Log inJoin early access
Legal

Privacy

Last updated 8 November 2026

This notice explains what TidyBids, a Nivibox product, stores, who helps us run it, and the choices you have.

What we store

  • Your account: your name, email address and password. Passwords are hashed before they are stored and are never written to logs.
  • Your business profile: the business name, contact details, address, logo link, currency and timezone you enter.
  • Records you create: customers, services, quotes, and the responses your customers submit through a quote link.
  • Inquiries: the details people submit through your public inquiry form. Inquiry records don’t include the sender’s IP address.
  • Plan and usage records: your plan status, usage counts (such as published quotes) and your AI credit history. When a Quote Review succeeds, its result is saved to your account automatically.

Your customers’ information

You decide which customer details to enter. A shared quote link shows the customer’s name, line items, totals, notes, exclusions and terms, but not the customer’s email, phone, address or your private notes. Anyone who has the link can view the quote and respond, so share it only with the intended customer. Until a quote is accepted, you can turn its link off from your dashboard.

Service providers

  • Cloudflare serves this website.
  • DigitalOcean hosts the TidyBids server and database.
  • Twilio SendGrid delivers account emails (see below).
  • OpenAI or DeepSeek receives the quote details you select, only when you run a Quote Review with that provider (see below).
  • Paddle is planned to handle payments when paid plans launch. It isn’t used today, and TidyBids doesn’t collect payment details.

Like most online services, our hosting and network providers process IP addresses and request details (such as browser type and time) in operational logs, used to deliver the service and protect it against abuse.

If you add a logo link to your business profile, the image is loaded from that address whenever a quote or inquiry form is viewed, so the image host may see the viewer’s IP address.

Account emails

We send a small number of transactional emails about your own account: password reset links and email address confirmation links. They’re delivered by Twilio SendGrid, which processes the recipient address and the message content, including the one-time link, in order to deliver the email and keep delivery logs. We don’t use these emails for marketing or advertising, and we don’t add tracking to them.

Reset and confirmation links expire and work once. Keep these emails private. Opening a link does not change your account until you confirm on the website.

Optional Quote Review (AI)

Quote Review sends parts of a quote to an AI provider for suggestions. It only runs when you ask for it, and it works like this:

  • You choose what’s included. Every part starts unticked: services, prices, estimated hours and costs, terms and exclusions, property type and size, and notes. The quote’s customer name, contact and address fields, payment details, your business details and your other records are never included. We don’t send your whole account.
  • You see the exact text first. Before anything is sent, our server prepares the text and shows you exactly what will go to the provider, which provider it is, and the credit cost. Nothing is sent until you confirm.
  • Your own text can still contain private details. Notes, terms and item descriptions are sent as you wrote them. Our server replaces email addresses, phone numbers and access codes it recognises, but this is pattern-based and can miss things. Check the preview for names, addresses or other private details and remove them from the quote before you send.
  • You choose the provider. The review goes only to the provider you pick; we never switch to another one without asking. A provider may be unavailable depending on our configuration.

OpenAI. Under OpenAI’s API terms, data sent through its API isn’t used to train its models by default. OpenAI may keep API content for up to 30 days, for example to detect abuse, and longer where the law requires, so this isn’t zero retention. See OpenAI’s API data controls.

DeepSeek. DeepSeek’s public privacy policy says it doesn’t cover data processed for apps that developers build on its platform, which includes data TidyBids sends. We haven’t agreed separate data terms with DeepSeek, so we can’t promise how it handles this data, including on training or retention. Choose what you send with that in mind.

In your browser

  • Your sign-in token is kept in this tab’s session storage and cleared when the tab closes. Sessions expire after 12 hours.
  • Your light/dark theme choice is saved in local storage. It contains no personal data.
  • We don’t use advertising or analytics trackers.

What we don’t do

  • We don’t sell your data or your customers’ data.
  • We don’t email or text your customers; you send quotes yourself. The only emails we send are the account emails above.
  • We don’t collect payment details or process payments today.

Your choices

You can edit or delete customers and services at any time. To request a copy of your data or deletion of your account, email [email protected]. During early access, these requests are handled manually.

Changes

If this notice changes in a meaningful way, we’ll update this page and the date above.