Privacy Policy

1. Who We Are

The data controller responsible for your personal information is:

If you have any questions, concerns, or requests regarding this Policy or how we handle your personal information, please contact us at the address above.

2. Information We Collect

We collect personal information in the following categories:

2.1 Information You Provide Directly

• Account Information: First name, last name, email address, and password (stored as a secure hash — we never store plain-text passwords).
• Profile Information: Profile photo, username, bio, and location (city/province).
• Task & Bid Content: Descriptions, titles, budgets, photos, and other content you post as part of tasks or bids.
• Payment Information: When you add a payment method or connect a Stripe account, payment details are processed and stored by Stripe, Inc. BidGig never directly stores your full credit or debit card numbers. We store only Stripe-assigned customer IDs, payment method tokens, and payout account identifiers.
• Communications: Messages exchanged between users on the Platform, support requests, and feedback submitted to us.
• Identity Verification: Where required, government-issued identification may be collected for fraud prevention or payout verification purposes.

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, search queries, tasks and bids viewed, and timestamps.
• Device & Technical Data: IP address, browser type and version, operating system, device identifiers, and screen resolution.
• Log Data: Server logs, error reports, and performance data.
• Location Data: General location inferred from IP address, or precise location if you grant permission in our mobile application.

2.3 Information from Third Parties

• Google Sign-In: If you sign in using Google, we receive your name, email address, and profile picture from Google as authorized by you.
• Stripe: Transaction status, payment confirmations, and payout account status.

3. How We Use Your Information

We use the information we collect to:

• Provide and operate the Platform: Create and manage your account, display tasks and bids, facilitate messaging, and process transactions.
• Process payments: Hold funds in escrow, release payments upon work approval, and remit payouts to Service Providers.
• Verify identity and prevent fraud: Detect, investigate, and prevent fraudulent transactions, abuse, and violations of our Terms of Service.
• Communicate with you: Send account notifications, transaction confirmations, security alerts, and customer support responses.
• Send marketing communications: With your consent, we may send newsletters and promotional emails. You can opt out at any time.
• Improve the Platform: Analyze usage patterns, conduct research, and develop new features and services.
• Personalize your experience: Show relevant tasks, recommendations, and search results.
• Comply with legal obligations: Respond to lawful requests from public authorities, comply with tax and financial reporting requirements, and enforce our policies.
• Protect safety: Enforce our community standards and protect the rights and safety of users and the public.

4. Legal Basis for Processing

We rely on the following legal bases to process your personal information:

• Contract Performance: Processing necessary to perform our contract with you (providing the Platform, processing payments, maintaining your account).
• Legitimate Interests: Processing for fraud prevention, security, platform analytics, and service improvement, where these interests are not overridden by your rights.
• Consent: For optional communications such as marketing emails. You may withdraw consent at any time by contacting us or using the unsubscribe link in our emails.
• Legal Obligation: Processing required to comply with applicable law (tax reporting, responding to lawful law enforcement requests).

5. How We Share Your Information

We do not sell your personal information. We share your information only in the following limited circumstances:

5.1 With Other Users

To facilitate task and bid matching, we share limited profile information with other users. When you post a task, your display name, general location, and task content are visible to other users. When you submit a bid, your display name, profile photo, and bid details are visible to the Task Poster.

5.2 With Service Providers

We share information with trusted third-party service providers who assist us in operating the Platform, subject to confidentiality obligations:

• Stripe, Inc. (payment processing and escrow — United States)
• Amazon Web Services, Inc. (AWS) (cloud hosting, database, storage, and authentication via Amazon Cognito — United States)
• Google LLC (OAuth sign-in — United States)

5.3 For Legal Reasons

We may disclose your information if required by law, court order, or government authority, or if we believe disclosure is necessary to: (a) comply with a legal obligation; (b) protect the rights, property, or safety of BidGig, our users, or the public; or (c) detect, prevent, or address fraud or security issues.

5.4 Business Transfers

If BidGig is involved in a merger, acquisition, restructuring, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you before your information becomes subject to a materially different privacy policy.

6. Payment Processing & Security

All payment processing on BidGig is handled by Stripe, Inc., a PCI-DSS Level 1 certified payment processor. When you enter payment information, it is transmitted directly to Stripe using TLS encryption. BidGig does not receive, process, or store full credit card, debit card, or bank account numbers.

BidGig stores only Stripe-generated tokens and identifiers (e.g., customer ID, payment method ID, connected account ID) necessary to initiate and track transactions. For more information on how Stripe handles your payment data, please review Stripe's Privacy Policy.

7. Cookies & Tracking Technologies

We use the following types of cookies and similar technologies:

• Essential Cookies: Required for the Platform to function. These include session cookies and authentication tokens. You cannot opt out of essential cookies without disabling the Platform.
• Functional Cookies: Remember your preferences such as dark/light mode settings, language preferences, and saved searches.
• Analytics Cookies: Help us understand how users interact with the Platform, which features are most used, and where errors occur. We use anonymized or aggregated data for these purposes.

We do not use third-party advertising or cross-site tracking cookies. You can manage cookie preferences through your browser settings, though disabling certain cookies may affect Platform functionality.

8. Data Retention

We retain your personal information for as long as necessary to:

• Provide you with the Platform and its services while your account is active.
• Comply with legal, tax, and financial reporting obligations (financial transaction records are retained for a minimum of 7 years as required by Canadian law).
• Resolve disputes and enforce our Terms of Service.

When you delete your account, we will delete or anonymize your personal information within 90 days, except where we are required to retain it for legal or compliance purposes, or where it forms part of an unresolved dispute.

Content you have posted (task descriptions, reviews) may be anonymized rather than deleted where removal would adversely affect the integrity of other users' records.

9. Your Privacy Rights

Under PIPEDA, PIPA (Alberta), and applicable privacy laws, you have the following rights:

• Right of Access: You may request a copy of the personal information we hold about you.
• Right to Correction: You may request that we correct inaccurate or incomplete personal information.
• Right to Withdrawal of Consent: You may withdraw consent to non-essential processing (such as marketing emails) at any time.
• Right to Deletion: You may request deletion of your personal information, subject to our legal retention obligations.
• Right to Data Portability: You may request an export of your personal data in a structured, machine-readable format.
• Right to Object: You may object to processing based on our legitimate interests where you have grounds relating to your particular situation.
• Right to File a Complaint: If you believe we have handled your personal information in violation of applicable privacy law, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada (OPC) or the Office of the Information and Privacy Commissioner of Alberta (OIPC).

To exercise any of these rights, please contact us at privacy@bidgig.ca. We will respond to verifiable requests within 30 days.

10. Children's Privacy

The Platform is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected personal information from a child under 13 without verifiable parental consent, we will take steps to delete that information promptly.

If you are a parent or guardian and believe your child under 13 has provided personal information to us, please contact us at privacy@bidgig.ca.

11. Data Security

We implement industry-standard technical, administrative, and physical safeguards to protect your personal information against unauthorized access, disclosure, alteration, and destruction:

• Encryption in Transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher.
• Encryption at Rest: Sensitive data stored on AWS is encrypted using AES-256.
• Authentication: User authentication is managed by Amazon Cognito, which provides industry-standard password hashing, multi-factor authentication support, and secure token management.
• Access Controls: Access to personal data is restricted to authorized personnel with a legitimate business need.
• Security Reviews: We conduct regular security assessments and apply security patches promptly.

No method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security. In the event of a data breach affecting your rights and freedoms, we will notify you and the applicable authorities as required by law.

12. International Data Transfers

BidGig is based in Alberta, Canada. However, our infrastructure and service providers operate in other countries, including the United States:

• AWS (Amazon Web Services): Our primary data is hosted in the us-west-2 (Oregon, USA) region.
• Stripe: Payment data is processed in the United States.
• Google: OAuth authentication data is processed by Google in the United States.

When your personal information is transferred outside of Canada, it may be subject to the laws of the destination country, including access by government authorities. We take steps to ensure that our service providers maintain appropriate safeguards, including data processing agreements and adherence to applicable privacy standards. By using the Platform, you acknowledge and consent to this cross-border transfer.

13. Links to Third-Party Sites

The Platform may contain links to third-party websites or services that are not operated by BidGig. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of those third-party sites. We encourage you to review the privacy policies of any third-party sites you visit.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by posting a prominent notice on the Platform at least 30 days before the changes take effect. We will update the "Last Updated" date at the top of this page.

Your continued use of the Platform after the effective date of the updated Policy constitutes your acceptance of the changes. If you do not agree to the updated Policy, you must stop using the Platform and may request deletion of your account.