Privacy Policy

This Privacy Policy describes how TowerBid (“TowerBid,” “we,” “us”) handles information when you use the marketplace at tower-bid.com. We are a Florida-based sealed-bid marketplace for building services. Buyers — building owners, property managers, condo and HOA boards, and developers — post work. Vendors — service contractors — bid when they are invited. Buyers use the product without a subscription fee. Vendors pay a subscription.

The product does not publish a street address or a company registration number. Privacy questions go to invites@tower-bid.com. The Terms of Service are governed by Florida law. This policy does not choose a different venue.

Account. Everyone who signs up provides an email address and a password. Sign-in is handled by Supabase Auth. TowerBid stores the email, the name you enter, your organization name, whether the organization is a buyer or a vendor, and your role on that organization. The person who finishes setup is the owner. TowerBid records which version of the Terms of Service you accepted, when, and whether that acceptance was at setup or when you submitted a bid.

Buyers. Buyers can add buildings: name, address, city, unit count, notes, and a photo. Requests include a title, category, scope, requirements, a budget range, whether that budget is visible to vendors, a deadline, and status. TowerBid also stores invitations, questions you receive, answers you publish, the award, a contract start date if you confirm one, and an audit log of actions on the request. You can download an audit record of your own request.

Vendors. Vendors can add trades, markets, a short company description, a website, a contact email, a meeting link, and a company photo. The profile can show a founding-vendor flag and a count of awards. Bids include the amount, the pricing unit, schedule, validity period, notes, attachments, and status. The compliance vault stores certificates of insurance, licenses, W-9s, and bond letters, including the file and the issuer, number, and expiration date entered with it, plus whether an administrator marked the document verified.

Billing. Vendors who subscribe are billed by Stripe. Checkout collects a billing address and, if sales-tax collection is turned on, Stripe uses it to calculate tax. Card numbers are entered on Stripe’s pages. TowerBid stores the Stripe customer id and the subscription’s plan, billing interval, status, current period end, and the time a failed payment started the grace period. TowerBid does not store card numbers.

Messages and records of use. The product stores in-app notifications, support tickets and replies, and an audit log of actions such as publishing a request, inviting a vendor, opening a bid, awarding, verifying a document, and accepting the terms. A new organization can trigger an email to TowerBid’s operator with the organization name, organization type, the person’s name, and the person’s email. Password reset and email confirmation are sent through the sign-in service.

Scope writer. If a buyer uses the scope writer, the building name, city, size, and the description they type are sent to Anthropic to draft request text. The draft comes back to the buyer, who can edit it before publishing.

Photos. Building photos and company photos are stored so they can be shown in the product. They are served from storage addresses that are readable by anyone who has the address.

TowerBid uses this information to run accounts, post and invite, collect and unseal bids, compare and award, share the winning vendor’s compliance file with the buyer, show the vendor directory to verified buyers, send operational email and in-app notices, bill vendor subscriptions, review buyer organizations and vendor documents, answer support tickets, keep an audit trail, and protect the service.

Operational email includes invitations, award and loss notices, deadline reminders, compliance-document expiry reminders, question notices, support messages, and signup notices to the operator. Those messages are sent with Resend from invites@tower-bid.com. Stripe may also send billing receipts and invoices.

TowerBid does not use your information to train its own models. The scope-writer text is sent to Anthropic to produce the draft you asked for. Anthropic’s handling of API inputs is governed by Anthropic’s terms. TowerBid does not sell personal information for money and does not share it for cross-context behavioral advertising. The product does not run ads.

Until the buyer’s deadline, bid amounts, pricing units, schedules, validity periods, notes, and bid attachments are sealed from the buyer. After the deadline, the request unseals, and the buyer can open each bid. Until a bid is opened, its price and notes stay hidden from the buyer. A vendor can read its own bid. A vendor cannot read another vendor’s bid. These limits are applied in the application and in database access rules.

The buyer can see which vendor asked a question. Published answers are shown to invited vendors without the asking vendor’s name. Unpublished questions stay between the asking vendor and the buyer.

Verified buyers can see a vendor’s directory profile, including contact email, meeting link, and photo, while bids are still sealed. That profile is how a buyer reaches a vendor. It does not reveal the bid.

Before an award, buyers do not receive compliance-vault files. When a buyer awards a bid, that winning vendor’s vault documents, including the files, issuer, number, expiration, and verification flag, become available to that buyer. Other bidders’ files are not shared on the strength of the award.

People with a TowerBid platform admin account can access records, including bid rows and vault files, to operate the service, review verification, answer support, and protect security. Buyers still cannot read sealed bid contents, and vendors still cannot read a competitor’s bid.

Information is shared with other users in the ways the product is built to work: invited vendors see the request they were invited to; the buyer sees bids after the request unseals and the bid is opened; verified buyers see the vendor directory; published questions and answers go to invited vendors as the sealed-bid section describes; the awarding buyer receives the winner’s vault documents; award, loss, and invitation email goes to the people involved.

TowerBid shares information with the service providers in the next section, with administrators operating the product, and with authorities when the law requires it or when disclosure is needed to protect users, the public, or TowerBid’s rights. If the business is sold or reorganized, information can transfer with the business, and this policy would still describe it until a new one is posted.

TowerBid does not share a vendor’s sealed bid with the buyer early, and does not share one vendor’s bid with another vendor, in order to market the product.

These are the services the application calls. Hosting and the daily scheduled job run on Vercel. Sign-in, the database, and file storage for compliance documents and photos run on Supabase. Vendor subscription checkout, the billing portal, and invoices run on Stripe. Transactional email is sent with Resend. The scope writer sends the buyer’s description to Anthropic.

Each of those companies processes information to provide its service and may use its own subprocessors under its own terms. TowerBid does not publish a longer subprocessor list than the providers named here. Their terms and privacy notices govern their handling of the information they receive.

TowerBid uses a session cookie, set by Supabase Auth, to keep you signed in and to refresh that session as you move through the product. The cookie is required for the account to work.

The application does not add a separate analytics cookie, advertising cookie, or third-party tracking pixel. Browser storage may remember a one-time on-screen animation so it does not repeat during the visit. That flag stays in the browser for the session and is not used to identify you for advertising.

TowerBid keeps account, procurement, bid, audit, message, and billing records while the account is in use and afterward for as long as those records are needed to operate the marketplace, preserve the award history, resolve disputes, and meet tax, accounting, and other legal duties. The product does not publish a fixed deletion timetable. Sealed-bid history and the audit log are part of the procurement record a buyer may need to show its board.

You can ask TowerBid to delete personal information. TowerBid will delete or de-identify what it can remove without breaking the records described above, such as an award a buyer must be able to document or a billing record that has to be retained. Support conversations are kept for the life of the ticket and for a period afterward so the thread can be understood.

TowerBid limits access with sign-in, organization rules, and database policies that decide who can read each kind of record. Card numbers are collected by Stripe, not stored in TowerBid’s database. Connections to the service use the transport security provided by the host.

These measures reduce risk. They are not a certification, and no method of storage or transmission is perfectly secure. TowerBid does not claim SOC 2 or an equivalent audit in this policy.

You can correct organization, building, and vendor profile details in the product, replace vault files you uploaded, and edit or withdraw your own bid before the deadline. A vendor can update payment details or cancel a subscription in the Stripe billing portal. You can stop using optional fields, including the scope writer.

You can email invites@tower-bid.com to request access to, correction of, or deletion of personal information TowerBid holds about you. TowerBid will respond within a reasonable time. Some requests cannot be completed in full where a procurement, security, or legal record has to be kept, and TowerBid will say so.

Residents of U.S. states with consumer privacy statutes may have rights to access, correct, or delete personal information, and to appeal a refusal, where those statutes apply to TowerBid and to the request. TowerBid will honor rights that apply. This policy does not claim that every state statute applies, and it does not claim a compliance certification. To ask, or to appeal a decision on a request, email invites@tower-bid.com with the subject “Privacy request.”

TowerBid is for organizations procuring and performing building services. It is not directed to children under 13, and TowerBid does not knowingly collect personal information from children. If you believe a child provided personal information, email invites@tower-bid.com and TowerBid will delete it.

TowerBid operates from Florida and uses the providers named above. Information is processed in the United States. If you access the service from another country, your information is transferred to and processed in the United States. TowerBid does not claim a particular transfer certification or an adequacy decision in this policy.

TowerBid may update this policy. The new version and the “last updated” date will be posted on this page. Continued use of TowerBid after the update means you have the updated policy. Material changes will show a new date you can see at the top of the page.

Privacy questions and requests: invites@tower-bid.com, addressed to TowerBid. If you are signed in, you can also open a ticket under Help. The commercial rules are in the Terms of Service.