The BidShakti app is on Google Play and the App Store. Daily matches and deadline alerts on your phone.Get the app
Legal

Privacy Policy

Version 2.0 · Effective 8 October 2026 · AveoSoft Private Limited

In brief
  • We collect what we need to run the Service: account and company details, the targeting settings you choose, the documents you upload, billing records and technical logs.
  • Tender notices are public government information, not your personal data.
  • Your documents are never used to train AI models. AI processing runs only when you ask for it, and only the details needed for that task are sent.
  • Each subscriber workspace runs on its own application instance and its own database.
  • Under the DPDP Act 2023 you can ask for access, correction or erasure, nominate someone, and raise a grievance at contact@bidshakti.com.

This summary is for convenience. The numbered sections below are the binding text.

1. Who we are and what this Policy covers

  1. 1.1This Privacy Policy explains how AveoSoft Private Limited (CIN U72900GJ2021PTC123833, GSTIN 24AAVCA4288N1ZU), 616 Sharan Circle Business Hub, Zundal, Ahmedabad, Gujarat 382424 ("AveoSoft", "we", "us") handles personal data.
  2. 1.2It covers the website at bidshakti.in, the BidShakti portal, the BidShakti mobile app, and related email, support and billing correspondence (together, the "Service").
  3. 1.3We use the terms of the Digital Personal Data Protection Act, 2023 ("DPDP Act"). For visitors, account holders and our own billing records we act as a Data Fiduciary. For personal data a subscriber uploads into its own workspace, such as details of its directors, staff or signatories, the subscriber is the Data Fiduciary and we act as its Data Processor.

2. Tender information is not personal data

  1. 2.1Tender notices, documents, dates, corrigenda and award results collected from GeM, CPPP, state e-procurement portals and nProcure are public information published by government buyers.
  2. 2.2Where such a document contains an official's name or office contact, that information has been made public by the authority itself. We do not combine tender information with personal data about you, and we do not sell it.

3. What we collect and why

  1. 3.1Account data: name, designation, email, mobile number, password (stored only as a salted hash), role, workspace address and a record of each agreement you accept. We use it to create and secure your account and to support you.
  2. 3.2Company data and documents: legal name, constitution, addresses, PAN, GSTIN, CIN, Udyam details, certificates, licences, financial statements, turnover certificates, work orders, completion certificates, letterhead, seal and signature images. We use them to check eligibility, generate bid documents and run the features you request.
  3. 3.3Targeting settings: the departments, keywords, categories, regions and value ranges you choose, and your alert preferences. We use them to show and send you relevant tenders.
  4. 3.4Billing data: billing name and address, GSTIN, plan, invoices, payment references and refund records. We use it to invoice, collect payment, process refunds and meet tax and accounting law. Card and bank credentials are handled by our payment gateway and are never stored by us.
  5. 3.5Technical data: IP address, browser and device details, pages and features used, and error, security and audit logs. We use it to run, secure and improve the Service.
  6. 3.6Communications: enquiries, support messages, call notes and grievance records. We use them to respond to you and keep a record.
  7. 3.7We do not ask for your GeM, e-procurement portal or digital signature certificate passwords, and we do not collect sensitive data such as health, caste, religion or biometric data.

4. How we use personal data

  1. 4.1To provide the Service: authenticate users, filter tenders, run analyses you request, generate documents and store your records.
  2. 4.2To support you, handle grievances and send service messages such as tender alerts, trial and billing notices, security notices and notice of policy changes.
  3. 4.3To secure the Service: detect and prevent misuse, fraud and unauthorised access.
  4. 4.4To improve the Service, using aggregated usage patterns.
  5. 4.5To send occasional product updates to subscribers and business contacts who have asked for them. Every such email has an unsubscribe link, and unsubscribing does not stop service messages.
  6. 4.6We do not sell or rent personal data, do not share one subscriber's content with another, and do not make automated decisions that have a legal effect on any individual.

5. AI processing

  1. 5.1AI features run only when a user starts them, for example a tender analysis, a Go/No-Go verdict or a drafted document. They are not applied to your stored content in the background.
  2. 5.2When you run an analysis, we send to Anthropic, PBC, the provider of the Claude models we use, the text of the tender and only the profile details needed for that analysis, such as entity name, city and state, incorporation date, MSME status, certifications, turnover figures and experience records.
  3. 5.3We do not send your PAN, GSTIN, CIN, Udyam number, contact email or phone, registered address, bank details, signature or letterhead images, or the personal names of your directors or signatory.
  4. 5.4Anthropic processes the request only to return the result and under terms that do not allow training its models on that data. Neither we nor our providers use your uploaded content to train AI models.
  5. 5.5The result is stored only in your own workspace.

6. Who we share data with

  1. 6.1We use a small number of service providers, each bound by written terms on confidentiality, security and use only on our instructions: cloud hosting and storage providers in India; network and content delivery providers that serve the website and protect the Service; email delivery providers; Anthropic, PBC for AI processing as described in Section 5; Cashfree Payments for payment collection, recurring mandates and refunds; and analytics providers for website and product usage measurement.
  2. 6.2We may also disclose data where the law, a court or a competent authority requires it, to our professional advisers under confidentiality, to a successor business in a merger or sale on equal protections and notice to you, or with your consent.
  3. 6.3A current list of providers is available on request at contact@bidshakti.com.

7. Workspace isolation

  1. 7.1Each subscriber's workspace runs on its own application instance with its own database. Content in one workspace is not visible to or reachable from another in normal operation.
  2. 7.2AveoSoft staff access a workspace only as needed for provisioning, support, maintenance, security or legal compliance. Such access is restricted to authorised people bound by confidentiality, and is logged.

8. Cookies and analytics

  1. 8.1The BidShakti portal sets a session cookie to keep you signed in. It is strictly necessary and the portal cannot work without it.
  2. 8.2On the website we use Google Analytics 4. Inside the portal we use Microsoft Clarity and PostHog. They show us which pages and features are used, so we can fix and improve them.
  3. 8.3We do not use advertising cookies, retargeting pixels or ad networks, and we do not sell analytics data.
  4. 8.4You can block or delete cookies in your browser. Blocking the session cookie will prevent sign-in.

9. Security

  1. 9.1We use reasonable safeguards, including encryption in transit, hashed passwords, workspace isolation, role-based access, audit logging, regular backups and timely patching.
  2. 9.2No system is perfectly secure. Keep your credentials safe, as the Terms of Use require.
  3. 9.3If a personal data breach occurs, we will contain and investigate it, notify the Data Protection Board of India and affected individuals as the DPDP Act and its rules require, and inform affected subscribers without undue delay.
  4. 9.4Report suspected security issues to contact@bidshakti.com.

10. How long we keep data

  1. 10.1Account, company, targeting and uploaded data: for the life of the account. When a trial ends without a plan, the workspace is paused and the data is kept until you ask us to delete it.
  2. 10.2When you ask us to delete your account, we remove it from live systems within 30 days, as described on the Account Deletion page. Copies in encrypted backups are overwritten within 90 days and are not restored or used meanwhile.
  3. 10.3When a paid subscription ends without a deletion request, we keep your content for 60 days so you can request an export, after which we may delete it.
  4. 10.4Invoices, billing and tax records: 8 years, as required by the Companies Act, 2013 and GST law.
  5. 10.5Technical logs: up to 12 months, and security logs up to 24 months where needed for an investigation.
  6. 10.6Support records: up to 24 months after the last message; grievance records for 3 years.
  7. 10.7Where a legal obligation or dispute requires longer retention, we keep the data only for that purpose and period.

11. Your rights

  1. 11.1Under the DPDP Act you may ask for a summary of the personal data we process about you, ask us to correct, complete, update or erase it, nominate another person to exercise your rights in case of death or incapacity, withdraw consent where processing relies on consent, and raise a grievance.
  2. 11.2Write to contact@bidshakti.com from your registered email address. We may verify your identity before acting. We acknowledge within 48 hours and respond within 30 days.
  3. 11.3If your data was uploaded by a subscriber, such as your employer, that subscriber is the Data Fiduciary. We will pass your request to them and help them respond.
  4. 11.4There is no charge for exercising these rights.

12. Children

  1. 12.1The Service is for businesses and for adults acting for them. We do not knowingly collect data of anyone under 18. If we learn that we have, we will delete it.

13. Where data is stored

  1. 13.1Workspace data, databases and backups are stored in India.
  2. 13.2Email delivery, network services and AI processing may involve processing outside India, with providers that offer contractual safeguards. We do not transfer personal data to any country restricted by the Central Government under Section 16 of the DPDP Act.

14. Grievance Officer

  1. 14.1Grievance Officer: Deval Chauhan, Director, AveoSoft Private Limited, 616 Sharan Circle Business Hub, Zundal, Ahmedabad, Gujarat 382424. Email: contact@bidshakti.com, with the subject "Data Protection Grievance".
  2. 14.2We acknowledge within 48 hours and aim to resolve within 30 days. If you are not satisfied, you may approach the Data Protection Board of India.

15. Changes to this Policy

  1. 15.1Each version carries a version number and effective date. For a material change, registered users receive at least 30 days' notice by email before it takes effect, unless law or security requires sooner. Where the law requires fresh consent, we will ask for it.
  2. 15.2This Policy is governed by the laws of India, and the courts at Ahmedabad, Gujarat have jurisdiction.