Last updated 9 September 2026. This is the whole thing; there is no second document.

Who we are

Bidfeed is a UK email service that reads public procurement notices and sends small businesses a short daily digest. We are the data controller for the personal data described below.

Gudgie Digital Ltd, company number SC880840, registered office: Glasgow, United Kingdom Contact us about anything on this page at hello@bidfeed.co.uk. We answer privacy requests ourselves; there is no ticket system.

What we collect

Your email address	So we can send you the digest and, if you are a subscriber, your receipts and account emails.
Your description of your business	A couple of sentences you write yourself, saying what you do. This is what the filter reasons from.
Your preferences	Sectors, parts of the UK, and the largest contract value you want to see.
A record of what we sent you	Which notices went into which email, and when. This is how we avoid sending you the same tender twice.
Payment status	A Stripe customer and subscription reference and whether the subscription is active. We never see or store your card number.
Email delivery results	Whether an email was delivered, bounced or was marked as spam, from our email provider.
If we contacted you first	Your business email address, your company name, and a link to the public source we found it in — a published contract award notice, your own website, or Companies House. We record the source for every contact so we can show where it came from.

That is the complete list. We do not collect your name unless you put it in an email to us, we do not ask for a phone number, and we do not buy contact lists from anyone.

Cookies and tracking

This website sets no cookies, runs no analytics, and loads nothing from another company — the typeface is served from this site rather than from a font network. There is no tracking pixel in the digest emails. We know an email was delivered because our email provider tells us, not because we watch you open it.

Why we are allowed to hold it

• To perform our contract with you (UK GDPR Article 6(1)(b)) — your email address, business description, preferences, send history and subscription status. Without these there is no service to provide.
• Our legitimate interests (Article 6(1)(f)) — for a business-to-business introduction email sent to a corporate address we found in a public source, and for keeping a record of anyone who has asked us not to contact them. We only ever email business addresses at incorporated companies, we say who we are, and every email has a one-click opt-out we action immediately.
• Legal obligation (Article 6(1)(c)) — keeping records of payments for as long as UK tax law requires.

Who else handles it

Cloudflare	Hosts this website, runs the service, and stores the database. Our database is located in Western Europe.
Stripe	Takes the payment. Your card details go to Stripe, never to us.
Resend	Sends the emails.
Anthropic	Reads the notices and writes the summaries. Your business description and the text of the public notices are sent to Anthropic’s Claude models each morning so the digest can be written. Nothing else about you is sent, and it is not used to train anyone’s model.

These four are our processors. They act on our instructions and cannot use your data for their own purposes. Stripe, Resend and Anthropic process data in the United States, under the UK Addendum to the European Commission’s standard contractual clauses. We do not sell, rent or share your data with anyone else, and there is no advertising network involved at any point.

How long we keep it

• While you are a subscriber: for as long as the subscription runs.
• After you cancel: we delete your email address, business description, preferences and send history 30 days after the subscription ends.
• One exception, kept on purpose: if you unsubscribe or ask us not to contact you, we keep your email address on a suppression list indefinitely. That record exists only so we never email you again, and it is not used for anything else.
• Payment records: kept for six years, because UK tax law requires it.
• If we emailed you and you never replied: we delete the contact record after 12 months.

Your rights

Under UK GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or hand it over in a portable format. You can object to us processing it under legitimate interests, and if you object to marketing contact we must stop, with no argument.

To delete everything: email hello@bidfeed.co.uk with the word “delete”. We do it within 30 days, usually the same day, and we tell you when it is done. You do not have to give a reason and it costs nothing. The unsubscribe link at the bottom of every digest also works on its own, instantly.

Automated decisions

The service scores each notice for how relevant it is to you and writes a one-line verdict. That decides what appears in your email and nothing else. It has no legal effect on you, it is not profiling in the sense the law is concerned with, and you can change what it sees at any time by editing your description and preferences.

Complaints

Tell us first and we will try to fix it. If you are not satisfied you can complain to the Information Commissioner’s Office, the UK’s data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. You do not need our permission and it does not cost anything.

Changes

If we change this notice we will change the date at the top, and if the change is a significant one we will tell subscribers by email before it takes effect.