Privacy Notice
BidCraft — operated by OmniLeb Tech. Last updated 24 August 2026.
Who is responsible for your data
BidCraft is operated by OmniLeb Tech, a software studio based in Lebanon. We are the data controller for the personal data described here. You can reach us at contact@omnileb.tech.
This notice was last updated on 24 August 2026 and covers getbidcraft.tech and the BidCraft application.
What we collect and why
We collect only what the service needs to work:
- Account data — your name, email address and a hashed password. Used to create your account, sign you in and contact you about the service.
- Usage data — how many generations or scans you have run, and your remaining balance. Used to enforce plan limits and show you your usage.
- Project briefs, company details and pricing information you enter in order to generate a bid.
- Generated bid documents, stored so you can download them again.
- Technical data — IP address, browser type and request timestamps in our server logs. Used for security, abuse prevention and debugging.
Payment data — we never see your card
All payments are processed by Paddle, our Merchant of Record. Your card number, CVC and expiry date go directly to Paddle and never touch our servers. We cannot see them, store them or recover them.
From Paddle we receive only what we need to give you what you paid for: a customer identifier, a transaction identifier, the price purchased, and the status of your subscription or order. Paddle also handles sales tax and VAT and acts as its own controller for that purpose.
AI processing
The content you submit to BidCraft is sent to the Anthropic Claude API to produce your output. Anthropic processes it on our behalf as a subprocessor and does not use API content to train its models.
Do not submit anything you would not be comfortable sending to a third-party processor — in particular passwords, live credentials, payment card numbers or government identity numbers you are not required to include.
Subprocessors
These are the third parties that process personal data on our behalf:
- Paddle.com Market Ltd — Merchant of Record. Handles checkout, payment processing, invoicing and tax. Receives your name, email address, billing address and payment details.
- Anthropic PBC — The Claude API generates your output. Receives the content you submit for generation. Anthropic does not train its models on API data.
- Contabo GmbH — Virtual server hosting in Germany. Stores the application, its database and your generated files.
- Google LLC — Optional Sign in with Google. We receive your name, email address and Google account ID only if you choose it.
Cookies
We use only what is necessary to run the site. A session token is stored in your browser so you stay signed in, and a preference cookie remembers your theme. We do not use advertising cookies and we do not sell data to advertisers.
Paddle sets its own cookies inside the checkout window in order to process your payment and detect fraud. Those are governed by Paddle's privacy policy.
How long we keep it
Account data is kept while your account is open and for thirty days after you close it, so the account can be restored if you change your mind.
Generated files and their history are kept for twelve months, then deleted.
Server logs are kept for ninety days.
Records of purchases are kept for as long as tax law requires, which is generally ten years. Paddle holds the authoritative copy of those records.
Your rights
Wherever you live, and regardless of whether the GDPR applies to you, we will honour the following:
- Access — ask for a copy of the personal data we hold about you.
- Rectification — ask us to correct anything inaccurate.
- Erasure — ask us to delete your account and personal data.
- Portability — ask for an export of your data in a machine-readable format.
- Restriction and objection — ask us to stop or limit a particular use.
- Withdraw consent — where we relied on consent, withdraw it at any time.
How to exercise them
Email contact@omnileb.tech from the address on your account. We will respond within thirty days. We do not charge for this. If you are in the EU or UK and you are unhappy with our response, you may complain to your national data protection authority.
International transfers
Our servers are in Germany. Anthropic and Paddle process data in the United States and the United Kingdom. Those transfers rely on the Standard Contractual Clauses or an equivalent safeguard in each provider's data processing agreement.
Security
Passwords are stored hashed, never in plain text. Traffic is encrypted with TLS. Access to production systems is restricted to the people who need it.
No system is perfectly secure. If a breach affects your personal data and puts you at risk, we will tell you and the relevant authority without undue delay.
Children
The service is not intended for anyone under 18 and we do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.
Changes
If we change this notice materially we will email you or show a notice in the application before the change takes effect.
Contact
Privacy questions: contact@omnileb.tech.