Privacy Policy

Effective date: April 17, 2026 · Last updated: April 17, 2026

0. Person responsible for the protection of personal information

Under Quebec Law 25 (Act respecting the protection of personal information in the private sector, as amended September 2023), the Person Responsible for the protection of personal information at Manera Technologies Inc. is Kao Manirath, Privacy Officer.

Direct contact: [email protected]. Postal: Manera Technologies Inc., Privacy Officer, Pointe-Calumet, Quebec, Canada. We respond to access, rectification, portability, and deletion requests within 30 days as required by §32 of the Act.

1. What we collect — the minimum

We collect only what is operationally necessary: your email and region to route your request, the content of your request itself, and (for vendors) license details you self-declare.

We do NOT collect browsing data, behavioral profiles, or marketing identifiers beyond what is strictly required for the Platform to function.

2. What we do with it (purpose)

Your request is shown only to vendors who are licensed in your region and in the relevant vertical. Your contact information is shared only with the vendor you select. Unsuccessful bidders never receive your contact details.

We do not sell your data. We do not rent, lease, or monetize it through third-party advertisers. The legal basis for processing is contract performance (Civil Code of Quebec art. 35 et seq., Law 25 §12).

3. Sub-processors and cross-border transfers

Some processing involves transferring your information outside Quebec. As required by Law 25 §17, we disclose:

Anthropic, PBC (United States) — provides the AI model used for matching your request to relevant vendors and summarizing responses. Anthropic is contractually bound by a Data Processing Agreement to delete API inputs after 30 days unless safety review is required, and not to train models on your data.

Stripe, Inc. (United States / Ireland) — payment processor for vendor subscription fees only. Consumers do not pay Manera; consumer card data never reaches our servers.

Cloudflare, Inc. (global edge) — DNS, DDoS protection, and TLS termination. Cloudflare may retain connection logs for up to 4 hours.

Postmark / Mailtrap (United States) — transactional email delivery for magic-link login and vendor notifications.

All sub-processors operate under data-protection agreements equivalent to Quebec Law 25 standards. You may request the current sub-processor list and any privacy impact assessment summary by writing to [email protected].

4. Automated processing and AI matching (Law 25 §12.1)

We use automated processing — specifically a large-language-model-based scoring step — to match your request to vendors and to summarize vendor responses for you. This processing is not a fully automated decision producing legal effects: a vendor only sees your request after passing license/region filters that are themselves rule-based, and you (the consumer) make every selection decision. The AI never approves, rejects, prices, or contracts on your behalf.

You have the right to: (a) be informed of the principal factors and parameters used (request content, region, vertical, vendor licensing, response time); (b) request that a human review any matching outcome that affected you; (c) ask Manera to recompute matching without the AI step. To exercise: [email protected].

5. How long we keep it

Active request data: kept for the duration of the request + 90 days for dispute support. Vendor account data: kept for the lifetime of the account + 7 years for accounting/tax records (CRA / Quebec Revenue obligations). Magic-link login tokens: 15 minutes. Session cookies: 30 days.

You may request deletion at any time at [email protected]. Upon deletion, we remove personal identifiers; anonymized transactional records may be retained for statistical and legal-compliance purposes.

6. Cookies and tracking

We use only essential session cookies (Lax-SameSite, HttpOnly, Secure flag in production) required for login and the request flow. We do not use third-party advertising trackers, behavioral analytics, or tools that profile individual users.

We honor the Global Privacy Control (GPC) signal — if your browser sends it, we treat it as an opt-out from any non-essential processing.

7. Your rights — and how to exercise them

Under Quebec Law 25, you have the right to: (a) access your personal information, (b) rectification of inaccurate data, (c) data portability in a structured, commonly-used format, (d) deletion when no longer necessary, (e) withdraw consent at any time, (f) be informed of automated processing factors, and (g) lodge a complaint (see §10 below).

Equivalent rights apply for residents of the EU (GDPR), Canada outside Quebec (PIPEDA), and California (CCPA/CPRA).

Send all requests to [email protected]. We respond within 30 days; complex requests may extend to 60 days with notice.

8. Security measures (Law 25 §10)

Reasonable technical measures: TLS 1.3 in transit; AES-256 at rest; HSTS, CSP, X-Frame-Options, X-Content-Type-Options security headers on every response; HttpOnly + Secure + SameSite=Lax cookies; magic-link authentication (no consumer passwords stored); rate limiting on login endpoints.

Reasonable organizational measures: principle-of-least-privilege access; encrypted backups; documented incident response plan; annual review of sub-processors. Manera is a single-founder company at this stage; access to production data is limited to the founder. We do not warrant absolute security — no online system is perfectly secure.

9. Children

Bidit is not intended for use by persons under 18. We do not knowingly collect information from minors. If we discover such information, we delete it. Parents or guardians who believe their child has used Bidit may contact [email protected] for immediate deletion.

10. Data breach notification

Per Law 25 §3.5, in the event of a confidentiality incident presenting a risk of serious injury, we will notify the Commission d'accès à l'information du Québec (CAI) and affected individuals without delay. We maintain an incident register as required.

11. Complaints — how to escalate

If you are not satisfied with Manera's handling of a privacy matter, you may lodge a complaint with the Quebec privacy regulator:

Commission d'accès à l'information du Québec (CAI) · Bureau de Québec : 525, boulevard René-Lévesque Est, bureau 2.36, Québec (QC) G1R 5S9 · Bureau de Montréal : 2045, rue Stanley, bureau 900, Montréal (QC) H3A 2V4 · Telephone: 1-888-528-7741 · Web: cai.gouv.qc.ca.

Outside Quebec: Office of the Privacy Commissioner of Canada (PIPEDA) — priv.gc.ca. EU residents: your local Data Protection Authority.

Questions about this document? Write to [email protected].

Manera Technologies Inc.
Bidit™ and Just Bidit.™ are trademarks.