Privacy Policy - BidVision

This Privacy Policy explains how BidVision collects, uses, stores, shares, and protects personal data when you use the BidVision website, applications, and related services (the "Service").

BidVision is currently a pre-launch service operated from Lithuania. If you have any questions about this Privacy Policy or about how your personal data is processed, you can contact us at privacy@bidvision.eu. If BidVision later begins operating through a registered legal entity, this Privacy Policy will be updated with the full legal entity name, registration details, and registered address.

BidVision has not appointed a Data Protection Officer at this time. If that changes, we will update this Privacy Policy.

1. What personal data we collect

Depending on how you use the Service, we may collect the following categories of personal data:

Account and identity data: your email address, Google account sign-in data, external login identifiers, and account-related information needed to authenticate you and manage access.
Vehicle, auction, and analysis input data: auction listing URLs, lot numbers, VIN or partial VIN, make, model, year, title information, damage descriptions, odometer information, location data, auction platform data, image URLs, equipment/specification data, target bid values, and market-value inputs.
Analysis output and quality data: AI-generated damage reports, damaged part assessments, repair estimates, user feedback, corrections, ground-truth review data, analysis run metadata, image hashes, and raw or structured model outputs retained for quality, reproducibility, and service improvement.
Autopilot and workflow data: search URLs, extracted lot URLs, processing progress, session status, and related workflow records.
Billing and transaction data: payment session IDs, payment intent IDs, purchased credit packs, credit balances, transaction history, payment status, and amounts. We do not store full payment card numbers on our own servers.
Technical, cookie, and security data: authentication cookies, culture/language cookie, theme cookie, temporary pending-lot cookie, IP-related request data, browser/device metadata, basic logs, and diagnostic or error data.
Communications data: information you send to us when you contact support or send a privacy request.

2. How we collect personal data

We collect personal data:

directly from you when you sign in, submit auction URLs, request vehicle analysis, buy credits, or contact us;
from Google when you use Google Sign-In;
from third-party sources you ask us to process, such as publicly accessible auction listing pages and related vehicle data sources;
from payment providers such as Stripe in connection with purchases and payment confirmations; and
automatically through essential cookies, server logs, and security or diagnostics tooling when you use the Service.

3. Why we process personal data and our legal bases

Under the GDPR, we rely on one or more of the following legal bases:

Performance of a contract or steps at your request before a contract: to create and manage your account, authenticate you, analyze auction listings you submit, provide vehicle reports, manage credits, and process purchases.
Legitimate interests: to secure the Service, prevent abuse, validate access against allowlists, investigate incidents, troubleshoot issues, improve model quality, review corrections and feedback, maintain service performance, and defend legal claims.
Legal obligations: to maintain records required by accounting, tax, fraud-prevention, or other applicable laws, and to comply with lawful requests from authorities.
Consent, where consent is specifically required by law. If we rely on consent, you may withdraw it at any time, although this will not affect processing already carried out before withdrawal.

4. How we use your personal data

We use personal data to:

operate, maintain, and secure the Service;
sign you in and manage your account;
analyze vehicle listings and generate AI-assisted reports;
calculate costs, valuations, and related bidding information;
process payments and manage credits;
store your analysis history and related workflow data;
review user corrections and feedback to improve quality and reliability;
respond to support, legal, and privacy requests;
monitor performance, detect bugs, and investigate security issues; and
comply with legal obligations and enforce our terms.

We do not currently use the Service to send marketing emails, run targeted advertising, or operate analytics/advertising trackers such as Google Analytics.

5. Cookies and similar technologies

BidVision currently uses essential cookies needed to operate the Service, including cookies for:

authentication and session management;
language/culture preference;
theme preference; and
temporarily storing a pending auction URL during the login flow.

These cookies are used to provide core functionality and security. We do not currently use advertising cookies or analytics cookies such as Google Analytics.

6. Who we share personal data with

We may share personal data with the following categories of recipients, only where necessary:

hosting, infrastructure, database, and security service providers that help us run the Service;
Google, when you use Google Sign-In;
Stripe, to process payments and payment-related events;
Sentry or similar error-monitoring providers used to detect and fix service issues;
AI model providers configured for the Service at the time of processing, such as Google or OpenAI, when needed to perform requested vehicle analysis;
professional advisers, insurers, or auditors where reasonably necessary; and
public authorities or regulators where disclosure is required by law or necessary to protect rights, safety, or the Service.

We do not sell your personal data and we do not share personal data for cross-context behavioral advertising.

7. International data transfers

Some of our service providers may process personal data outside the European Economic Area. Where this happens, we aim to use appropriate safeguards under applicable data protection law, such as adequacy decisions, standard contractual clauses, or other lawful transfer mechanisms made available by the relevant provider.

8. How long we keep personal data

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Service, maintain security, handle disputes, improve quality, and comply with legal obligations.

Account data is generally retained while your account remains active and for a reasonable period afterward to handle security, support, or dispute issues.
Vehicle, analysis, autopilot, and feedback records are generally retained while your account remains active, unless you request deletion sooner or longer retention is required for legal reasons.
Billing and transaction records may be retained for longer where required by applicable accounting, tax, or anti-fraud rules.
Technical logs, diagnostics, and security data are generally kept for a limited period appropriate for troubleshooting, abuse prevention, and security monitoring.

9. Your rights

Under the GDPR, you may have the right to request access to your personal data, rectification of inaccurate data, erasure, restriction of processing, portability of eligible data, and objection to certain processing, especially where we rely on legitimate interests.

If we rely on consent for any specific processing, you may withdraw that consent at any time. You also have the right to lodge a complaint with your local supervisory authority. If you are in Lithuania, you can contact the State Data Protection Inspectorate (Valstybine duomenu apsaugos inspekcija) at vdai.lrv.lt.

To exercise your rights, contact us at privacy@bidvision.eu. We may ask you to verify your identity before completing a request.

10. Automated decision-making

BidVision uses AI-assisted analysis to help generate vehicle damage and cost estimates. These outputs are decision-support tools only. We do not intend them to be the sole basis for decisions that produce legal effects or similarly significant effects on you. Users should independently verify vehicle condition, pricing, and repair costs before acting on an analysis.

11. Children's privacy

The Service is not directed to children and is not intended for users under the age of 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided personal data to us, please contact us so we can review and delete it if appropriate.

12. Do Not Track

Because BidVision does not currently use cross-site advertising trackers or similar profiling technologies, browser "Do Not Track" signals have limited practical effect on our current processing. If our practices change materially, we will update this Privacy Policy.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in the Service, our providers, or legal requirements. When we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice through the Service.

14. Contact us

For privacy questions, access requests, deletion requests, or other data protection enquiries, contact: