Privacy Policy

Effective date: May 1, 2026

This Privacy Policy explains how XeroBit Inc., doing business as BidWise ("BidWise," "we," "us," or "our"), collects, uses, discloses, and protects personal information when merchants install or use the BidWise Shopify app, when buyers submit offers through a merchant's storefront, and when users visit our website or contact us for support.

1. What BidWise does

BidWise is a Shopify app that allows merchants to add private price negotiation to product pages. A buyer can submit an offer for a product, and the merchant can accept, decline, or counter the offer. When an offer is accepted, BidWise helps create a Shopify Draft Order so the buyer can complete checkout through Shopify at the agreed price.

BidWise is not an auction platform, payment processor, marketplace, or resale service. BidWise supports private one-to-one offer workflows for merchants using Shopify.

2. Our role

For most buyer personal information processed through a merchant's store, the merchant is the controller or business responsible for deciding why and how the information is processed, and BidWise acts as a processor or service provider that processes the information on the merchant's behalf.

For personal information we collect directly from merchants, account users, website visitors, or support contacts for our own business purposes, BidWise may act as an independent controller or business.

3. Information we collect

We collect only the information needed to provide, secure, troubleshoot, and improve BidWise.

3.1 Information from merchants and Shopify

When a merchant installs or uses BidWise, we may collect:

• Shop domain and Shopify store identifiers.
• Merchant account, installation, OAuth, and app session information.
• Product, variant, collection, and pricing information needed to display the offer widget, evaluate offers, and create Draft Orders.
• Draft Order references, invoice link metadata, order/payment status updates, and webhook event metadata.
• App configuration settings, including offer rules, thresholds, widget copy, email template settings, language/currency settings, and onboarding status.
• Billing status, plan key, trial status, and subscription-related metadata from Shopify Billing, if paid plans are enabled.
• Support communications and any information a merchant provides when contacting us.
• Operational logs, diagnostics, audit records, and security records related to the merchant's use of BidWise.

3.2 Information from buyers who submit offers

When a buyer uses the BidWise widget on a merchant's store, we may collect:

• Email address.
• Name, if the merchant's implementation collects or passes it to BidWise.
• Offer amount, quantity, product, variant, selected currency, and optional buyer message.
• Offer status and offer timeline events, such as submitted, accepted, countered, declined, expired, checkout created, or paid.
• Magic link token metadata for accepting or declining counter offers.
• Draft Order and invoice URL metadata needed to send the buyer a private checkout link.
• Technical and security data, such as IP address hash, user-agent hash, nonce validation details, request timestamps, and anti-abuse signals.

We do not use buyer email addresses for marketing unless the buyer separately gives valid consent through a merchant-controlled or BidWise-controlled process that clearly asks for marketing consent.

3.3 Website and support information

When someone visits a BidWise website or contacts us, we may collect:

• Contact details provided through forms or email.
• Support request content.
• We do not use website analytics.
• Security logs used to detect abuse, fraud, and unauthorized access.

4. How we use information

We use personal information to:

• Provide and operate the BidWise app.
• Display and submit the Make an Offer widget on merchant storefronts.
• Evaluate offers according to merchant-configured rules.
• Notify buyers and merchants about offer status and actions.
• Create and manage Shopify Draft Orders after accepted offers.
• Provide magic links so buyers can accept or decline counter offers without creating an account.
• Maintain offer histories, dashboards, analytics, and reporting for merchants.
• Provide support, respond to questions, and troubleshoot technical issues.
• Secure the app, prevent fraud, block spam, enforce rate limits, and verify request authenticity.
• Maintain audit logs and comply with legal, tax, accounting, and platform obligations.
• Improve app reliability, performance, and usability.

5. Transactional email only

BidWise sends transactional emails related to offers, such as offer received, auto-declined, merchant declined, counter received, invoice link, new offer alert, and offer paid alert emails.

Buyer email addresses collected for offers are used to send offer-related transactional messages and private checkout links. They are not sold, shared for cross-context behavioral advertising, or used for unrelated marketing by BidWise.

6. Automated offer rules

BidWise may automatically classify an offer based on rules configured by the merchant, such as minimum offer, auto-decline threshold, counter threshold, and auto-accept threshold. These rules are set by the merchant. BidWise provides the technical tool that applies those merchant settings.

If a buyer believes an offer result is incorrect, the buyer should contact the merchant directly or contact BidWise at contact@bidwiseapp.com so the request can be routed appropriately.

7. Legal bases for processing under GDPR/UK GDPR

Where GDPR or UK GDPR applies, we rely on the following legal bases when BidWise acts as a controller:

• Contract: to provide BidWise to merchants and administer merchant accounts.
• Legitimate interests: to secure the app, prevent abuse, maintain logs, improve the service, communicate about service matters, and support merchants and buyers, where those interests are not overridden by individual rights.
• Legal obligations: to comply with applicable law, accounting, tax, security, and platform requirements.
• Consent: where we ask for consent, such as optional marketing communications or certain analytics/cookies, if applicable.

For buyer information processed on behalf of a merchant, the merchant determines the applicable lawful basis, and BidWise processes the information under the merchant's instructions and our Data Processing Agreement, where applicable.

8. How we disclose information

We disclose personal information only as needed to provide BidWise, comply with obligations, or protect rights and security. Recipients may include:

• Shopify, including Shopify APIs and Shopify Draft Orders, to provide the app and checkout flow.
• Hosting and infrastructure providers, including Render and database providers.
• Email delivery providers, including Postmark, to send transactional emails.
• Error monitoring providers, including Sentry, configured to reduce or scrub personal information where feasible.
• Professional advisors, such as lawyers, accountants, auditors, and insurers.
• Authorities or third parties when required by law, legal process, or to protect rights, safety, and security.
• A successor entity in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to appropriate confidentiality and privacy protections.

We do not sell buyer personal information. We do not share buyer personal information for cross-context behavioral advertising.

9. Subprocessors and service providers

We use third-party processors and service providers to operate BidWise. Current categories include:

• Shopify: app platform, APIs, Draft Orders, checkout, billing, and app installation infrastructure.
• Render: application hosting and deployment.
• Render: PostgreSQL database hosting and storage.
• Render: Redis / queue infrastructure for background job processing.
• Postmark: transactional email delivery.
• Sentry: error tracking and monitoring with PII scrubbing where configured.

We do not use website analytics or a third-party analytics provider.

We require processors and service providers to process personal information only for authorized purposes and to protect it using appropriate safeguards.

10. Security measures

BidWise uses technical and organizational safeguards designed to protect personal information, including:

• Encryption of buyer email at rest where stored by BidWise.
• Encryption or restricted handling of invoice URL data.
• Hashing or pseudonymization of IP addresses and user agents where feasible.
• HMAC verification and nonce/replay protections for storefront-to-server requests.
• Access controls and least-privilege practices.
• Background job retry controls and idempotency to reduce duplicate processing.
• Audit logs for sensitive operator actions.
• Error monitoring with personal-information scrubbing where feasible.

No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

11. Data retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer period is required or permitted by law.

Our default retention periods are:

• Merchant account and app configuration records: while the merchant uses BidWise and for up to 90 days after uninstall, unless needed for legal, security, or billing purposes.
• Offer records and offer event timelines: while the merchant uses BidWise and for up to 12 months after uninstall or deletion request, unless required for legal, tax, fraud-prevention, dispute, or audit purposes.
• Transactional email event records: up to 12 months for deliverability, troubleshooting, and audit purposes.
• Security, request, and diagnostic logs: up to 12 months, unless needed for security investigation.
• Backups: deleted or overwritten on a rolling schedule, typically within 90 days.
• Billing, tax, and legal records: as required by applicable law, typically up to 7 years.

When retention expires, we delete, anonymize, or aggregate the information.

12. Merchant uninstall and shop data deletion

When a merchant uninstalls BidWise, we may deactivate the merchant's shop account and begin deletion or anonymization according to our retention schedule and legal obligations.

Merchants may request deletion of shop data by contacting contact@bidwiseapp.com. BidWise also supports Shopify privacy/redaction workflows for shop deletion requests, where applicable. We may retain limited records if needed for legal, billing, fraud-prevention, security, or dispute purposes.

13. International transfers

We and our service providers may process personal information in countries other than the country where the merchant, buyer, or website visitor is located, including the United States, Canada, and other jurisdictions where our providers operate.

Where required, we use appropriate safeguards for international transfers, such as contractual protections, data processing agreements, and standard contractual clauses or equivalent transfer mechanisms.

14. GDPR and UK privacy rights

Depending on location and applicable law, individuals may have rights to:

• Access personal information.
• Correct inaccurate personal information.
• Delete personal information.
• Restrict or object to certain processing.
• Receive a portable copy of personal information.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with a supervisory authority.

Buyers who submitted offers through a merchant's store should first contact the merchant because the merchant is usually the controller for buyer data. Buyers may also contact BidWise at contact@bidwiseapp.com, and we will assist the merchant or route the request as appropriate.

Merchants and account users may contact BidWise directly at contact@bidwiseapp.com.

15. California privacy notice

This section applies to California residents to the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA"), applies.

15.1 Categories of personal information

In the last 12 months, BidWise may have collected the following categories of personal information:

• Identifiers, such as name, email address, shop domain, account identifiers, and online identifiers.
• Commercial information, such as offer details, product references, order references, and subscription/billing status.
• Internet or electronic network activity information, such as logs, device/browser data, hashed IP and user-agent data, and security events. We do not collect or infer geolocation information.
• Professional or business information, such as merchant role, store details, and support communications.
• Inferences, such as app usage analytics or offer funnel analytics provided to merchants in aggregate or shop-specific dashboards.
• Sensitive personal information only if incidentally provided in free-text support messages or buyer offer messages; users should not provide sensitive information in offer messages.

15.2 Purposes

We collect and use these categories for the business and commercial purposes described in this Privacy Policy, including providing BidWise, completing offer workflows, sending transactional emails, creating Draft Orders, securing the service, providing support, and complying with obligations.

15.3 Sale or sharing

BidWise does not sell personal information and does not share personal information for cross-context behavioral advertising.

15.4 California rights

California residents may have the right to know, access, delete, correct, opt out of sale or sharing, limit certain uses of sensitive personal information, and be free from discrimination for exercising privacy rights. To exercise rights, contact contact@bidwiseapp.com. Buyers should also contact the merchant whose store collected the offer because the merchant may be the business responsible for the buyer relationship.

16. Children's privacy

BidWise is intended for merchants and buyers using Shopify stores. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child provided personal information to BidWise, contact us at contact@bidwiseapp.com.

17. Third-party links and Shopify

BidWise operates within the Shopify ecosystem and may link to Shopify checkout, Shopify admin, merchant storefronts, or other third-party sites. Those services have their own privacy practices. Merchants are responsible for their own storefront privacy notices and for explaining to buyers how the merchant uses buyer information.

18. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date and provide notice by reasonable means, such as in-app notice, email, or posting on our website.

19. Contact us

Privacy contact: contact@bidwiseapp.com Legal entity: XeroBit Inc. (doing business as BidWise)