Privacy policy

This policy explains what Bidfence collects, why, who helps us process it, and how to have it changed or deleted. Bidfence is operated from New York, NY. Questions go to hello@bidfence.io.

What we collect

• When you request a scan: your website, brand name, the search terms you want watched, your affiliate platform, your work email and any note you add.
• When you reserve or buy a plan: your name, email and billing details are collected by Stripe, our payment processor. We never see or store your full card number.
• When you use the site: which pages you view and which buttons and form steps you use; the campaign details in the link you arrived from (utm values and Google's ad click ID) and the referring page; your browser's user agent; and a one-way, salted hash of your IP address. We don't store your IP address itself.
• If you upload a partner list: each partner's name, website, partner ID and coupon code. Other columns in your file aren't sent to us. We use the list only to match ads in your reports.

Information about advertisers

To build reports, we record ads that appear publicly in search results for the terms a brand asks us to check: the ad text, the advertiser's website and landing page, affiliate IDs visible in the ad's link, and when and where the ad appeared. Some advertisers are individuals. We use this only to show the brand what appeared on searches for its own terms, and we keep it for the periods below. If you're an advertiser and think a finding about your ads is wrong, write to hello@bidfence.io and we'll review it.

Why we use it

• To run the scan you asked for and send your report.
• To provide the monitoring you pay for, including alerts and weekly reports.
• To send your report and a few follow-up messages about it. Every email has a way to opt out.
• To measure our site and advertising, and to prevent abuse and automated requests.

We don't sell personal information, and we don't use it for advertising that follows you to other sites.

Who helps us process it

• Vercel: hosting
• Supabase: database and file storage
• Resend: email delivery
• Stripe: payments
• PostHog: product analytics
• Cloudflare: bot protection and email routing
• Google: advertising measurement (Google Ads)
• SerpApi and DataForSEO: search results and keyword data. They receive the search terms we check, not your contact details.

Each processes data only to provide its service to us.

Cookies and similar technologies

We use a small number of cookies and browser storage: PostHog's analytics cookies to count visits and see how the site is used; Google's advertising cookies to measure whether our ads lead to scan requests; and your browser's session storage to keep what you typed in the form and the link you arrived from until you finish. You can block or delete cookies in your browser settings; the site works without them.

Your browser may send a "Do Not Track" signal. Our site doesn't change its behavior in response to it, because there's no common standard for honoring it.

Reports are shared by link

Each report has a long, unguessable link. Anyone you give that link to can open the report, so share it only with people you trust. Free-scan reports expire 90 days after we send them.

Businesses we contact

We sometimes email businesses that haven't contacted us, using business contact details from public sources and business data providers, to offer a free scan. We use those details only for that purpose. Reply "no thanks" to any such email, or write to hello@bidfence.io, and we'll stop and record your preference.

How long we keep it

• Free-scan reports, search results and evidence: deleted 90 days after the report is sent, unless you become a customer.
• Your scan request details (contact and form): 24 months, or sooner if you ask.
• Customer data: while your plan is active, and 90 days after it ends. Evidence: up to 13 months.
• Payment records: as long as tax and accounting law requires.
• Partner lists: deleted with the report they belong to, or when you delete or replace them. For customers, kept while the plan is active and 90 days after.

Security

We use access controls, encryption in transit and limited access to production data. No system is perfectly secure; if a breach affects your data, we'll tell you as the law requires.

Your choices

Write to hello@bidfence.io to see, correct or delete your data, or to stop emails. We'll respond within 30 days.

Children

Bidfence is a service for businesses and isn't meant for anyone under 18. We don't knowingly collect data about children.

Changes to this policy

When we change this policy, we'll update the date at the top of this page. If a change is significant, we'll also tell customers by email before it takes effect.