Privacy Policy

This Privacy Policy explains how One Up Solutions Northwest, Inc., an Oregon corporation doing business as CrestBid ("CrestBid," "we," "us," or "our"), collects, uses, shares, and protects personal information in connection with the website at crestbid.com, the CrestBid application, and related services (together, the "Service").

This policy covers visitors to our website, people who contact us or request a demo, and the people who create or use CrestBid accounts. It does not cover the business records our customers store in their CrestBid workspaces (for example, their bids, contacts, and documents). We process that information on our customers' behalf and under their instructions, as described in Section 9 and in our Terms of Service. If your information is in a customer's workspace, please contact that customer about it.

We collect the following categories of information.

Information you give us: • Account information: your name, email address, and password when you create an account (we store passwords only as salted cryptographic hashes, never in readable form), and your company's name, industry, and size. • Signup progress: when you complete the first step of signup and click Continue, we save the name and email address you entered so we can help you if you don't finish. We do not save your password at that step. • Demo requests and inquiries: your name, work email, company, and anything you write in your message, along with the page of our website you submitted it from. • Newsletter subscriptions: your email address. • Support and communications: the content of messages you send us and our replies. • Billing information: when you subscribe to a paid plan, payment is handled by our payment processor, Stripe. We receive and store the Stripe customer and subscription identifiers, your plan, seat count, and billing status. We never receive or store your full card number.

Information collected automatically: • Website analytics: we count page visits and signup steps as anonymous daily totals, grouped by page and by broad traffic source (for example, "google / organic," "linkedin / social," or the tag on a link we shared). We derive the traffic source from the address of the page you arrived on and the domain of the site that referred you, and we keep only those coarse labels, never the full referring address. We do not use analytics cookies, do not store IP addresses for analytics, and do not build individual visitor profiles. If your browser sends a Do Not Track or Global Privacy Control signal, we do not count your visit. • Security and service logs: when you sign in, we record the time, result, and IP address of the attempt, and our systems keep technical logs needed to operate, secure, and troubleshoot the Service. • Product usage: within the application, we record how features are used (for example, which screens and actions are used) to operate, support, and improve the Service.

Information from connected services: • If you or your organization connects Microsoft 365 or QuickBooks Online, we access the data that connection permits (such as email, calendar, contact, estimate, or invoice information) only to provide the features you turned on. We store the access tokens for those connections in encrypted form, and you can disconnect them at any time. • If you sign in with Microsoft or Google, we receive your name and email address from that provider to authenticate you.

We use personal information to: • provide, operate, maintain, and secure the Service, including authenticating users and enforcing workspace separation; • create and administer accounts, trials, and subscriptions, and process payments; • respond to demo requests, questions, and support requests, and follow up with people who started but did not finish signing up; • send service communications, such as account, security, trial, and billing notices; • send our newsletter or marketing emails to people who subscribed or have an existing business relationship with us, with an unsubscribe option in every message; • understand, in aggregate, how people find and use our website and the Service, and improve them; • detect, investigate, and prevent fraud, abuse, and security incidents; and • comply with legal obligations and enforce our agreements.

Where the law of your location requires a legal basis for processing, we rely on performing our contract with you or your organization, our legitimate interests in operating and improving a secure business service (balanced against your rights), your consent where we ask for it, and compliance with legal obligations.

Some features use artificial intelligence, for example reading a bid invitation email to prefill an opportunity, summarizing a project, or drafting text. When you use those features, the content needed to produce the result is sent to our AI service providers (currently OpenAI and Anthropic) through their business APIs, which process it to return the result to us. We do not use your workspace content to train our own models. AI output can be inaccurate, so please review it before relying on it.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share personal information only as follows: • Service providers who process it on our behalf and under contract to provide the Service: hosting and infrastructure (Replit, which runs on Google Cloud), database hosting (Neon), transactional email delivery (Resend), payment processing (Stripe), and AI processing (OpenAI and Anthropic). Our website loads fonts from Google Fonts, which receives your IP address when the fonts load. • Services you connect: Microsoft and Intuit (QuickBooks) receive and return data when you use those integrations. • Your organization: if you use CrestBid through your employer or another organization, that organization's administrators can see and manage your account and the content in its workspace. • Legal and safety: when we believe in good faith that disclosure is required by law, subpoena, or other legal process, or is necessary to protect the rights, property, or safety of CrestBid, our customers, or others. • Business transfers: in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to this policy's protections continuing to apply. • With your direction or consent.

We may share aggregated or de-identified information that cannot reasonably be used to identify you.

We use one essential cookie to keep you signed in; it expires after 24 hours. We use your browser's local storage to remember application preferences (for example, dismissed notices), and your browser's session storage to remember the traffic source of your current visit until you close the tab. We do not use advertising or cross-site tracking cookies. Because the essential cookie is required for the Service to work, it cannot be switched off while you are signed in.

We keep personal information only as long as needed for the purposes in this policy: • Account and workspace data: for as long as the account is active. After an account is closed or a deletion request is verified, we delete it from our active systems within 30 days, and it ages out of backups within 90 days after that. • Unfinished signups, demo requests, and inquiries: up to 24 months after our last interaction, unless you become a customer. • Newsletter subscriptions: until you unsubscribe. • Security logs: up to 12 months, or longer when needed to investigate an incident. • Billing records: as long as required for tax, accounting, and legal purposes (generally 7 years). • Aggregate analytics: indefinitely, because they do not identify anyone.

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit (HTTPS), hosting with providers that encrypt data at rest, salted password hashing, encryption of third-party access tokens, database-level separation of each customer's workspace data, role-based access controls, and audit logging of administrative actions. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we learn of a security incident affecting your personal information, we will notify you as required by law.

You can update most account information in the application. You can unsubscribe from marketing emails using the link in any message; we will still send service messages about your account.

Depending on where you live, you may have the right to: know or access the personal information we hold about you; correct it; delete it; receive a portable copy; object to or restrict certain processing; withdraw consent where we rely on it; and opt out of the sale or sharing of personal information or targeted advertising (we do neither). We honor Global Privacy Control signals. We will not discriminate against you for exercising these rights.

To make a request, contact us as described in Section 13. We will verify your request using information associated with your account or submission, and respond within the time the law requires (generally 30 to 45 days). You may use an authorized agent where the law allows; we may ask for proof of authorization. If we deny your request, you may appeal by replying to our decision, and if you are in the European Economic Area or the United Kingdom you may also lodge a complaint with your local data protection authority.

Our customers control the business information they put in CrestBid, including personal information about their own contacts (for example, general contractors, owners, architects, and subcontractors). For that information we act as a service provider (processor) to our customer: we process it only to provide the Service under the customer's instructions and our agreement with them, and not for our own purposes. Requests about that information should go to the customer; we will assist our customers in responding to them.

CrestBid is operated from the United States, and information is processed and stored in the United States. If you use the Service from outside the United States, you understand that your information will be transferred to, processed, and stored in the United States, where data protection laws may differ from those of your country. Where required, we rely on appropriate safeguards for these transfers.

The Service is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us personal information, contact us and we will delete it.

We may update this policy from time to time. We will post the updated version on this page with a new effective date. If we make material changes, we will notify account owners by email or in the application before the changes take effect.

Questions and privacy requests: privacy@crestbid.com, or use the contact form at https://crestbid.com/#demo and tell us your request concerns privacy.

Mail: One Up Solutions Northwest, Inc. (CrestBid), Attn: Privacy, 8060 SW Pfaffle St, Suite 108, Tigard, OR 97223, United States.