Privacy Policy

1. Who operates BidFern

BidFern is a service operated by Yaroslav Solkh, an individual sole proprietor based in Sainte-Julienne, Quebec, Canada. BidFern is not a company, corporation or incorporated entity. Where this policy says "we", it refers to that sole proprietor.

Yaroslav Solkh is also the person in charge of the protection of personal information for BidFern, as required by Quebec's Law 25 (Act respecting the protection of personal information in the private sector). Any question, request or complaint about personal information can be sent to contact@bidfern.com, or to the postal address in section 16.

2. Scope of this policy

This policy applies to bidfern.com and to the BidFern application, including account creation, quote generation, quote delivery and online approval. It applies to information about account holders and about people whose details are entered into a quote.

Quotes you send may link to pages hosted by us for your own clients. Those pages are covered by this policy as far as our own handling of the data goes. Your relationship with your client, and what you tell your client about their data, remains yours.

3. Personal information collected

We collect only what the service needs to work and to be billed correctly.

Account information

• Full name and business name
• Email address
• A password hash — the password itself is never stored or readable by us
• Trade and crew size, given at sign-up
• Chosen plan and subscription status

Content you create

• Job descriptions, dictated or typed notes, and scope details
• Site photos and room or area measurements you upload
• Your price book: labor rates, crew costs, material costs, markup rules
• Client names, addresses, email addresses and phone numbers you enter into a quote
• Generated quotes, revisions, approval events and e-signature records

Billing information

• Subscription plan, billing dates, charge amounts and payment status
• Card details are entered directly with our payment processor. We never receive or store full card numbers.

Technical information

• IP address
• Device type, operating system and browser
• Usage logs: pages opened, quotes generated, features used, timestamps, error reports
• Cookies and similar technologies, as described in the Cookie Policy

4. Information about your clients

For that information, you act as the person who decides why it is collected; we hold and process it on your behalf so the quote can be produced, delivered and signed. We do not use your clients' information for our own purposes, do not market to your clients, and do not share it with anyone except the service providers listed in section 8.

If one of your clients contacts us directly about their information, we will normally refer them to you and let you know, unless the law requires otherwise.

5. Why the information is collected and consent

Under Quebec's Law 25 and Canada's federal Personal Information Protection and Electronic Documents Act (PIPEDA), personal information may only be collected for stated, necessary purposes, and generally with the consent of the person concerned. The purposes are:

• To create and secure your account — name, business name, email, password hash.
• To produce your quotes — job notes, photos, measurements, price book and client details.
• To deliver quotes and record approvals — client email address, approval and signature events.
• To bill you and prevent payment fraud — plan, billing dates, payment status.
• To keep the service running and safe — IP address, device data, usage and error logs.
• To answer your emails — whatever you include in your message.
• To send service messages — receipts, renewal notices, security notices and important changes. These are needed to run your subscription and are not marketing.

You give consent by creating an account and by using the service after being shown this policy. Optional cookies are only set after you accept them in the cookie banner. Any commercial email we send follows Canada's Anti-Spam Legislation (CASL) and always includes a one-click unsubscribe; unsubscribing from marketing does not stop transactional messages about your own subscription.

You may withdraw consent at any time (section 10). Withdrawing consent to the processing that is necessary to run the service means the account can no longer be provided, and it will be closed.

6. How your content is used

• Your job notes, photos, price book, quotes and client details are not sold, rented or traded. Ever, to anyone.
• Your content is not used to train third-party artificial intelligence models. Where an AI provider is used to generate a quote, it is used under terms that prohibit training on the content submitted.
• We do not read your quotes except where you ask for support, where it is needed to fix a technical failure, or where the law requires it.
• Aggregated statistics that cannot identify you or your clients — for example, the total number of quotes generated in a month — may be used to improve and describe the service.

7. How long information is kept

• Account data is kept while the account is active, and is deleted within 90 days of the account being closed.
• Quotes and price book data stay available for export for 30 days after cancellation, and are deleted after that, as set out in the Refund & Cancellation Policy.
• Uploaded photos are deleted on request at any time, and otherwise follow the retention of the quote they belong to.
• Billing records are kept for the period Canadian tax and accounting rules require, currently six years, then deleted.
• Signed approval records are kept for six years so a signature can be evidenced if it is disputed, unless you ask for earlier deletion and no dispute is open.
• Server and security logs are kept for up to 12 months.

8. Service providers and transfers outside Quebec

Running BidFern requires a small number of specialist providers. Each receives only what it needs:

• Payment processor — takes card details, charges your subscription and issues refunds.
• Hosting and storage provider — runs the application and stores your account data, photos and quotes.
• Transactional email provider — sends quote links, follow-ups, receipts and password resets.
• AI model provider — turns the job description and measurements you submit into draft line items.
• E-signature delivery provider — presents the quote for approval and records the signature event.
• Analytics provider — measures site and app usage, only where you have accepted analytics cookies.

Some of these providers store or process information outside Quebec, including in the United States and in the European Union. Information held in another country can be subject to that country's laws, including lawful access by its authorities, and the protections there may differ from those in Quebec.

Before entrusting personal information to a provider outside Quebec, we assess whether the information would receive adequate protection, taking into account the sensitivity of the information, the purpose of the transfer, the protections in place — including contractual terms — and the legal framework of the destination country. Providers are chosen only where that assessment is satisfactory, and each is bound by a written agreement that limits use of the information to the service being provided, requires confidentiality and appropriate security, and requires notification of any confidentiality incident.

9. Security

• All traffic between your device and BidFern is encrypted in transit using TLS.
• Stored data, including uploaded photos, is encrypted at rest.
• Passwords are stored only as salted hashes and cannot be read by us or recovered — they can only be reset.
• Access to production systems is limited to the operator, protected by multi-factor authentication, and logged.
• Backups are encrypted and access to them is restricted in the same way.

No system is perfectly secure. Please use a strong, unique password, keep it private, and tell us at once if you believe your account has been accessed by someone else.

10. Your rights

Under Quebec's Law 25 and PIPEDA you have the right to:

• Access the personal information held about you and be told how it is used and who it has been shared with.
• Correct information that is inaccurate, incomplete or out of date.
• Delete your information where it is no longer needed for the purpose it was collected for, and to close your account.
• Withdraw consent to a given use, understanding that some uses are needed for the service to exist.
• Portability — receive the computerised personal information you supplied in a structured, commonly used technical format. Your quotes and price book can be exported from the dashboard at any time.
• Complain to a regulator. In Quebec that is the Commission d'accès à l'information du Québec; federally it is the Office of the Privacy Commissioner of Canada.

We would rather hear from you first, and will try to settle any complaint directly.

11. How to exercise your rights

Write to contact@bidfern.com from the email address on the account, state what you are asking for, and give enough detail to find the right records. We may ask for reasonable proof of identity so information is not disclosed to the wrong person.

We answer within 30 days of receiving the request. If a request is refused, we will say why, cite the provision relied on, and explain how to seek a review.

12. Cookies

Cookies and similar technologies are described in full in the Cookie Policy, including the categories used, how long each lasts and how to block them. Non-essential cookies stay off until you accept them, and you can change your choice at any time from the cookie settings link in the footer.

13. Age requirement

BidFern is a business tool for people who quote paid work. It is not directed at anyone under 18, and accounts may only be created by people aged 18 or over. If we learn that an account belongs to a minor, it will be closed and the associated personal information deleted.

14. Confidentiality incidents

If a confidentiality incident occurs — unauthorised access to, use of, disclosure of, or loss of personal information — it is recorded in a register, assessed at once, and contained as quickly as possible. Where the incident presents a risk of serious injury, the Commission d'accès à l'information du Québec and every affected person will be notified promptly, together with what happened, what information was involved and what to do about it. Where you are the one who entered your client's information, you will be told so you can inform your client.

15. Changes to this policy

This policy may be updated as the service changes or as the law changes. The "Last updated" date at the top always shows the current version. For any change that materially affects how personal information is handled, account holders are notified by email at least 30 days before it takes effect. Continuing to use BidFern after that date means the updated policy applies.

16. Contact

Questions about this policy, requests to exercise your rights, and privacy complaints all go to the same place: