Draft under legal review. The binding version is the one you accept when you sign up or choose a plan; we will ask you to accept any change.
Privacy policy
Version 2026-10-22 · IntentBid.co is provided by BNNR Kamil Bednarski, Warsaw, Poland, VAT ID PL6783171607, REGON 368967330 · ask@answerbid.co
1. Controller
The controller of the personal data described here is BNNR Kamil Bednarski, Warsaw, Poland, VAT ID PL6783171607. Contact for all privacy matters: ask@answerbid.co.
This policy covers people who use IntentBid.co for a customer (users), people who contact us, and visitors of intentbid.co. For visitors of our customers’ websites, the customer is the controller and we process data on its behalf under the data processing agreement (/dpa); the customer’s own privacy notice applies to them.
2. What we process, why, and on what basis
| Data | Purpose | Legal basis (GDPR) | How long |
|---|---|---|---|
| Name, e-mail, password (stored hashed by our database provider; we never see it), role, login times | Account and access to the Service | Contract, art. 6(1)(b) | While the account exists, then up to 6 years for claims |
| Company and billing details, invoices, payment status (card data stays with Stripe) | Payments, invoices, accounting | Contract and legal obligations, art. 6(1)(b) and (c) | 5 years from the end of the tax year |
| Acceptance records: document version, time, IP address, browser | Proof that the contract was concluded | Legitimate interest, art. 6(1)(f) | While the account exists, then up to 6 years |
| Logs of actions in the Service (audit log), security logs | Security, preventing abuse, support | Legitimate interest, art. 6(1)(f) | Up to 12 months; audit log while the account exists |
| Messages to support and e-mails | Answering and helping | Legitimate interest, art. 6(1)(f) | Up to 3 years |
| Service e-mails (alerts, invoices, changes to terms) | Running the Service | Contract, art. 6(1)(b) | While the account exists |
| Product news to business contacts | B2B marketing | Legitimate interest, art. 6(1)(f); you can opt out in every e-mail | Until you object |
3. Who receives the data
We use these providers, bound by data processing agreements:
- Vercel Inc. (USA, global edge network (EU SCCs / EU–US Data Privacy Framework)): hosting of the application and the website script
- Supabase Inc. (Data stored in the EU (Ireland)): database, sign-in and storage
- ipapi.is (VERIFY provider entity and location): first step in finding the company behind an IP address
- Enrich.so (VERIFY provider entity and location (EU SCCs where outside the EEA)): company behind an IP address and company details
- DataForSEO (VERIFY (listed as Estonia, EU)): asking AI assistants the buyer questions; no visitor data
- Stripe Payments Europe Ltd. (Ireland (EU); Stripe group companies in the USA (EU SCCs / DPF)): payments, subscriptions and tax calculation
- Resend Inc. (USA (EU SCCs / DPF)): sending service e-mails (sign-in links, alerts)
- Anthropic PBC (USA (EU SCCs)): claude features (advisor, fill-in, report commentary, campaign builder, fix kits): the text you send, your knowledge base and account figures. No visitor IP addresses. Under Anthropic’s commercial terms, inputs are not used to train models
- Our invoicing provider, for invoices (including national e-invoicing systems where the law requires them)
- Google and OpenAI, only when you connect your own Google Ads or ChatGPT Ads account (and Google, if you sign in with Google)
When data goes outside the European Economic Area (for example to the USA), it is protected by the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.
4. Your rights
You have the right to access your data, correct it, delete it, restrict processing, data portability, and to object to processing based on legitimate interest. To use them, write to ask@answerbid.co. You can also complain to the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.
Giving data is voluntary, but without an e-mail and password we cannot create an account. We do not make decisions about you based solely on automated processing.
5. Visitors of our customers’ websites
Our customers’ script records the pages viewed, the referring site and campaign tags. The visitor’s IP address is sent to our identification provider only to find the company it belongs to. We never store IP addresses in readable form: we keep a keyed hash for at most 30 days and an encrypted copy for at most 24 hours while a lookup is pending. Visits that match no company are deleted after 30 days. We identify companies, not people. Questions about this processing should go to the website owner; we will help them answer.
6. Claude features (AI)
Some features use Claude, an AI model by Anthropic: the advisor, “describe it and Claude fills it in”, report commentary, the campaign builder and AEO/GEO fix kits. When you use them, we send Anthropic the text you type, the documents you add to your knowledge base and the account figures needed for the answer (for example campaign results). We do not send visitor IP addresses or data about identified people. Anthropic processes this as our service provider and, under its commercial terms, does not use it to train models. AI output can be wrong: you review every suggestion, and nothing is published or spent without your action. These features do not make decisions with legal or similarly significant effects about anyone.
If your organization connects its own Anthropic API key (Integrations → Claude), these requests run on your own Anthropic account under your agreement with Anthropic, and Anthropic bills you for them. We store the key encrypted, use it only for your organization’s requests and delete it when you disconnect.
Business facts you tell Claude (your customers, offer, competitors, markets, phrases) are saved to your brand’s company profile so later answers can use them. You can see and remove every item in AI advisor → Company profile.
6a. Google user data (Google sign-in and Google Ads)
This section explains how IntentBid.co accesses, uses, stores and shares data from Google accounts. It applies when you sign in with Google or connect your Google Ads account.
| Google access you grant | What we access | What we use it for |
|---|---|---|
| Sign in with Google (openid, email, profile) | Your name, e-mail address and profile picture | Creating your account and signing you in. Nothing else. |
| Google Ads (https://www.googleapis.com/auth/adwords) | The Google Ads accounts you can access, and in the account you choose: campaigns, ad groups, ads, budgets, audiences, placements and performance reports | Showing your campaign results and reports in the dashboard, and making the changes you ask for in your own account: creating campaigns (always paused until you approve them), starting and pausing them, changing budgets and frequency caps, excluding placements, and creating company audiences and custom segments. |
| Google Ads audience upload (https://www.googleapis.com/auth/datamanager), only if you turn it on | No data is read. We send the customer lists you upload yourself, as SHA-256 hashes | Creating Customer Match audiences in your own Google Ads account from your own first-party contacts, when you ask for it. |
- Storage: the access token from Google is stored encrypted (AES-256) with a separate key. Reports and campaign data from your Google Ads account are stored in our database in the EU (Ireland), only for your organization.
- Sharing: we do not sell Google user data and do not share it with anyone, except the infrastructure providers listed in section 3 that run the Service for us under data processing agreements, or where the law requires it.
- No advertising or AI training: we do not use Google user data for our own advertising, retargeting, profiling, credit decisions or to train AI models. It is used only to provide the features you see in the dashboard.
- People: our staff do not read your Google data, unless you ask us to for support, for security reasons, or where the law requires it.
- Deletion: disconnect Google Ads in Connections at any time: we revoke our access at Google and delete the token straight away. Stored reports are deleted with your account, or within 30 days when you ask us at ask@answerbid.co. You can also remove our access yourself at myaccount.google.com/permissions.
IntentBid.co’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
6b. Microsoft user data (Microsoft Advertising)
When you connect Microsoft Advertising, we receive an access token for your Microsoft login (scope msads.manage). It is stored encrypted, and is used only to show your Microsoft Advertising results and make the changes you ask for in your own account. The same rules on storage, sharing, no advertising use and deletion apply as for Google above.
7. Security
Data is encrypted in transit (TLS) and at rest. Ad-account credentials and secrets are encrypted with a separate key. Access is limited by role, sign-in actions and changes are logged, and IP addresses of our customers’ visitors are never stored in readable form (section 5). If a breach affects your data, we notify you and the supervisory authority as the law requires (within 72 hours under the GDPR).
8. Where data is stored and international transfers
Our database is in the European Union (Ireland). Some providers process data in the USA or elsewhere (section 3). Transfers out of the EEA, the UK and Switzerland rely on adequacy decisions (including the EU–US Data Privacy Framework and its UK and Swiss extensions, where the provider is certified) or the EU Standard Contractual Clauses with the UK Addendum, plus supplementary measures. You can ask us for a copy of the safeguards.
9. Residents of the United States
This section applies where a US state privacy law covers you, including the California Consumer Privacy Act as amended by the CPRA, and the laws of Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia.
| Category (CCPA) | Examples | Source | Disclosed to |
|---|---|---|---|
| Identifiers | Name, e-mail, account ID, IP address in security logs | You, your use of the Service | Providers in section 3, for business purposes |
| Commercial information | Plan, invoices, payment status | You, Stripe | Stripe, invoicing provider |
| Internet or network activity | Log-ins, actions in the Service | Your use of the Service | Hosting and database providers |
| Professional information | Company, role | You | Hosting and database providers |
No sale, no sharing, no targeted advertising. We do not sell personal information, share it for cross-context behavioural advertising, use it for targeted advertising or profiling with legal or similarly significant effects, or collect sensitive personal information. We have not done so in the last 12 months. We honour Global Privacy Control as an opt-out request (see the cookie policy).
Your rights: to know and access the personal information we hold and how we use it, to get a portable copy, to correct it, to delete it, to opt out of sale, sharing, targeted advertising and profiling, to limit the use of sensitive personal information (which we do not collect), and not to be discriminated against for using these rights. Write to ask@answerbid.co with the subject “Privacy request”. We verify requests by e-mail from the address on the account, answer within 45 days (extendable once by 45 days where the law allows) and do not charge for it. An authorised agent may act for you with your signed permission. Appeals: if we decline a request, you can appeal by replying to our answer with the subject “Privacy appeal”; we decide within 45 days (60 in Colorado) and, if we deny the appeal, tell you how to contact your state attorney general.
Retention: section 2. California “Shine the Light”: we do not disclose personal information to third parties for their direct marketing.
10. United Kingdom and Switzerland
For people in the UK, the UK GDPR and the Data Protection Act 2018 apply with the same rights as in section 4; you can complain to the Information Commissioner’s Office (ico.org.uk). For people in Switzerland, the Federal Act on Data Protection (nFADP) applies; you can contact the Federal Data Protection and Information Commissioner (edoeb.admin.ch). We have no establishment in these countries; contact us directly at ask@answerbid.co.
11. Other countries
- Canada (PIPEDA and Québec’s Law 25): we use personal information only for the purposes in section 2, with your consent where required, and you can access and correct it and withdraw consent. Our privacy officer is the person responsible at ask@answerbid.co. Complaints: the Office of the Privacy Commissioner of Canada or, in Québec, the Commission d’accès à l’information.
- Brazil (LGPD): the legal bases are those in section 2 (contract, legal obligation, legitimate interest); you have the rights in art. 18 LGPD, including confirmation, access, correction, anonymisation, portability and deletion; you can complain to the ANPD.
- Australia (Privacy Act 1988, APPs), New Zealand (Privacy Act 2020), Japan (APPI), Singapore (PDPA), South Korea (PIPA), India (DPDP Act 2023), South Africa (POPIA), the UAE and Saudi Arabia (PDPL): you can access and correct your data, ask for deletion and complain to your local data protection authority. Data may be processed in the EU and the USA as described in section 8, with contractual safeguards.
Wherever you are, we apply the GDPR standard as a minimum.
12. Children
IntentBid.co is a business service for adults. We do not knowingly collect data from anyone under 16. If you believe a child has given us data, write to us and we will delete it.
13. Cookies
We use only strictly necessary cookies and storage. Details, and your choices, are in the cookie policy at /cookies.
14. Changes
When this policy changes, the date at the top changes. We tell account owners about material changes by e-mail or in the app before they take effect.