Privacy

Who we are

The service is SmartBidCheck at smartbidcheck.com. Privacy contact: privacy@smartbidcheck.com. Built by a Utah remodeler. The comparison rules are the same for every contractor.

Mailing address: 881 W State St Ste 140-526, Pleasant Grove, UT 84062. This is a mailing address only. SmartBidCheck does not have a storefront or a shop at this address.

Notice at collection

We collect the following categories when you use the site. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

• Identifiers. Your email address, which you type in. We use it to send a sign-in code or link, to allow one free report, and to email a PDF when you ask. We do not keep the address in our database; we keep a salted pseudonymous HMAC of a canonical form of it (plus-tags are removed for every domain, and Gmail dots are ignored), so we can recognize the address but not read it back. Resend, Stripe, and our hosting provider may keep the address in delivery logs or receipts under their own policies. The account record is kept until 400 days after your last activity on the account, or until you delete it, except the free-report marker and session-epoch counter described below.
• Commercial information. Whether you opted in to product updates, whether a report is paid, and a count of unused report credits. You provide the marketing choice. Stripe tells us that a checkout completed. Kept until 400 days after your last activity on the account, or until you delete it. Stripe keeps its own payment record.
• Customer content. Bid files and the extracted report (contractor names, prices, scope, and related fields). You upload the files. Source uploads are not saved by SmartBidCheck. They are held in memory while a request runs and sent to Anthropic for reading. The extracted report is stored so you can open it and, if you pay, unlock it. In-progress pieces of a reading last up to 2 hours. A finished report and its share link are kept for 30 days from the last time you save, share, edit, or pay for it, unless you delete it sooner. Opening a report does not extend that time.
• Internet activity. A salted hash of your IP address for rate limits, from the hosting network. Kept about an hour. Product events (free report started, free report completed, checkout started, checkout paid) are counts from our server, with no bid text and no email. Those counts, and Vercel Web Analytics page views, are skipped when your browser sends Global Privacy Control.
• Bot-check data. If Cloudflare Turnstile is on, Cloudflare processes the check, which can include an IP address, when you request a code or start a comparison.

Processors

These companies process personal information for us as service providers. Their own retention rules apply. This page does not promise that a processor keeps nothing.

• Anthropic reads the uploaded pages to extract bid facts. We do not use your bids to train any AI model. We send them to Anthropic only to read them. Anthropic’s handling is governed by its commercial terms and retention policy, summarized on the methodology page.
• Stripe takes the card payment on Stripe Checkout, on Stripe’s own page, and can email a receipt. Stripe receives the verified email when it matches checkout and may collect billing details and an IP address under its own privacy policy. SmartBidCheck does not receive or store the card number.
• Vercel hosts the app and provides Web Analytics.
• Upstash stores Redis records: reports, share links, verification challenges, rate limits, and the daily reading-budget counter.
• Resend sends the sign-in code, a report you request, and an operator alert if the daily reading budget is reached.
• Cloudflare provides Turnstile when that check is turned on.

Retention

• Source uploads are not saved by SmartBidCheck. They are held in memory while a request runs and sent to Anthropic for reading.
• Verification codes and links: 15 minutes. Failed sign-in attempts for an address: about 1 hour.
• In-progress readings: up to 2 hours, then deleted when the report is saved or the time runs out. Upload grants last 30 minutes. An account lock lasts about 90 seconds.
• A finished report and its share link are kept for 30 days from the last time you save, share, edit, or pay for it, unless you delete it sooner. Opening a report does not extend that time.
• Account record (email HMAC, credit count, marketing choice, and the most recent 50 applied Stripe session ids): kept until 400 days after your last activity on the account, or until you delete it. Saving the account refreshes this period.
• Rate-limit counters: a hash of the IP address, about 1 hour. Daily reading-budget counter and the daily count of verification emails: about 48 hours. Those daily counters do not store an email address.
• Stripe checkout-session ids and payment-intent maps used to avoid applying one payment twice: about 90 days. The account’s list of the most recent 50 applied session ids is removed when the account is deleted.
• Free-report marker: a pseudonymous HMAC of the canonical email, kept for up to 400 days after the free report is created, even after you delete the account, so the free allowance is not reset. Later account activity does not refresh that timer. It is not a copy of the email address. Plus-tags are removed for every domain, and Gmail addresses that differ only by dots use the same marker.
• Session-epoch counter: a number tied to the email HMAC, with no address, kept for up to 400 days from the first time it is set, so a signed-out session stays invalid. Deleting the account does not remove it and does not refresh that timer.
• Unsubscribe link: an unguessable token, stored as an HMAC, for 90 days or until you turn product updates off or delete the account. A new opt-in replaces it. It is not derived from the email address.

Cookies, analytics, and Global Privacy Control

A necessary cookie named sbc_session remembers that this browser verified an email. It is HttpOnly, SameSite=Lax, and lasts 30 days. A second necessary cookie, sbc_grant, lasts 30 minutes and ties an upload to that verification. These are not advertising cookies. Deleting your account signs this browser out and invalidates that session cookie.

When the bot check is on, Cloudflare Turnstile may set or read its own cookies or browser storage to detect abuse. We use it for security only.

Vercel Web Analytics records page views. Paths that contain a report id or a share link are rewritten before they are sent, and query strings are removed. The four product events are separate server counts. Analytics does not receive bid contents or email addresses.

If your browser sends Global Privacy Control (Sec-GPC: 1), we do not load page-view analytics on that visit and we do not record product events for it. We do not sell or share personal information, so there is no separate sale to turn off.

Email

Sign-in codes, report delivery you request, Stripe receipts, and the operator budget alert are transactional. They are not a mailing list. Asking for a report is not consent to marketing email.

Marketing email is off unless you check the optional box. That box is separate from the sign-in code and from sending a report, and it is off by default. After you verify your email, you can turn product updates on or off on the home page. This version does not send marketing messages. If marketing email is sent later, it will include this mailing address, marked as a mailing address only, and a working unsubscribe link. Each opt-in creates a new link and retires the previous one. A link expires after 90 days. You can unsubscribe at /unsubscribe. An opt-out applies immediately, before any later marketing message.

Your choices

You can ask to access, delete, or correct personal information, and you can opt out of sale or targeted advertising. We do not sell or share personal information for cross-context advertising. We will not charge a different price because you used a privacy right.

We offer these rights to all users regardless of state. Categories of personal information above are collected directly from you (and, for payment status, from Stripe). We disclose them for business purposes only to the processors listed on this page. We do not sell or share personal information. Uploads are sent to Anthropic, our processor, only to read them. If a document contains sensitive information (such as a government ID or account number), remove it first. Last updated: October 20, 2026.

You can make a request in either of these ways: email privacy@smartbidcheck.com, or use the delete form below after you verify the same email. We will respond within 45 days. If we need more time, we may take one additional 45 days and will tell you. If we decline a request, you may appeal by replying to our response or emailing privacy@smartbidcheck.com with “Appeal” in the subject. We will respond to the appeal in writing within 45 days (60 days where Utah law allows), and, if we deny it, explain how to contact your state attorney general.

An authorized agent may email privacy@smartbidcheck.com with your written permission to act for you. We may ask the agent for that permission and ask you to confirm the request.

• Access. Email privacy@smartbidcheck.com from the address you verified. We can say whether that address has an account and whether a free report was used. We do not keep a plaintext copy of the address on our server.
• Delete. Use the form below after verifying the same email, or email privacy@smartbidcheck.com. Deletion removes reports, share links, the marketing preference, the unsubscribe record when one exists, the verification record, and the account, and signs out that browser. A pseudonymous HMAC marker that the free report was used is kept for up to 400 days after that free report was created, so the free allowance is not reset. We also keep a session-epoch counter (a number tied to the email HMAC, no address) for up to 400 days from the first time it is set, so signed-out sessions stay invalid. Stripe’s payment record stays with Stripe. Checkout-session and payment-intent markers used to prevent a double credit expire after about 90 days.
• Correct. Email privacy@smartbidcheck.com. Project notes on a paid report can also be edited in the report.
• Opt out of sale or share. We do not sell or share personal information for cross-context advertising. Global Privacy Control turns off page-view analytics and product events for that visit.

Verify your email on the home page first, then return here. We store a hash of the address, not a list we can search by name.

Children

SmartBidCheck is intended for adults (18+) and is not directed to children. We do not knowingly collect personal information from anyone under 18, and we do not knowingly sell or share the personal information of anyone under 16. If you believe a child has given us information, email privacy@smartbidcheck.com and we will delete it.

Security

Reports are stored under unguessable ids, shared only with a separate unguessable link, and set to expire. You can turn off a share link from the paid report. Payments are handled entirely by Stripe Checkout on Stripe’s own page; we are not able to see or store your card number.