Privacy policy

Last updated 24 October 2026

Who we are

Bidlark is a trading name of Highfold Group Ltd (company number 17521208, registered in England and Wales). Registered office: Office 21848, 182-184 High Street North, East Ham, London, E6 2JA. The "controller" of the personal data described here ("we", "us") is Highfold Group Ltd. We are registered with the Information Commissioner's Office (ICO) under reference ZC280583.

Questions about your data? Email hello@bidlark.co.uk. We read every message and we'll get back to you as soon as we can.

What we collect

• Details you give us - your name, business name, email address and password (stored only as a secure hash); your firm's profile: fields of work, where you're based and have offices, turnover band, staff numbers, the insurance, certificates and policies you hold, and the past jobs you add; notices you track, your saved answers and the drafts you make; buyer question documents you upload to draft answers; if you ask us to email you when your count picks up, that email address and your search; a one-way code made from your email address, kept to stop a second free trial.
• Payment details - handled entirely by Stripe. We never see or store your full card number.
• Messages - what you send us by email or through our contact forms.
• Basic usage data - we count page views without cookies. To count unique visitors we use a one-way, daily-changing hash of your IP address and browser; we can't use it to identify you and it resets every day. For each visit we keep the pages viewed, the kind of device, the country (worked out from your IP address, which isn't stored) and whether the visit ended in a purchase, chat or message, for 90 days, without cookies. To leave robots out of our counts we also compare a similar one-way daily code of your IP address between our own websites for up to two days, and for nothing else.
• Security logs - like most websites, our web server and mail server keep logs of each request: your IP address, the date and time, the page or service requested and your browser details (and, for emails, the sender and recipient addresses). We use them only to keep our services secure and working.
• Live chat - the messages you type into our chat assistant and any details you choose to send through it (see Live chat below).

Why we use it, and our lawful basis

Who we share it with

We never sell your data. We share it only with the suppliers below, who help us run Bidlark. Suppliers that act for us may use it only on our instructions, under contracts that require them to protect it. Where a supplier also uses data for its own purposes (as the table says), its own privacy policy covers that use.

Some of these suppliers may process data outside the UK (for example in the USA). Where they do, the transfer is protected by UK adequacy regulations (including the UK-US data bridge), or the ICO's International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.

How long we keep it

• Records of your payments and invoices: 6 years (UK tax rules).
• An account that never started a paid plan: deleted with everything in it a year after it was last used. We email 30 days before, and logging in keeps it.
• The one-way code that stops a second free trial: 3 years.
• Answers to Spot my contracts from people without an account: 7 days.
• The record of which notices we sent you or left out: 90 days.
• "Email me if it picks up" requests: deleted after 6 months, or after the one email.
• Your account, profiles, tracked notices, answers library and drafts: while you have an account. When a plan ends nothing is deleted until you delete it. Deleting your account deletes all of it.
• Buyer documents you upload to draft answers: deleted automatically 30 days after upload, or straight away when you delete them. The drafts you make stay until you delete them.
• Enquiries that don't lead anywhere: 2 years.
• Emails to and from our hello@bidlark.co.uk mailbox: deleted from our mail server 2 years after they arrive.
• Our log of the emails we send you (address, subject and whether it was delivered): 1 year.
• Security logs on our servers: 14 days.
• Cookieless page-view and visitor counts: about 13 months (400 days).
• Backups: anything we delete can stay in our backups (nightly copies, plus weekly and monthly encrypted off-site copies) for up to about 3 months, then it's gone.
• Live chat conversations: 180 days after the last message; details you send through the chat, with the recent part of the conversation, are kept like other enquiries.

Live chat

Our website has a chat assistant. It is an automated AI assistant, not a person: it answers questions using Bidlark's own web pages and information we've written for it, and it can make mistakes. If it can't help, it can take your details so we can reply to you by email.

• What we keep - the messages you type, the assistant's replies, the page you started the chat on, when it happened, and a one-way hash of your IP address that changes every day (only to stop one connection using up the assistant - we don't use it to identify you). Please don't type card details or sensitive personal information into the chat; card numbers are removed automatically, from the chat and from details you send.
• AI processing - to write its replies, your messages and the relevant parts of our website are sent to Abacus.AI, Inc. in the United States, which acts as our processor under a contract that requires it to protect your data. The transfer is protected by UK adequacy regulations (including the UK-US data bridge), or the ICO's International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.
• Details you send us - if you choose to leave your details (for example your name, email address and phone number) they reach us in the same way as a message through our contact form, together with the recent part of your conversation so we know what you asked. We reply by email. Nobody joins the chat itself: the assistant stays automated.
• Why (lawful basis) - legitimate interests (answering questions about Bidlark and passing your details to us), and steps you ask us to take before entering into a contract when you ask us to get back to you.
• How long - chat conversations are deleted 180 days after the last message. If you send your details, they and the recent part of the conversation that goes with them are kept like other enquiries (2 years).
• On your device - once you start a chat, your browser keeps the conversation (in local storage, not a cookie) so it stays open as you move between pages. It's cleared the next time you visit after 24 hours without using it, or straight away when you choose "Start a new chat" or clear this site's data. Once you've sent your details, your browser no longer keeps them.

Public contract notices

• Where they come from: Find a Tender, Contracts Finder and Public Contracts Scotland. Notices are public sector information published under the Open Government Licence v3.0.
• What we keep: the buyer organisation only. We never store buyer staff names, email addresses or phone numbers: contact details are removed before a notice is stored, and email addresses and phone numbers are taken out of notice descriptions.
• Award winners: named only when they are organisations. Anyone else shows as "a small supplier", and the name isn't stored.
• How long: notices are deleted 13 months after they close (unless one is on a customer's tracked list or in a draft, as part of that customer's own records), and awards after 4 years.
• Why we may use it: notices are published by public bodies so that suppliers can find them. Where a notice names a person, we rely on our legitimate interest in showing suppliers the official notice; we strip contact details and keep only what the notice needs. The Open Government Licence doesn't cover personal data, so we treat any name in a notice as personal data and hide it when asked.
• Asking us to hide one: if you're named in a notice and would rather not appear on Bidlark, email hello@bidlark.co.uk and we'll hide it from our pages and emails.

The one-way code that stops a second free trial

When a free trial starts we keep a one-way code made from your email address (a keyed hash: it can't be turned back into the address). It lets us offer the trial once per email address, even after an account is deleted. We keep it for 3 years, for our legitimate interest in preventing misuse of the trial.

"Email me if it picks up"

When you ask us to email you if your count picks up, we keep your email address and your search answers, and we rely on your consent (the tick on the form). We re-count on the 1st of each month and send you one email if the count passes our floor; then we delete the request, and after 6 months we delete it anyway. You can withdraw your consent at any time by emailing hello@bidlark.co.uk, and we delete the request straight away.

AI and your profile

Notice readings are made once per notice and shared by everyone; they contain nothing about you. When Bidlark re-ranks your matches, it sends the AI service your fields, what you hold and your size band, never your name, business name or email. When you ask Pro for a draft, it sends the question, the notice, your profile, your past jobs and your best-matching saved answers. Our admin screens never show your drafts or saved answers.

Ask us about your data

If you have an account you can download or delete everything yourself in Settings.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable format. You can withdraw consent at any time. If you have an account you can delete it yourself from your account page. Email hello@bidlark.co.uk for anything else - we'll respond within one month.

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to put things right first.

Changes

If we make important changes we'll update the date above and, where appropriate, tell you by email.