Privacy Policy

Your work email address; the company profile you enter; the solicitation documents you upload; anonymous funnel analytics (a random session identifier, page path, referrer, device class, coarse user agent); and payment records from Stripe. We never receive or store your card number.

Uploaded files go to private storage that is not publicly readable and has no anonymous access. Files are retrieved only by our fulfillment pipeline and by the two authorized BID MACHINE administrators. Access to your own files is through short-lived signed links issued after we confirm you own the order.

Text extracted from your documents, together with your company profile, is sent to a large-language-model provider through the Lovable AI Gateway to extract requirements and produce drafts. Document text is passed as data, delimited so that instructions embedded in a document cannot direct the model. We do not use your documents to train models.

Supabase (database, authentication, private file storage), Lovable (application hosting and the AI gateway) and the model provider behind it, Stripe (payments), and our transactional email provider. Each processes only what is needed for its function.

During the controlled beta we retain uploaded documents and generated packages for as long as your order exists, so that you can re-download them and so we can support you. Email chris@wlp-tv.com to have an order's documents and generated artifacts deleted; we will action deletion within 30 days. Payment and accounting records are retained as required by law.

We treat your documents as confidential and access them only to deliver and support the service. We cannot, however, guarantee confidentiality against lawful legal process, and we are not a party to any non-disclosure agreement between you and an issuing agency unless we have signed one. If a solicitation carries confidentiality restrictions that prohibit third-party processing, do not upload it.

Private buckets with no public access; row-level database rules that scope every record to its owning customer; admin access restricted to an explicit allowlist; signed download links that expire in minutes; server-side validation of file type, file count, and total upload size; archive expansion protected against path traversal, nested archives, and excessive uncompressed size.

You can request a copy of your data, correct your company profile, or ask for deletion at chris@wlp-tv.com. Analytics are anonymous and are not tied to your identity.