Privacy Policy

Effective date: October 16, 2026 · Last updated: October 16, 2026

0. Person responsible for the protection of personal information

Under Quebec Law 25 (Act respecting the protection of personal information in the private sector, as amended September 2023), the Person Responsible for the protection of personal information at Manera Technologies Inc. is Kao Manirath, Privacy Officer.

Direct contact: privacy@maneratech.com. Postal: Manera Technologies Inc., Privacy Officer, 286, 43e Avenue, Pointe-Calumet, QC J0N 1G0, Canada. We respond to access, rectification, portability, and deletion requests within 30 days as required by §32 of the Act.

1. What we collect — the minimum

We collect only what is operationally necessary: your email and region to route your request, the content of your request itself, and (for vendors) license details you self-declare.

We do NOT collect browsing data, behavioral profiles, or marketing identifiers beyond what is strictly required for the Platform to function, except the channel information described just below.

How you reached us. When you send a request from our website, we note how you reached us: the Bidit page you started from, the referring website's name (domain only), and any campaign codes in the link. We use this only to see which channels bring requests.

Requests sent by an AI assistant. You can ask an AI assistant (for example ChatGPT or Claude) to send a request to Bidit through https://justbidit.ai/mcp. The assistant sends us the category, region, urgency, your description and answers to the request form, and your email address. It may also tell us which assistant platform it is, a session reference, and a campaign or referral code; we record the assistant platform with your request. We do not receive your conversation with the assistant; what you share with the assistant is governed by that provider's own privacy policy, and that provider is not our sub-processor. We return an access key to the assistant so it can check the status of that one request; we store only a hash of the key. Nothing is shown to any business until you click the confirmation link we email you, which works for 7 days. When you confirm, we record your acceptance of the Client Agreement, Terms and Privacy Policy (time, IP address, browser). Unconfirmed requests are never shown to businesses and are marked expired after 7 days. If you ask for a category that is not open yet, we keep only an anonymous record (a hash of the text, the region and the assistant platform).

2. What we do with it (purpose)

Your request is shown to vendors who have declared that they serve your region and category, and to local businesses Bidit invites to your request; Bidit has verified the licence of some of them, not all. Vendors see the details of your request, not your name or contact information. Your contact information is shared only with the vendor you select. Unsuccessful bidders never receive your contact details.

We do not sell your data. We do not rent, lease, or monetize it through third-party advertisers. The legal basis for processing is contract performance (Civil Code of Quebec art. 35 et seq., Law 25 §12).

3. Sub-processors and cross-border transfers

Some processing involves transferring your information outside Quebec. As required by Law 25 §17, we disclose:

Hetzner Online GmbH (United States) — hosts Bidit's servers in a data centre in Hillsboro, Oregon, United States. Your personal information is therefore stored outside Quebec and outside Canada.

Anthropic, PBC (United States) — provides the AI model used for matching your request to relevant vendors and summarizing responses. Anthropic is contractually bound by a Data Processing Agreement to delete API inputs after 30 days unless safety review is required, and not to train models on your data.

Buyer Agent (the “Describe what you need” page). If you use the Buyer Agent, where it is available to you, the text you type (up to 2,000 characters) is sent to Anthropic, our AI provider, to choose the category of your request and pre-fill its form. No other information about you is added to it: not your name, email address or account details. Anything you type yourself, including contact details, is sent as written. Text containing common health or medical words is not sent; you are taken to the normal form instead. Other text that concerns health may still be sent to choose the category; if it is placed in the health category, it is not sent again, no draft is kept, and you are taken to the normal form for that category, or to the category list if that category is not taking requests. Otherwise it is handled like any other request. The resulting draft (your text and the pre-filled answers) is stored on our servers encrypted with AES-256-GCM. It can be opened only from the browser that created it, and our staff have no tool to view drafts. A draft is deleted when you post or cancel your request, and otherwise automatically within about 2 and a half hours of being created. Once posted, your request is kept like any other request (see section 5).

Stripe, Inc. (United States / Ireland) — payment processor for fees charged to vendors (match fees and regulated-profession subscriptions). Consumers do not pay Manera; consumer card data never reaches our servers.

Cloudflare, Inc. (global edge) — DNS, DDoS protection, and TLS termination. Cloudflare may retain connection logs for up to 4 hours. Cloudflare may also show a visitor a bot check (a Cloudflare challenge or Turnstile), which uses signals from the visitor's browser and device.

Cloudflare Web Analytics (Cloudflare, Inc.) — visit statistics and page-load speed for Bidit's website. When a page loads, a Cloudflare script in your browser sends Cloudflare the address of the page, the page you came from, your browser type and measurements of how long the page took to load; like any request to Cloudflare, it also carries your connection's IP address. It sets no cookies and stores nothing on your device, and we see only totals (for example visits per page or per country), never individual visitors. It does not run on pages reached from a personal link (for example a sign-in, confirmation or invitation link), or if your browser sends the Global Privacy Control signal (see section 6).

Google (Gmail / Google Workspace, United States) — transactional email delivery for magic-link login and vendor notifications.

Google Places API (Google, United States) — to find local businesses to invite to bid on a request, we send Google a search made of a trade term taken from a fixed list for the request's category (for example "roofer") and the request's city and province or state (for some categories, only the province or state). No name, contact details or description from the request is sent.

Google Flights (Google, United States) — for flight requests, we look up Google Flights prices through a flight-search library so they can be shown next to vendors' bids. The search sends the departure and arrival airports, the travel dates, the number of adults, children and infants, and the cabin class. No name or contact details are sent.

OpenStreetMap Nominatim (OpenStreetMap Foundation, United Kingdom) — geocoding for vendor business locations: an address or place name typed into Bidit's location search, or a point chosen on the map, is sent to find the matching address and coordinates.

Telegram (outside Canada) — operational alerts to Manera staff (for example a new vendor sign-up, a fee to review, or vendor invitations for a request). An alert can include a request or vendor identifier, a category and region, a licence number, or the name and email address of the person or business that signed up.

Sentry (Functional Software, Inc., United States) — error monitoring: when something fails on our servers, a report of the error is sent to Sentry so we can fix it. Before a report leaves our servers, form contents, cookies, the query string, your IP address and user details are removed, and email addresses, North American and international (+…) phone numbers, IPv4 addresses and access tokens in the remaining text are replaced with placeholders. Other text in an error message, such as a name, a phone number in another format or an IPv6 address, may remain.

Public registers — we check vendors' licence and business numbers against public registers: in Quebec, the Régie du bâtiment du Québec (RBQ) and the Office de la protection du consommateur (OPC); in the United States, the NPI Registry; in the United Kingdom, Companies House; in France, SIRENE; and in Australia, the Australian Business Register (ABR). Only the NPI Registry is queried online: a vendor's NPI number is sent to it. The others are checked against copies of their public data kept on our servers, so nothing is sent to them.

All sub-processors operate under data-protection agreements equivalent to Quebec Law 25 standards. You may request the current sub-processor list and any privacy impact assessment summary by writing to [email protected].

If you click a flight search link (Skyscanner, Aviasales or Kiwi), your browser opens that site with your route, travel dates and number of travellers so it can show prices. That site's own privacy policy applies.

4. Automated processing and AI matching (Law 25 §12.1)

We use automated processing — specifically a large-language-model-based scoring step — to match your request to vendors and to summarize vendor responses for you. This processing is not a fully automated decision producing legal effects: a vendor only sees your request after passing rule-based category and region filters, or after Bidit invites that business to your request, and you (the consumer) make every selection decision. The AI never approves, rejects, prices, or contracts on your behalf.

If you use the Buyer Agent, where it is available to you, an AI model also reads the text you type to choose your request's category and pre-fill its form (see section 3). You review, edit or cancel the result before anything is posted.

You have the right to: (a) be informed of the principal factors and parameters used (request content, region, vertical, vendor licensing, response time); (b) request that a human review any matching outcome that affected you; (c) ask Manera to recompute matching without the AI step. To exercise: [email protected].

5. How long we keep it

Active request data: kept for the duration of the request + 90 days for dispute support. Vendor account data: kept for the lifetime of the account + 7 years for accounting/tax records (CRA / Quebec Revenue obligations). Sign-in links we email to businesses: 30 minutes, and each works once. The link to your request dashboard that we email to customers: 30 days from sending; you can ask for a new one at any time. The copy we keep of each email does not contain working links. Session cookie: 14 days after your last visit if you signed in as a vendor (by email link, with Manera ID or by accepting an invitation to bid) or as a Bidit administrator (an administrator is signed out after 30 minutes without activity and 8 hours after signing in); otherwise, including partner-portal sign-ins, until you close your browser (see section 6).

Photos and videos you upload to a request are deleted 90 days after the request closes (awarded, cancelled or expired). Photos and videos uploaded but never sent with a request are deleted 90 days after the last photo or video was added to them.

Buyer Agent drafts are deleted when you post or cancel the request, and otherwise automatically within about 2 and a half hours of being created (see section 3).

Outreach records — that we wrote to a business address, and whether a message was opened (see §6) — are kept for 24 months and then deleted automatically, and an unsubscribe record is kept indefinitely because that is what stops us writing again.

You may request deletion at any time at [email protected]. Upon deletion, we remove personal identifiers; anonymized transactional records may be retained for statistical and legal-compliance purposes.

What deletion keeps. When a customer's data is deleted, these records are kept: each request, cut down to the structured answers a business could already see before being chosen (for example the category, region and options picked), without your name, contact details, description or any other text you typed; photos and videos you uploaded until they are deleted 90 days after the request closed, as described above; your star ratings, without their written comments; the offers businesses made on your requests, as those businesses' own records; dispute records (their subject, details and resolution, stored encrypted) as legal records, with your email address removed; and the records that you accepted our terms of service, privacy policy and customer agreement (for an address that is also a business account, only the customer agreement), with your email address replaced by a code that does not reveal it and the IP address and browser details removed. A business's acceptance of the Vendor Agreement is vendor account data and is kept as described above.

5a. My home, logbook and reminders

What. If you tick "Remember my home details for next time", we keep a short home profile: region, city, property type, size, year built and, when your request gave them, the air-duct and electrical-panel answers. Only answers from the form's fixed choices (and the city name) are kept: never your description, never your name, email, phone or address. The box is unticked by default. When one of your requests is awarded, your home logbook shows the category, date, accepted amount and the business you chose; you may add a warranty end date. We also record the fact that you proved your email address by clicking a link we sent you.

Why. To fill in your next request for you (you review every field before it is posted), to show you a "welcome back" summary of your last request after you open a link we emailed you, to let you invite a business you hired before to bid again (the business is not told who invited it, and it must still be eligible), and to send maintenance, warranty, seasonal and related-service reminders.

Who sees it. Only you, after you open a link we emailed to your address. It is never shown to someone who types your email into a form or an AI assistant, and an AI assistant never receives it. Businesses never see your profile or logbook.

Reminders and consent (CASL). We send these emails only (a) if you ticked "Send me maintenance and seasonal reminders" (until you withdraw that consent), or (b) for 6 months after you last asked for offers or chose a business on Bidit, and only once you have proved your email address. A "welcome back" summary with suggestions is added to a confirmation email only on the same terms. At most 2 a month. Every reminder identifies Manera Technologies with our mailing address and has a one-click unsubscribe; unsubscribing never affects emails about a request in progress. Using your request history for these reminders is commercial prospecting: you may withdraw your consent at any time (Law 25 §22).

How long. The home profile is kept until you ask us to forget it, or deleted with your account. Logbook entries follow your requests (section 5) and you may delete any entry at any time. Reminder records (what was sent, when, and on what consent) are kept 3 years as proof of consent.

Your controls. "Forget my home details" on the confirmation page, your request page and your dashboard deletes the profile at once. Your dashboard also lets you export your home data as a file, delete logbook entries or everything, and turn reminders on or off. Or write to [email protected].

6. Cookies and tracking

Cookies we set. Bidit sets only the four cookies described below. All of them are first-party and essential or functional: they keep you signed in, keep a request or sign-up form working, protect our forms against forgery, and remember that you closed the cookie notice. The three set by our server are sent with the HttpOnly, SameSite=Lax and, in production, Secure flags; the cookie-notice cookie is set by your browser, so it is not HttpOnly. None of them is used for advertising, analytics or cross-site tracking, and we do not use third-party advertising trackers, behavioral analytics, or tools that profile individual users.

Session cookie (session). It holds a signed record of whether, and as whom, you are signed in (or which of your requests you opened from a link we emailed you), your language choice, a security token that protects our forms against forgery, the short-lived state of a request or sign-up form you are filling in and, if you start a request on our website, the note of how you reached us (see “How you reached us” above) until you send that request. If you sign in as a vendor (by email link, with Manera ID or by accepting an invitation to bid) or as a Bidit administrator, it lasts 14 days after your last visit (an administrator is signed out after 30 minutes without activity and 8 hours after signing in). Otherwise, including when you sign in to the partner portal, it is deleted when you close your browser.

Manera ID sign-in cookie (bidit_sso_tx). Set only while you sign in with Manera ID, to tie the sign-in back to your browser and block forged sign-ins. It is sent only to the Manera ID sign-in pages, lasts at most 10 minutes and is deleted when the sign-in completes.

Photo upload cookie. When you add photos or videos to a request, we also set the essential cookie bidit_upl. It remembers which browser uploaded which photos to a request, so that only you (and Bidit administrators) can see them and you can keep adding photos if you come back later. It holds only a random identifier, is not used for tracking, advertising or analytics, and lasts 180 days.

Cookie notice cookie (manera_consent). Records that you closed the cookie notice, so it is not shown again. It holds only the word "acknowledged" and lasts 365 days. It is set by a script in your browser rather than by our server, so it is not HttpOnly; it is SameSite=Lax and, over HTTPS, Secure.

Email we send you. Some of our outreach emails — currently those to trade and industry associations — contain a single-pixel image, so we can tell whether a message was opened. We record the time it was fetched, the user agent that fetched it, and our assessment of whether the fetch came from a person or from an automated mail scanner — the two are hard to tell apart, and we do not present these figures as proof anyone read anything. Where our systems can see the network address that fetched the image, we store only a keyed hash of it and never the address itself; where we cannot see it, we store nothing. We keep every fetch, not only the ones we judge human, so the judgement can be re-examined. We do this to tell whether writing to you was worth your attention, not to build a profile; nothing is shared with third parties and no advertising network is involved. Blocking images in your mail client prevents this entirely, the plain-text version of every message is never tracked, and every message carries a one-click unsubscribe. This applies only to email we send, it is disclosed in the footer of each message, and we do not do it at all for recipients in the EU or the UK.

No referral cookie. Until October 7, 2026, our partner-association pages set a 30-day cookie named bidit_assoc. We no longer set it, and we delete it from your browser on your next visit. When you sign up from an association's page, the association is recorded from the sign-up link itself, not from a cookie.

Website analytics. We use Cloudflare Web Analytics to count visits and measure how fast our pages load. It sets no cookies, does not use your browser's storage and does not follow you to other websites. We receive only aggregated figures, never a profile of an individual visitor, and it is not used for advertising. If your browser sends the Global Privacy Control signal, the analytics script is not allowed to run.

We honor the Global Privacy Control (GPC) signal — if your browser sends it, we treat it as an opt-out from any non-essential processing.

7. Your rights — and how to exercise them

Under Quebec Law 25, you have the right to: (a) access your personal information, (b) rectification of inaccurate data, (c) data portability in a structured, commonly-used format, (d) deletion when no longer necessary, (e) withdraw consent at any time, (f) be informed of automated processing factors, and (g) lodge a complaint (see §10 below).

Equivalent rights apply for residents of the EU (GDPR), Canada outside Quebec (PIPEDA), and California (CCPA/CPRA).

Send all requests to [email protected]. We respond within 30 days; complex requests may extend to 60 days with notice.

8. Security measures (Law 25 §10)

Reasonable technical measures: TLS 1.3 in transit; AES-256 encryption at rest for the data listed below; HSTS, CSP, X-Frame-Options, X-Content-Type-Options security headers on every response; HttpOnly + Secure + SameSite=Lax server-set cookies; magic-link authentication (no consumer passwords stored); rate limiting on login endpoints.

What is encrypted at rest (AES-256). Request forms and descriptions; your home profile and the business names in your home logbook; the subject and text of emails and alerts we send; vendor alerts; questions and answers on requests; text typed in "Other" fields; waitlist descriptions and notes; disputes; and uploaded photos and files. What is not encrypted: the contact details we use to identify accounts (email addresses, names, phone numbers), the text of business offers, and technical logs such as IP addresses. These are protected by restricted access instead.

Backups. Backups are kept on access-restricted servers. Backups made after October 7, 2026 contain the data listed above in encrypted form; older backups, made before that encryption, are being deleted.

Reasonable organizational measures: principle-of-least-privilege access; documented incident response plan; annual review of sub-processors. Manera is a single-founder company at this stage; access to production data is limited to the founder. We do not warrant absolute security — no online system is perfectly secure.

9. Children

Bidit is not intended for use by persons under 18. We do not knowingly collect information from minors. If we discover such information, we delete it. Parents or guardians who believe their child has used Bidit may contact [email protected] for immediate deletion.

10. Data breach notification

Per Law 25 §3.5, in the event of a confidentiality incident presenting a risk of serious injury, we will notify the Commission d'accès à l'information du Québec (CAI) and affected individuals without delay. We maintain an incident register as required.

11. Complaints — how to escalate

If you are not satisfied with Manera's handling of a privacy matter, you may lodge a complaint with the Quebec privacy regulator:

Commission d'accès à l'information du Québec (CAI) · Bureau de Québec : 525, boulevard René-Lévesque Est, bureau 2.36, Québec (QC) G1R 5S9 · Bureau de Montréal : 2045, rue Stanley, bureau 900, Montréal (QC) H3A 2V4 · Telephone: 1-888-528-7741 · Web: cai.gouv.qc.ca.

Outside Quebec: Office of the Privacy Commissioner of Canada (PIPEDA) — priv.gc.ca. EU residents: your local Data Protection Authority.

Questions about this document? Write to [email protected].

Manera Fintech Service Bidding Platform Inc. (operating as Manera Technologies)
Bidit™ and Just Bidit.™ are trademarks.