Privacy Policy

BidBud AI (“BidBud,” “we,” “us”) is operated by FloatingKey LLC. This policy explains what information we collect when you use bidbudai.com, the BidBud estimator embedded on partner websites, our contractor portal, our partner API and our hosted MCP server for AI assistants (together, the “Service”), and what we do with it.

It does not cover what contractors do with your information after they receive it from us, or the websites of partners that embed our estimator. Those businesses have their own privacy practices.

When you get an estimate

You tell us about your project: home size, number of rooms and stories, the services you are interested in, a quality level and, if you choose, details such as roof pitch, roof shape, home type and the year the home was built.

The estimate form on bidbudai.com also asks for your name, email address, city, state and ZIP code, and optionally your phone number and street address. Your ZIP code or state is used to price the job at local labor rates. If you do not ask to be contacted by a contractor, we use these details only to produce your estimate and do not save them.

When you ask to be contacted by a contractor

If you tick “Yes, I want to be contacted by a contractor” and agree to the consent statement, we save a contact request (a “lead”) for each service you selected. Each lead contains:

• your name, email address, phone number, street address (if you gave one), city, state and ZIP code, and whether you prefer a call or a text;
• your project details and the estimate we showed you; and
• a record of your consent: the date and time, the version of the consent wording you saw, and the IP address your request came from.

When you chat with Buddy

Buddy is our AI assistant for questions about your estimate. We receive the questions you type (and the last few messages of the conversation) together with the project details behind your estimate. See AI features for how these messages are handled.

When you use BidBud as a contractor

• Account details: company name, contact name, email address, phone number, city, state, ZIP code, service radius, the services you offer, your license number (optional), your plan choice and your notification preferences.
• Sign-in information: your password, which we store only as a one-way hash, and sign-in tokens kept in your browser.
• Payment information: card details are entered into a form provided by our payment processor, Stripe, and go directly to Stripe. We do not receive or store your full card number. We store the Stripe customer ID and payment references that Stripe returns to us.
• Activity: the leads you claim, lead statuses and notes, quotes you prepare and send, the number of leads you have claimed and the amounts charged, and questions you ask Contractor Buddy.
• Security records: sign-in attempts (the email address used, the time and the IP address) and records of actions such as claiming a lead.

Information contractors enter about their own customers

Contractors can add their own customers to the portal (“manual leads”), including a customer’s name, email address, phone number, address and project details, and can use BidBud to email that customer a quote. We store this information for the contractor who entered it. It is not added to the lead queue and is not shared with other contractors.

Partner websites and the embedded estimator

Some businesses (“partners”) embed the BidBud estimator on their own websites. When you use it, we receive the project details you enter (ZIP code, home size, rooms, stories, quality level and services) to produce your estimate. The partner’s page is told when the estimator has loaded, its size on the page, the estimate totals and, if contact requests are available, that a request was sent. It is not sent your name or contact details by the estimator. We keep daily counts of how many requests each partner’s estimator and API key make.

Contact requests through partner websites are currently turned off. Before they are turned on, we will update this policy, and the consent statement shown in the estimator will name the partner and explain who may receive your information.

We also keep business information about partners, such as the partner’s name, the websites allowed to embed the estimator, and branding.

Partner API and MCP server

Partners can request estimates through our API, and AI assistants can do so through our hosted MCP server. These requests contain project details (for example a ZIP code, home size, services or a quoted price). We use them to return an answer and do not save them, except as follows:

• For each partner we keep daily request counts per type of request.
• For the MCP server we keep a usage record of each request: the time, the tool used, whether it succeeded, how long it took, the type of client software (for example, the name of the AI assistant), the state and the first three digits of the ZIP code, the services and quality level asked about, a quoted price rounded to the nearest $1,000, and a visitor code calculated from the IP address and a secret value. The visitor code changes every day, so the records are not grouped by visitor across days. The record does not contain the IP address itself, the full ZIP code or the home size.

Information collected automatically

• Server logs. Our servers record basic information about each request, such as the time, the page or API path, the result and how long it took.
• IP address. We use your IP address to apply usage limits (these counters are kept in memory and are not saved), and we record it in the consent record of a contact request and in the security records described above.
• Browser storage. See Cookies and browser storage.

We do not use analytics, advertising or social media tracking tools on the Service.

Information from other sources

Stripe tells us whether a contractor’s payment succeeded and the status of any subscription. Our estimates use public cost and wage data (for example, U.S. Bureau of Labor Statistics data), which is not information about you.

We use the information described above to:

• produce estimates, price ranges, permit guidance and answers to your questions;
• deliver contact requests to contractors, as you asked us to;
• run contractor accounts, show contractors leads that match their services and service area, and process lead fees;
• send emails, such as new-lead alerts and claim confirmations to contractors, and quotes that contractors send to their customers through BidBud;
• keep a record of your consent to be contacted;
• protect the Service and its users, for example by limiting how often requests can be made, locking accounts after repeated failed sign-ins, and investigating misuse;
• understand how the Service is used, using counts and anonymous records rather than profiles of individuals;
• comply with law, respond to lawful requests, and enforce our Terms of Use; and
• as part of a sale, merger or other transfer of our business (see below).

We do not use your personal information to train AI models, and we do not use it for targeted advertising.

With contractors, when you ask us to

We share your contact details only if you ask to be contacted and agree to the consent statement. The process works like this:

• Your request is placed in our lead queue for contractors, one lead per service you selected. While a lead is unclaimed, the queue shows a summary only: your initials, city, state and ZIP code, your project details and the estimate. Your full name, email address, phone number and street address are hidden.
• A contractor who offers that service can claim the lead, usually for a fee paid to BidBud. Only one contractor can hold a lead at a time. The contractor who claims it receives your name, email address, phone number, street address and preferred contact method, and may contact you about your project.
• If a contractor claims a lead but does not update it or prepare a quote within 14 days, we may return the lead to the queue, and another contractor may then claim it and receive your details.

Contractors are independent businesses, not BidBud employees or agents. Once a contractor has your details, their use of them is governed by their own practices. Our Terms require contractors to use your information only for your project and to follow the laws that apply to calls, texts and emails.

With service providers

We use other companies to run the Service. They may process information for us only to provide their services:

• Microsoft Azure hosts our website, API and database, stores our encryption keys and logs, and runs Azure OpenAI Service, which generates Buddy’s answers.
• Stripe processes contractor payments. Stripe receives the contractor’s name, email address and card details, and a reference to the contractor account and lead for each charge. Stripe does not receive homeowner information from us.
• Zoho Mail (or another email provider we choose) delivers our emails.
• Google Maps Platform provides street address suggestions as you type on the estimate form, and maps of a lead’s address in the contractor portal. Our pages load Google’s mapping software, so Google receives your IP address and browser information when you visit, and your browser sends what you type in the street address field, or the address being mapped, directly to Google.
• Zippopotam.us, a public ZIP code lookup service, fills in a city and state from a ZIP code. Your browser sends only the ZIP code.

With partners

Partners that embed our estimator or use our API receive estimates and request counts. We do not give them your name or contact details.

For legal reasons and to protect people

We may disclose information if we believe it is required by law or legal process, or needed to protect the rights, property or safety of our users, the public or BidBud, or to investigate fraud or misuse.

If our business is transferred

If BidBud or its assets are sold, merged or otherwise transferred (including during negotiations and due diligence for such a transaction), information we hold may be transferred to the buyer or successor as part of that transaction. The buyer or successor will be required to handle it in a way that is consistent with this policy, or to tell you about any changes.

Aggregate and anonymous information

We may share information that does not identify anyone, such as total numbers of estimates or typical project prices in a state.

Buddy and Contractor Buddy are AI assistants. Their answers are generated by a large language model (currently OpenAI’s GPT-4o) running in Azure OpenAI Service in our own Microsoft Azure account. Buddy’s prices come from our estimating engine, and Buddy is designed to repeat only figures that engine produced, but AI answers can still be wrong or incomplete. They are planning information, not professional advice. Chats are labeled as AI-generated.

• What the model receives. Your question, the last few messages of the conversation, and your project and estimate details. Before a question is sent, we try to remove email addresses, phone numbers and street addresses from it. This filter is automatic and may not catch everything, so please do not type personal details into the chat. For Contractor Buddy and lead briefs, the model receives project details and the homeowner’s city, state and ZIP code, but not names, email addresses, phone numbers or street addresses.
• What we keep. We do not save your chat conversations. The conversation stays in your browser tab and is gone when you leave or reload the page. Our server logs record that a chat request was made, but not what was said.
• Microsoft. Under Microsoft’s terms for Azure OpenAI Service, prompts and answers are not used to train Microsoft’s or OpenAI’s models. Microsoft may keep them for a limited time to detect abuse, as described in its product terms.
• Limits. We limit how many questions can be asked per minute and per day.

BidBud does not set its own cookies and does not use tracking cookies or pixels.

• Contractor sign-in. When a contractor signs in, the browser’s local storage keeps the sign-in tokens, the contractor’s ID, company name, contact name and email address, so the contractor stays signed in. Signing out removes them.
• Admin console. Our own staff’s admin sign-in is kept in session storage, which the browser clears when the tab is closed.
• Third-party services. Google’s mapping software, which our pages load for address suggestions and maps, and Stripe’s payment form on the contractor sign-up page come from those companies, and they may set their own cookies or collect device information under their own privacy policies, for example to prevent fraud.

Because we do not track you across sites, we do not respond differently to browser “Do Not Track” signals or Global Privacy Control signals. To opt out of sharing, see Your US state privacy rights.

• You choose whether to be contacted. You can get an estimate and chat with Buddy without asking to be contacted. If you do not tick the contact box, we do not share your details with contractors.
• Changing your mind. To stop a request that has not yet been claimed, or to have your details removed from a lead, email us at admin@floatingkey.com. We cannot recall details that a contractor has already received; please also tell that contractor directly.
• Texts. You can reply STOP to a text message from a contractor to opt out of that contractor’s texts.
• Emails. Notification emails from BidBud, such as new-lead alerts and quotes sent through BidBud, include an unsubscribe link. You can also email us to unsubscribe. Some account emails, such as claim confirmations, are sent even if you unsubscribe from notifications.
• Contractor accounts. Contractors can change their service radius in the contractor portal, and can email us to change other details, change email preferences or close their account.

Depending on the state you live in (for example California, Colorado, Connecticut, Oregon, Texas, Utah or Virginia), you may have the right to:

• know and access the personal information we hold about you, and receive a copy in a portable format;
• correct inaccurate personal information;
• delete personal information, subject to exceptions allowed by law (for example, keeping a record of your consent);
• opt out of the “sale” or “sharing” of personal information, of targeted advertising, and of certain profiling; and
• appeal a decision we make about your request.

Sales and sharing

Contractors pay BidBud to claim leads. We share a homeowner’s contact details with a contractor only after the homeowner asks to be contacted and agrees to the consent statement. We treat this as a disclosure you direct us to make, not as a sale. Apart from this, we do not sell personal information, and we do not share it for cross-context behavioral (targeted) advertising. We do not knowingly sell or share the personal information of anyone under 16.

If you would like us to stop sharing your information with contractors, email us at admin@floatingkey.com with the subject “Do not sell or share,” and we will stop sharing information that contractors have not already received. You can also simply leave the contact box unticked: an estimate without a contact request is not shared with contractors. We do not currently read Global Privacy Control signals.

Sensitive information

The only sensitive personal information we collect, as some state laws define it, is a contractor’s sign-in email and password, which we use only to let the contractor sign in.

How to make a request

Email admin@floatingkey.com with the subject “Privacy request,” and tell us what you would like us to do. To protect your information, we will ask you to confirm details we already have (for example, by replying from the email address on your request or account) before we act. You can use an authorized agent; we may ask the agent for proof that you authorized them and ask you to confirm your identity with us. We aim to respond within 45 days, and will tell you if we need more time as the law allows.

If we deny your request, you can appeal by replying to our decision with the subject “Privacy appeal.” If you are not satisfied with the result of an appeal, you may contact your state attorney general.

We will not discriminate against you for exercising these rights. For example, we will not deny you the Service or charge you a different price because you made a request.

Categories of personal information

In the last 12 months we have collected the following categories of personal information:

We use each category for the purposes in How we use information, and keep it for the periods in How long we keep information.

We keep information only as long as we need it for the purposes in this policy:

• Estimates without a contact request: not saved.
• Buddy chats: not saved by us.
• Contact requests (leads): kept until they are no longer needed to connect you with contractors and to keep records of the request and your consent, or until you ask us to delete your details (see below). We do not yet delete leads automatically after a set period.
• Contractor accounts: kept while the account is open. To close an account and have its details deleted, email us; we keep records we must keep for tax, accounting or legal reasons.
• Unsubscribe list: kept for as long as we send email, so that we keep honoring your choice. It holds a coded version of the email address, not the address itself.
• Server, security and MCP usage logs: kept for 30 days, then deleted automatically.
• Backups: our database backups are kept for 7 days.

When you ask us to delete your details from a lead, we overwrite your name, email address, phone number, street address and the IP address in your consent record, close the lead, and keep only your city, state, the project details (including the ZIP code) and the record that consent was given.

• Connections to the Service use HTTPS (TLS encryption).
• Homeowners’ names, email addresses, phone numbers, street addresses and consent IP addresses are encrypted in our database with AES-256-GCM, and the whole database is encrypted at rest.
• Encryption keys and passwords for our systems are kept in a managed key vault.
• Contractor passwords are stored only as one-way hashes, and repeated failed sign-ins lock the account temporarily.
• Unclaimed leads show only a summary; full contact details are shown only to the contractor who claimed the lead and to our administrators.
• We limit how often our systems can be called, to reduce scraping and abuse.

No system is perfectly secure, and we cannot guarantee the security of information. If we learn of a security incident that affects your personal information, we will notify you as required by law.

The Service is meant for adults, such as homeowners and contractors. It is not directed to children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, email admin@floatingkey.com and we will delete it.

The Service is intended for homes and contractors in the United States. Our systems are located in the United States, and information is stored and processed there.

We may update this policy from time to time. We will change the “Last updated” date above and, if a change is significant, tell you in a clear way, for example with a notice on the website or by email to contractors. If a change would affect how we share information you gave us before, we will ask for your consent where the law requires it.

Questions or requests about this policy or your information: email admin@floatingkey.com. BidBud AI is operated by FloatingKey LLC.