Last updated: 11 September 2026.
HexaBid is an AI-assisted platform for analyzing government tender documents and preparing bid packages. This policy explains what personal data we collect, why we collect it, who we share it with, and the rights you have over it.
The service is operated by HexaBid, a product of SnxwFairies, the data fiduciary for the personal data described here. SnxwFairies is a virtual organisation and does not publish a street address; all privacy correspondence goes to the Grievance Officer named in section 10.
Account information — your email address, full name, phone number, and the organization you belong to. Passwords are never stored in readable form; we store only a one-way cryptographic hash.
Documents you upload — tender PDFs, BOQ spreadsheets, corrigenda, and any files you add to your document vault. These may contain your company's commercial information, including pricing, registrations and qualification credentials.
Company qualification data — turnover figures, years of experience, PAN and GST identifiers, MSE and DPIIT registration status, used to assess your eligibility against tender pre-qualification criteria.
Billing records — credit balance, transaction history and payment order references. We do not store your card, UPI or bank details; those are handled entirely by our payment gateway.
Usage and diagnostic data — product analytics events, application error reports, and server logs, used to operate and improve the service.
We use your data to provide the service — analyzing the tenders you upload, evaluating your eligibility, generating bid documents, maintaining your account, processing payments, sending transactional email, and diagnosing faults. We do not sell your personal data, and no AI provider we use trains its models on your data.
To analyze a document or draft a bid document, HexaBid sends the relevant content to a large language model. Our default model is Gemini 2.5 Flash on Google Vertex AI, processed in Google Cloud's Mumbai region (asia-south1). Other models are reached through OpenRouter, whose underlying providers may process data outside India.
Both are engaged under contractual terms that prohibit training on your data. Content is not anonymized or redacted before it is sent to a model, so please do not upload material you are not permitted to share with a processor.
We rely on the following processors to operate HexaBid. Each receives only the data needed for its function:
We may also disclose data where required by law, court order, or a lawful request from a government authority.
Your account and tender records are stored in Supabase (Mumbai) and your uploaded documents in Cloudflare R2. Both are encrypted at rest at the storage layer. Application servers run in Google Cloud's Mumbai region (asia-south1). Some of the processors listed above operate globally, which means limited categories of data — such as analytics events, error reports, email delivery metadata and AI requests routed through OpenRouter — may be processed outside India. We share data with these providers only under their standard data-processing terms.
We retain your account and document data for the lifetime of your account. If you delete your account, or ask us to, we delete your personal data and uploaded documents within 90 days of deletion, unless a law requires us to keep specific records — such as financial records needed to meet tax and accounting obligations — for longer.
Under India's Digital Personal Data Protection Act, 2023, you have the right to access the personal data we hold about you, to have inaccurate data corrected, to request erasure of your data, to raise a grievance about how it is handled, and to nominate another person to exercise these rights on your behalf. You may also withdraw consent where processing relies on it. To exercise any of these rights, or to have your account deleted, contact the Grievance Officer named in section 10.
All traffic is encrypted in transit over HTTPS. Data is encrypted at rest at the storage layer. Passwords are stored only as one-way hashes. Access to your tenders and documents is scoped to your organization and enforced on the server for every request. Document downloads use short-lived signed URLs rather than public links. No system is perfectly secure, but we work to protect your data using industry-standard measures.
In accordance with the Digital Personal Data Protection Act, 2023 and the Information Technology Rules, complaints about the handling of your personal data may be addressed to:
SnxwFairies Grievance Officer
[email protected]
We respond to every grievance within 30 days of receiving it.
We may update this policy as the service evolves. When we make material changes we will update the date at the top of this page and, where the change significantly affects your rights, notify you by email.