Privacy Policy

1. Introduction

This Privacy Policy (“Policy”) describes how Catalab Solutions LLP (“Catalab”, “we”, “us”, or “our”), a limited liability partnership incorporated under Indian law, collects, uses, stores, processes, and discloses information in connection with ClearBid and its products and services.

ClearBid encompasses: (a) the ClearBid SaaS Platform – an AI-powered platform for GeM tender preparation (the “Platform”); (b) the GeM Onboarding Service – a done-for-you GeM portal registration service; (c) the Tender Intelligence Subscription – a standalone daily GeM tender alert service; and (d) the Proposal Expert Service – a human expert-led bid document preparation service. Together, these are referred to in this Policy as “ClearBid services.”

By registering for, accessing, or using any ClearBid service, you (“User”, “you”, or “your”) acknowledge that you have read and understood this Policy and consent to the practices described herein. If you are accessing a ClearBid service on behalf of an organisation, you represent that you have the authority to bind that organisation to this Policy.

This Policy is published in compliance with:

• The Information Technology Act, 2000 (“IT Act”) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”);
• The Digital Personal Data Protection Act, 2023 (“DPDP Act”) and rules thereunder, to the extent notified and in force; and
• Any other applicable Indian laws and regulations governing personal data and privacy.

Where global best practices under frameworks such as the General Data Protection Regulation (“GDPR”) are referenced in this Policy, they are incorporated as standards of good practice and not as binding legal obligations, unless the DPDP Act or other applicable law expressly requires equivalent standards.

2. Definitions

For the purposes of this Policy, the following terms shall have the meanings ascribed to them:

3. Information We Collect

ClearBid collects the following categories of information from Users. Collection occurs through direct input, document upload, document submission via WhatsApp or email (for service lines), and automated means during Platform use.

3.1 Account and Identity Information

Collected when registering for the SaaS Platform:

• Full name and professional designation
• Email address and mobile number
• Username and hashed password
• Billing name and address (for GST-compliant invoicing)
• GST Identification Number (GSTIN) of the billing entity

3.2 Organisational and Business Information

• Company name and registered address
• Corporate Identification Number (CIN) or LLP identification number
• Permanent Account Number (PAN) of the entity and/or authorised signatories
• Udyam Registration certificate
• Certificate of Incorporation or equivalent registration document

3.3 Financial and Compliance Documents

The following documents, which may contain Sensitive Personal Data or Information under the SPDI Rules, are collected when uploaded by Users to the SaaS Platform or submitted to Catalab in connection with a service:

• Income Tax returns (ITR) of the entity
• GST returns and GST registration certificates
• Balance Sheet and Profit and Loss statements
• Bank statements (where submitted as part of tender requirements)

3.4 Experience and Credential Documents

• Work orders evidencing previous contracts
• Completion certificates for prior projects
• OEM (Original Equipment Manufacturer) authorisation certificates
• Rental or lease agreements (for premises or equipment)
• Agreements forming part of tender eligibility documentation

3.5 Personnel Information

• Curriculum Vitae (CVs) of key team members and employees
• Scanned signatures of authorised signatories and relevant personnel
• Individual PAN numbers of authorised signatories (where part of uploaded documents)
• Email addresses and phone numbers of individual personnel

3.6 Brand Assets

• Company logo (image file)
• Authorised signatory’s signature (soft copy)
• Company seal (soft copy)
• Blank company letterhead (soft copy)

3.7 Platform Usage and Technical Data

Collected automatically during SaaS Platform use:

• Login timestamps and session metadata
• Records of documents uploaded, AI queries initiated, Credits consumed, and tender workflows completed
• Device type, browser type, IP address, and operating system
• Cookies and similar tracking technologies (see Section 9)

3.8 Payment and Billing Data

Payment transactions for all ClearBid products and services are processed exclusively by Razorpay Software Private Limited (“Razorpay”), a PCI-DSS compliant payment gateway incorporated in India. We do not store credit card, debit card, or netbanking credentials on our servers. We retain:

• Transaction identifiers and payment status records
• Billing name, billing address, and GSTIN (for the purpose of generating GST-compliant invoices)

3.9 Documents Collected for GeM Onboarding Service

When you engage the GeM Onboarding Service, the following documents are collected by Catalab’s team via WhatsApp or email for the purpose of completing your GeM portal registration on your behalf:

• Personal PAN card
• Personal Aadhaar card (see Section 3.11 for Aadhaar collection and deletion policy)
• Business PAN card
• Business/entity Aadhaar (where applicable) (see Section 3.11)
• Certificate of Incorporation or equivalent registration document
• Bank account details and cancelled cheque
• Income Tax returns
• GST registration certificate
• Udyam Registration certificate
• DPIIT Startup certificate (where applicable)

Documents collected for the GeM Onboarding Service are collected and held by Catalab’s team outside the SaaS Platform. They are not stored on or accessible through the Platform.

3.10 Documents Collected for Proposal Expert Service

When you engage the Proposal Expert Service, the following documents may be collected by Catalab’s team via WhatsApp or email for the purpose of preparing bid documents for a specific tender. The exact set of documents required will depend on the tender:

• Personal and/or Business Aadhaar (see Section 3.11)
• Financial statements (Balance Sheet, Profit and Loss accounts)
• Work experience certificates
• Work orders and completion certificates
• Client testimonials and references
• Product and/or service information and descriptions
• Technical specifications
• Photographs of products, premises, or relevant assets
• Any other documents listed under Sections 3.2 through 3.6, as applicable to the specific tender

Documents collected for the Proposal Expert Service are collected and held by Catalab’s team outside the SaaS Platform. They are not stored on or accessible through the Platform.

3.11 Aadhaar Collection and Deletion Policy

Catalab collects Aadhaar card documents (Personal Aadhaar and, where applicable, Business/entity Aadhaar) in connection with the GeM Onboarding Service and the Proposal Expert Service. The following terms apply:

• Aadhaar documents are collected solely via WhatsApp or email communication between the User and Catalab’s team and are not stored on the SaaS Platform or any ClearBid automated system;
• Aadhaar data is retained only for the duration required to complete the relevant service engagement; and
• All Aadhaar documents are permanently deleted from Catalab’s records and communication channels within 7 days of the completion of the relevant service engagement.

3.12 Data We Do Not Intentionally Collect

We do not knowingly collect passwords in plain text, biometric data, caste, religion, political opinions, or health information. Scanned signatures uploaded for tender documentation purposes are stored solely for document generation and are not used for biometric identification or verification.

4. How We Use Your Information

We use the information collected for the following purposes:

4.1 SaaS Platform Services

• To create, populate, and generate tender documents for GeM using information you provide
• To process and extract structured data from uploaded documents using AI-powered analysis
• To score the compatibility between your organisational profile and selected tender criteria (see Section 4.8)
• To display and auto-populate relevant fields in tender workflows
• To enable you to reuse previously submitted data across multiple tenders

4.2 Account and Subscription Management

• To create and manage your SaaS Platform user account
• To process subscription and service payments through Razorpay
• To generate GST-compliant invoices for subscriptions and service engagements
• To communicate with you regarding your account, billing, or service changes

4.3 GeM Onboarding Service

For Users who engage the GeM Onboarding Service, we use the documents and information provided to complete the GeM portal registration process on your behalf. This includes submitting your details and documents directly to the Government e-Marketplace portal. Your documents collected for this service are not transmitted to any AI Provider or automated system.

4.4 Tender Intelligence Subscription

For Users who subscribe to the Tender Intelligence Subscription, we use the business profile information and keyword preferences you provide to identify and deliver daily matched GeM tender alerts.

4.5 Proposal Expert Service

For Users who engage the Proposal Expert Service, we use the documents and information you provide to prepare bid documents for the specified tender. This work is performed entirely by Catalab’s human experts.

4.6 Platform Improvement and AI Model Training

We use data processed through the SaaS Platform, including uploaded documents and AI-generated outputs, to train and improve Catalab’s proprietary AI models. This helps us improve the accuracy, relevance, and quality of tender generation over time.

Important: This use is a distinct purpose from delivering the Platform service. By accepting this Policy, you consent to this use. You may withdraw your consent for model training at any time by submitting a written request to our Grievance Officer (see Section 14). Withdrawal of consent for model training will not affect your access to or use of any ClearBid product or service. Data submitted for the GeM Onboarding Service, Tender Intelligence Subscription, and Proposal Expert Service is not used for AI model training purposes.

4.7 Security, Fraud Prevention, and Legal Compliance

• To detect, prevent, and investigate unauthorised access, fraud, and security incidents
• To comply with applicable laws, regulations, and lawful Government or judicial orders
• To enforce our Terms of Service and other contractual obligations

4.8 Automated Scoring – Disclosure

The SaaS Platform includes a feature that generates a compatibility score between your organisational profile and the eligibility criteria of a selected tender. This score is generated for informational purposes only. It does not constitute a legal determination of eligibility, is not submitted to any Government portal, and cannot be relied upon as a compliance assessment. All submission decisions remain entirely with the User.

4.9 Analytics

We use Google Analytics on both our marketing website and within the SaaS Platform to understand usage patterns, feature adoption, and performance metrics. See Section 9 for details on cookie and tracking choices.

5. Legal Basis for Processing

Under the DPDP Act and applicable Indian law, we process your Personal Data on the following bases:

6. Data Sharing and Third-Party Processors

We do not sell your Personal Data to any third party. We share data only as described in this Section.

6.1 AI Service Providers

The following data sharing with AI Providers applies exclusively to the SaaS Platform. Data submitted in connection with the GeM Onboarding Service, Tender Intelligence Subscription, and Proposal Expert Service is not transmitted to any AI Provider.

The SaaS Platform uses the APIs of the following third-party AI providers to power its document analysis and tender generation functionality. Raw uploaded documents – which may include PAN cards, financial statements, IT returns, GST documents, and other sensitive business data – are transmitted to these providers for processing.

Routing:The Platform uses a fallback mechanism between AI Providers. If one provider is unavailable, the system may route your request to an alternate provider. This routing is managed by Catalab’s backend systems and is not visible to Users in real time. By using the Platform, you consent to your data being processed by any or all of the above AI Providers as necessary to deliver the SaaS Platform service.

6.2 Payment Processor

Razorpay Software Private Limited processes all payment transactions for all ClearBid products and services. Razorpay is a PCI-DSS compliant payment gateway incorporated in India. We share your billing name, billing address, and payment amount with Razorpay. We do not share financial documents or tender data with Razorpay. Razorpay’s privacy policy is available at https://razorpay.com/privacy/.

6.3 Cloud Infrastructure

The ClearBid SaaS Platform is hosted on Amazon Web Services (“AWS”), operated by Amazon Web Services, Inc., a US-based entity. All storage and compute infrastructure is configured to the AWS ap-south-1 region (Mumbai, India). Catalab intends to ensure that all Platform data storage and processing is maintained within this Indian AWS region. However, certain AWS shared infrastructure components may involve cross-region data flows. See Section 11 for cross-border transfer disclosures. Data held by Catalab’s team in connection with the GeM Onboarding Service and Proposal Expert Service is not stored on the AWS Platform infrastructure.

6.4 Analytics

Google Analytics (operated by Google LLC, United States) is used on our marketing website and within the SaaS Platform. Google Analytics collects anonymised usage data, including page views, session duration, feature interactions, and device/browser metadata. This data is processed by Google under Google’s data processing terms. You may opt out of Google Analytics tracking by using the Google Analytics opt-out browser add-on available at https://tools.google.com/dlpage/gaoptout, or by adjusting your cookie preferences as described in Section 9.

6.5 Disclosure Required by Law

We may disclose your Personal Data to Government authorities, regulators, courts, or law enforcement agencies where required to do so by applicable law, judicial order, or in the good-faith belief that such disclosure is necessary to comply with a legal obligation, protect the rights of Catalab or third parties, or prevent fraud or harm.

6.6 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of Catalab’s assets, your Personal Data may be transferred to the successor entity, subject to equivalent or greater privacy protections. We will notify you of any such transfer by updating this Policy or by direct communication.

7. Data Storage and Retention

7.1 Storage Location

All SaaS Platform User data, including uploaded documents, extracted data, activity logs, and account information, is stored on AWS infrastructure configured to the ap-south-1 (Mumbai, India) region. Catalab takes reasonable steps to ensure that primary Platform data storage remains within India. Data held by Catalab’s team in connection with the GeM Onboarding Service and Proposal Expert Service is held in Catalab’s internal communication systems and is not stored on the AWS Platform infrastructure.

7.2 Retention Schedule

7.3 Deletion on Account Closure

Upon SaaS Platform account deletion, Catalab will initiate deletion of your personal data and extracted content within 30 days, subject to the following exceptions:

• Data that Catalab is required to retain under applicable Indian law (e.g., tax records, invoicing data);
• Data that has been anonymised and incorporated into aggregated datasets for AI model training, which cannot be individually identified or reversed; and
• Activity logs retained for security and fraud prevention purposes, up to the retention limit described in Section 7.2.

7.4 Data Used for AI Model Training

Data that has been used to train Catalab’s proprietary AI models may persist in anonymised or aggregated form within the model’s learned parameters. This data cannot practically be isolated or deleted from a trained model. Catalab will not use identifiable Personal Data for model training without consent, and will implement de-identification measures prior to training data ingestion to the extent technically feasible.

8. Security Measures

Catalab implements and maintains security measures commensurate with the sensitivity of the data processed in connection with ClearBid services. These include:

8.1 Technical Safeguards

• Encryption in transit: All data transmitted between Users and the Platform, and between the Platform and AI Providers, is encrypted using TLS 1.2 or higher
• Encryption at rest: Documents and structured data stored on AWS are encrypted at rest using AES-256 or equivalent AWS-native server-side encryption
• Access controls: Access to raw User data (including uploaded financial documents) is restricted to authorised personnel at the founder level within Catalab, on a strict need-to-know basis
• Authentication: User accounts are protected by password-based authentication with hashed credential storage

8.2 Organisational Safeguards

• Catalab limits internal access to Personal Data to personnel with a legitimate operational need
• Third-party AI Providers and infrastructure partners are engaged subject to their published security and compliance terms
• Catalab is working toward industry-recognised security certifications (including ISO 27001 or equivalent) as part of its security maturity roadmap

8.3 Data Breach Response

Catalab is establishing a formal data breach response procedure, including: identification and containment of breaches; assessment of risk to affected individuals; and notification to affected Users and relevant authorities in accordance with requirements under the DPDP Act and applicable law. Until such procedure is formally documented, Catalab commits to notifying affected Users and the Data Protection Board of India (once constituted and notified) of any material data breach without undue delay.

8.4 Limitation of Liability for Third-Party Security

While Catalab takes reasonable measures to protect data in transit to AI Providers and cloud infrastructure, it cannot guarantee the security practices of OpenAI, Anthropic, Google, or AWS. Users acknowledge and accept the residual risk arising from transmission of data to these third-party processors, as disclosed in Section 6.

9. Cookies and Tracking Technologies

9.1 Types of Cookies Used

9.2 Cookie Consent

On your first visit to the Platform or marketing website, you will be presented with a cookie consent notice. Strictly necessary cookies are set automatically. Analytics cookies are only activated upon your explicit consent. You may withdraw or change your cookie preferences at any time through the cookie preference settings available on the Platform or by using browser-level controls.

9.3 Google Analytics

Google Analytics collects anonymised data including page URLs visited, session duration, device and browser type, and approximate geographic location (country/city level). This data is transmitted to and processed by Google LLC in the United States. Google Analytics does not receive or process your uploaded documents, PAN, GST data, Aadhaar, or any other sensitive business information.

9.4 Do Not Track

ClearBid does not currently respond to Do Not Track (DNT) browser signals. Users who wish to limit analytics tracking should use the cookie opt-out mechanism described above or the Google Analytics opt-out tool referenced in Section 6.4.

10. Your Rights as a Data Principal

Under the DPDP Act and applicable Indian law, you have the following rights with respect to your Personal Data. These rights may be exercised through the self-serve account settings on the SaaS Platform, or by contacting our Grievance Officer as described in Section 14.

Response Timeline: Catalab will acknowledge all data rights requests within 3 business days and will endeavour to resolve them within 30 days of receipt. Complex requests may require additional time, and we will communicate any delay promptly.

11. Cross-Border Data Transfers

As described in this Policy, certain categories of your Personal Data are transferred outside India in the course of providing ClearBid services. Data submitted for the GeM Onboarding Service, Tender Intelligence Subscription, and Proposal Expert Service is not transferred to any third-party provider outside India.

Cross-border transfers arise in connection with the SaaS Platform only, and occur to the following entities in the United States:

• OpenAI, LLC – for AI document processing (standard API terms)
• Anthropic, PBC – for AI document processing (standard API terms)
• Google LLC – for AI document processing (Gemini API, standard terms) and analytics (Google Analytics)
• Amazon Web Services, Inc. – as cloud infrastructure provider (primary data residency: ap-south-1, Mumbai, India; residual AWS shared infrastructure may involve cross-region flows)

These transfers are necessary to deliver the SaaS Platform’s core AI-powered functionality. The DPDP Act provides for the Central Government to notify countries to which personal data transfers are permitted. Until such notification is issued and in force, Catalab relies on the necessity of these transfers for contractual performance and on the standard data handling terms published by each third-party provider.

Catalab acknowledges the following residual risks associated with cross-border transfers to AI Providers on standard API plans and discloses them to Users:

• Google’s standard Gemini API terms permit Google to use API inputs for model improvement unless opted out or on an enterprise plan; and
• Catalab does not currently hold signed Data Processing Agreements (DPAs) with any of these three AI Providers.

Catalab is working to address these gaps by migrating to enterprise API plans and/or Vertex AI, and will update this Policy when such changes are implemented.

12. Children’s Privacy

All ClearBid products and services are designed exclusively for business use. They are not directed at, intended for, or designed to be used by individuals under the age of 18. We do not knowingly collect Personal Data from minors.

If you are a parent or guardian and believe that a minor has provided Personal Data to us without your consent, please contact our Grievance Officer immediately at the contact details in Section 14. We will take prompt steps to delete such data upon verification.

13. Changes to This Policy

Catalab reserves the right to update or modify this Privacy Policy at any time. When we make material changes to this Policy, we will:

• Update the “Effective Date” at the top of this document;
• Notify registered Users by email or in-Platform notification at least 14 days before the changes take effect; and
• For changes requiring fresh consent (e.g., a new purpose of processing), seek your affirmative consent before implementing such processing.

Your continued use of any ClearBid service after the effective date of any updated Policy constitutes your acceptance of the revised terms, to the extent permitted by applicable law. If you do not agree with the revised Policy, you should cease using all ClearBid services and request account deletion as described in Section 10.

14. Grievance Officer and Contact

In accordance with the IT Act, SPDI Rules, and the DPDP Act, Catalab has designated a Grievance Officer to address privacy-related complaints, data rights requests, and inquiries related to this Policy.

You may contact the Grievance Officer for any of the following:

• To exercise your data rights (access, correction, erasure, portability, consent withdrawal)
• To raise a complaint about how your Personal Data has been handled
• To report a potential data breach or security concern
• To inquire about or object to the use of your data for AI model training

If your complaint is not resolved to your satisfaction within the timelines above, you may escalate the matter to the Data Protection Board of India, once constituted and operational under the DPDP Act.

15. Jurisdiction and Governing Law

This Policy and all matters arising out of or relating to it shall be governed by and construed in accordance with the laws of the Republic of India.

Any dispute, claim, or controversy arising out of or in connection with this Policy, including any question regarding its existence, validity, or termination, shall be subject to the exclusive jurisdiction of the courts located in Chennai, Tamil Nadu, India.

16. Company Information