What rebiddate collects about you, why, who handles it and where, how long we keep it, and how to see it or have it deleted.
Last changed .
rebiddate is run by Helios One Oy, business ID 3596623-5, a limited company (osakeyhtiö) in Finland. Helios One Oy decides what is collected and why, so the EU's data protection law (GDPR) covers what we keep about you, wherever you are. Sources: Finnish Trade Register (YTJ) ; EU General Data Protection Regulation, Art. 3, 12, 15–17
US mailing address: 3075 Clay St, San Francisco, CA 94115. Email: hello@rebiddate.com
| What | Why | How long |
|---|---|---|
| Your email address | To send the Monday email, sign you in with a one-time code, and answer you. | While your account is open. |
| Your metro and what you search for (ZIP, city or company) | To build your feed and to see which areas people want next. | While your account is open. Searches are also kept as analytics events. |
| How you found us: the campaign tags on the link (UTM), the site you came from, the page you landed on (with any ad click ID in its address) and when | To know which messages are worth sending. Kept in two cookies on your browser and on your account. | Cookies: 400 days. On your account: while it's open. |
| How you use the site, the app and the email: pages, clicks, what you type into our forms, opens and clicks of the Monday email, and session recordings | To see where people get stuck and fix it. | Recordings: deleted after 30 days. Other events: no set end date. |
| Your IP address and browser type | To tell people from bots and link scanners, and to estimate your city. | Kept with the analytics events. |
| Wrong-record reports, feedback (with any screenshot you attach) and call requests | So we can check the record, fix it, and get back to you. | Until you ask us to delete them. |
| If you subscribe: your plan, its status and Stripe's customer and subscription IDs | To know what you've paid for. Your card, billing address and invoices stay with Stripe. | While your account is open. Stripe keeps its payment records under its own rules. |
The site and the app send analytics to PostHog, through our own address (/ingest) to PostHog's EU cloud at eu.i.posthog.com. The data sits in PostHog projects that
belong to Helios One Oy. Source: PostHog data storage
What is recorded:
On this site and in the app, PostHog records what happens on the screen: the pages, what was shown, where you moved, clicked and scrolled, and what you typed into our forms. That includes a ZIP code or company you look up, your email address, and anything you write in a Wrong record? report, a call request or feedback. Typed text isn't hidden.
One field is left out: the box where you type a sign-in code. It carries PostHog's ph-no-capture class, so recordings never show it. Card numbers are typed only on
Stripe's own Checkout page, which isn't part of our site, so we never record them. Source: PostHog session replay privacy controls
A recording also keeps the browser console and the page's requests to our servers, with what was sent and what came back, such as the search you ran. Sources: PostHog network recording ; PostHog console log recording
Recordings are deleted after 30 days, the setting on our analytics account.
Resend sends our emails: sign-in codes, invites, the Monday email and the account emails (welcome, a day-7 check-in, "fixed what you reported" and trial ending). It tells us whether each one was delivered or bounced. A hard bounce or a spam complaint stops all our email to that address. Source: Resend regions and data storage
The Monday email counts its own opens and clicks: it loads a tiny image from our server, and its links pass through our server on the way to the page. Replies to any of these emails go to a co-founder's inbox.
The Monday email and the emails we send on our own, like the welcome email and the reminder before your trial ends, have an unsubscribe link at the foot: it opens a page where one press unsubscribes you. Sign-in codes go out only when you ask for one, and an invite only when a teammate adds you, so those two don't have one.
When you subscribe, you pay on Stripe's own Checkout page, and you change your card, see invoices or cancel on Stripe's billing page. Stripe collects your card details and, when it needs it, your billing address. Card data never touches our servers. We keep your plan, its status and Stripe's IDs for your customer record and subscription. Sources: Stripe Checkout ; Stripe privacy policy
These companies run parts of rebiddate for us. Several keep data in the United States. The same list, with how we protect it, is on Security.
Ashburn, Virginia, US (Fly region iad)
Runs this site, the app and the weekly data run on its servers. It sees your IP address with each request. Source: Fly.io regions (iad)
United States (AWS us-east-1, N. Virginia)
Our database and file storage: your account, your metro, the emails you give us, wrong-record reports, call requests, feedback with its screenshots, which of our emails you got, opened or clicked, and your plan. Source: Convex deployment regions
EU Cloud, Frankfurt, Germany (eu.i.posthog.com)
Analytics and session recordings for the site and the app, in PostHog projects that belong to Helios One Oy. Source: PostHog data storage
United States (Resend region us-east-1, N. Virginia)
Sends our emails: sign-in codes, invites, the Monday email, the four account emails (welcome, a day-7 check-in, "fixed what you reported" and trial ending) and our own alert emails. It tells us whether each one was delivered or bounced. Source: Resend regions and data storage
Stripe's own systems (Helios One Oy's Stripe account)
Takes payment on its own Checkout page and runs the billing page where you change or cancel your plan. Your card goes to Stripe, never to our servers. Source: Stripe Checkout
Google's own data centers
The co-founder inbox our alert emails go to: sign-ups, wrong-record reports, call requests and feedback, with what you wrote. Replies to our emails go there too.
Global bucket: each file is kept near where it was written and copied to other regions when read there
File storage for the weekly data run: our copies of the public records and each run's results. Nothing about you. Source: Tigris bucket locations (global)
We find grounds, tree and snow firms in public sources: state and local license files, agency and association lists, and the firm's own website. From them we keep the firm's name, the name and role of the person who runs it, their work email and the area the firm works in, so we can send one email about the public contracts near them.
If you'd rather not hear from us, reply "no" to that email, or write to hello@rebiddate.com.
You can ask for a copy of what we keep about you, ask us to correct it or delete it, or object to analytics about you. Email hello@rebiddate.com from the address on your account, and we answer within one month. Source: EU General Data Protection Regulation, Art. 3, 12, 15–17
Deleting removes your account, your metro and searches, your reports and requests, your recordings and the analytics events tied to you.
We use your data to give you the service you signed up for (your account, sign-in, the Monday email and billing), and because we have a legitimate interest in seeing how rebiddate is used, keeping it working and free of abuse, and telling firms about the public contracts near them.
If you think we've got it wrong, you can also complain to Finland's data protection authority. Source: Office of the Data Protection Ombudsman (Finland)
The rules for using rebiddate are in the Terms.