What we hold, and why.

LAST UPDATED SEPTEMBER 21, 2026

Bidovi is a quote-building service for businesses, operated by Ainsworth Facility Solutions Incorporated, a company incorporated in Ontario, Canada. This policy explains what personal information we collect, what we do with it, where in the world it is held, and the control you have over it. We follow the Personal Information Protection and Electronic Documents Act, which Canadians call PIPEDA.

Bidovi is sold to businesses in Canada, outside Quebec. We do not offer the service to consumers, and we do not currently accept businesses located in Quebec.

Two kinds of information

It helps to separate them, because our responsibilities differ.

Your account information is what we hold about you and the people in your business: names, business email addresses, phone numbers, your business and billing address, and sign-in records. We are the organization responsible for that information, and this policy governs it.

Your client data is everything you put into the product: your clients, their sites and contacts, your walkthrough notes, your pricing and your quotes. That belongs to you. You are the organization accountable for it under PIPEDA, and we handle it only as your service provider, on your instructions. If one of your clients asks us for their information, we will refer them to you and help you answer.

What we collect

• Account information. Business name, business and billing address, owner name, email and phone, and the same details for anyone you add to your account.
• What you put in a quote. Your client names, site addresses, contacts, walkthrough details and your pricing. This is your data and we treat it as confidential.
• Quote requests sent to us. If you use the email intake, the messages sent to our intake mailbox and everything in them, so the product can read the request and draft a quote.
• Payment information. Handled by Stripe. We receive a record that a payment succeeded, the plan, and the last four digits of the card. We never see or store the full card number.
• Service records. Sign-in times, IP address and basic technical logs, kept to operate the service and keep it secure.

Why we use it

To create and run your account, build and send your quotes, provide support, take payment, and keep the service secure and available. We also use technical and usage records to find faults and improve the product.

We do not sell personal information. We do not use your client lists or your pricing for any purpose other than running Bidovi for you, and we do not use your data to train machine-learning models.

Where it lives

Your data is stored and backed up outside Canada. Our servers are currently in the European Union, in Finland, run by Hetzner Online GmbH. Our other providers also process it outside Canada. None of the providers listed below is located in Canada.

You should know what that means. Information held in another country can be reached by the courts, law enforcement and national security authorities of that country under their own lawful process. By using Bidovi you accept this, and where your own privacy obligations or policies require it, it is your responsibility to tell your own clients and staff.

Who else touches it

We use a small number of providers. Each one is bound to protect what it handles, and we remain responsible to you for how they handle it.

Connected mailboxes (Google and Microsoft)

You can connect your own mailbox so quotes go out from your address. Here is exactly what that allows.

What we do. We send the quotation email you approve, and any follow-up you scheduled, from your mailbox. To stop a follow-up once your client has replied, we check the messages in that quotation’s own email conversation.

What we read from Google. Header lines only, never the body or attachments, which our permission does not allow us to see at all. For the conversation of a quotation we sent: sender, subject, message identifiers, reply references and automatic-reply markers. For other new mail arriving in your inbox while a follow-up is pending: the sender’s address and automatic-reply markers, only to check whether it came from that client or their company. We never search your mailbox.

What we keep. The identifiers of the quotation email we sent, its conversation, and the date your client replied or wrote to you. Senders of other mail are checked and discarded; we do not keep copies of your emails, their headers, or a list of who writes to you. Your connection keys are stored encrypted (AES-256-GCM), unlike the rest of your data (see Security).

What we never do. We do not sell Google user data, use it for advertising, give it to our AI provider, or use it to train any AI model. People at Bidovi do not read it unless you ask us to for support, the law requires it, or it is needed for security.

Disconnecting. Settings → Email → Disconnect deletes your connection keys from Bidovi straight away (encrypted copies in our routine backups roll off within about 14 days). You can also remove Bidovi’s access at any time from your Google Account (myaccount.google.com/permissions).

Google API Services User Data Policy. Bidovi’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

If you ask us to connect an optional integration, such as sending your quotes or leads into your own CRM, we will tell you which provider receives the data before we switch it on. If we add or replace a provider, we will email the account owner at least 30 days before it starts handling personal information, and update this page, so that you have time to object.

We will disclose information if a court order or other legally binding demand requires it. Where the law allows, we will tell you before we respond, and we will disclose only what we are required to disclose.

Artificial intelligence

Parts of Bidovi use AI models to read quote requests, pull out the details and draft quotes. When you use those features, the content involved is sent to our AI provider, currently Anthropic, and processed under the terms of the service we use at the time. Where those terms allow it, we opt out of the provider using your content to train its models.

AI output is a draft for you to check, never a decision made by us, and no AI-drafted quote reaches one of your clients unless a person on your side sends it. Do not put information into the AI features that you are not permitted to share with us and the providers above.

How long we keep it

While your subscription is active, we keep your data so you can use it. Ending a subscription does not delete anything.

After it ends, we keep your data until you ask us to delete it, because you may want to export it or come back. At least once a year we will email the account owner to remind you that we still hold it and how to ask for an export or a deletion.

There are limited cases where we may delete data you have not asked us to delete: if we discontinue the service, if we can no longer reach you at the owner's email address after reasonable attempts, if the law requires it, or if it is clear you no longer need it kept. In each of those cases we will give you at least 90 days' notice by email first, so you can ask for an export, unless the law prevents us from giving notice.

When data is deleted, copies can persist briefly in our routine backups, currently about 14 days. We keep billing, tax and accounting records, and records needed to defend a legal claim, for as long as the law requires.

Your choices

• Ask what we hold. You can ask what personal information we hold about you and why. We will answer within 30 days.
• Get an export. Ask us any time and we will send a compressed archive of your account — settings, pricing, your client and quote database, and your quote PDFs — within 10 business days. Self-serve export is not available yet; we prepare exports by hand on request.
• Correct it. Tell us about anything inaccurate and we will fix it.
• Delete it. A deletion request has to come from the account owner's email address, or from someone we have verified is authorized to act for your business. We will confirm by email to the owner before we act on it.
• Email preferences. You can unsubscribe from our marketing email at any time. We will still send messages you need to run the account, such as invoices, renewal reminders, failed-payment notices and security alerts.

Security

We take reasonable steps to protect your data, appropriate to how sensitive it is. In practice that means traffic is encrypted in transit over HTTPS, each business has its own isolated database, sign-in uses session tokens, requests are rate limited, backups run nightly, and staff access is limited to the people who need it to support you.

Two honest limits. Your data is not encrypted at rest, with one exception: the keys that connect your mailbox are stored encrypted. And we do not offer a service level agreement unless we have signed one with you. The service currently runs on a single hosted server. We would rather state these plainly than let you assume otherwise.

No system is perfect. If we confirm a breach of our safeguards that affects your data, we will email the account owner without undue delay and in any event within 72 hours of confirming it, and tell you what happened, what was involved and what we are doing about it. Because you are accountable for your clients' information, you decide whether to notify the Privacy Commissioner of Canada or the people affected, and we will help.

Cookies and tracking

This website sets no cookies. There is no analytics, no advertising tracker and no third-party tag on these pages.

When you sign in to the application at app.bidovi.com, your browser stores a session token so that you stay signed in. That is strictly necessary to use the product, and it is not used to profile you or follow you anywhere else.

Features described on this website that are still in development — engagement tracking on sent quotes among them — are not running today. If we turn one on, we will update this page before it starts collecting anything.

Changes to this policy

If we change this policy we will update the date at the top. When a change is significant, or when we add a provider that will handle personal information, we will email the account owner beforehand, with at least 30 days' notice in the case of a new provider.

Contact

Questions about this policy, a request about your information, or a privacy complaint all go through the contact page. It reaches the person accountable for privacy at Bidovi. A person answers, and we will reply within 30 days.

Bidovi is operated by Ainsworth Facility Solutions Incorporated, a corporation registered in Ontario, Canada. If you are a customer, the email address for formal notices is set out in your agreement with us. If you need our registered office address in order to serve a legal notice, ask through the contact page and we will give it to you.

This policy forms part of our Terms of Service.