegram: delivers support messages to the founder. Nothing else goes through it.
• Forward Email: receives email sent to support@bidcoat.app. Nothing else goes through it.

We don't sell personal information, share it for advertising, or give anyone else access, unless the law requires it.

Where the data is

Our servers and the services above are in the United States. The founder works from Indonesia and may open data from there to run and support BidCoat. If you're in the EU, EEA or UK, your data leaves there with safeguards the law requires, such as the European Commission's standard contractual clauses. Lawyer: confirm the transfer mechanism for each provider.

Why we use it (legal bases)

Where EU, EEA or UK law applies:

• To run the app and your account, and to deliver your proposals: our contract with you.
• The signing record and the proposal page's history: the painter's legitimate interest, and ours, in showing who signed what and when, and the painter's legal duties, such as giving the client a signed copy and a notice of their right to cancel.
• Reminder emails: the painter's legitimate interest in following up on a proposal the client asked for. The client can stop them at any time.
• Support and subscription checks: our contract with you, and our legitimate interest in running the service well.

Lawyer: review.

How long we keep it

• Sent proposals, their photos and PDFs, the proposal page's history, signatures and signed copies are kept unchanged for as long as the painter's account exists. Nothing can edit them: they're the record of what was agreed. A proposal link doesn't expire; after the offer's end date the page says so and signing stops.
• Signed contracts are kept 7 years after signing, even if the painter deletes their account, so the painter and the client can both show what was agreed. What's kept: the proposal exactly as signed (with the client's name, address, email and phone, and the prices) and its fingerprint; the signature record (the signer's name and email, the typed name or drawn signature, the statements ticked, the time, IP address and browser, and the dates); the client's agreement to sign online and the signing itself, each with its IP address and browser; the PDF as sent; and the signed copy. Once the account is deleted, this record is no longer linked to it, nothing can change it, and it's deleted automatically 7 years after signing.
• When a painter deletes their account (Setup → Account → Delete account), we delete everything else straight away: the account, proposals that weren't signed, links, photos, the rest of the page history (views, declines, reminders and payment reports), phone registrations, the founding code, the emails and alerts queued for it, and support messages sent while signed in. Links the painter sent stop working. We also delete the account's customer record at RevenueCat, and where the painter signed in with Apple, we ask Apple to end BidCoat's access, when the app can reach Apple.
• Emails and alerts we've sent are deleted from our server 90 days after they went out (unsent ones within 180 days). Copies already in someone's inbox are theirs and stay there.
• Support messages: at most 12 months, everywhere (see Support messages).
• Purchase records stay with Apple under Apple's policies. RevenueCat's copy is deleted with the account.
• Our web server's access logs (IP address, page, time and browser) are rotated daily and kept for 14 days, for security. The app's own logs stay in the same server's system journal.

Your rights

Wherever you live, you can ask us for a copy of your data, to correct it, or to delete it. Write to support@bidcoat.app. We reply within a month.

• Painters can delete their account themselves in the app (Setup → Account → Delete account). Signed contracts are the exception: they're kept 7 years after signing, as above. The proposals and PDFs on your phone stay yours, and the app shares each one as a PDF.
• Clients: your details in a proposal are the painter's record of your job. You can ask the painter, or us: we'll help the painter answer you, and answer you ourselves if they don't.
• In the EU, EEA and UK you can also ask us to restrict or stop using your data, or to give it to you in a portable format, and you can complain to a data protection authority. In Finland that's the Data Protection Ombudsman (tietosuoja.fi).
• In California and other US states with privacy laws you have the right to know what we collect, and to delete and correct it. We don't sell or share personal information, and we don't use sensitive personal information to infer anything about you. We won't treat you differently for using your rights, and you can use an authorized agent.

We may need to check it's you before acting on a request, for example by replying from the email on the account.

Security

• Everything travels over HTTPS.
• Painters can read only their own data. Sent proposals and signatures can't be changed once stored.
• Proposal links are long random codes, and search engines are told not to index them.
• Sign-in details on the phone are kept in the iPhone's Keychain.
• Our server's secret keys stay on the server, never in the app or a browser.

Cookies

bidcoat.app sets no cookies, and has no analytics or third-party scripts. Two small things are remembered only in your open browser tab, and never sent to us: that the proposal page has already told the painter you opened it, and that you closed the site's language suggestion.

Children

BidCoat is for businesses. It isn't meant for anyone under 16, and we don't knowingly collect data from children.

Changes to this policy

When we change this policy, we update the date at the top. If a change matters, we'll email painters before it takes effect.

Contact

Questions or requests: support@bidcoat.app.