Provider: Rhino Bid LLC ("RhinoBid," "we," "us," or "our")
Security reports: support@rhinobid.com
Suggested subject: Security Report — RhinoBid
1. Purpose and relationship to our other policies
This policy explains our approach to protecting RhinoBid accounts and information, how users can help protect their access, and how to report suspected security problems involving our supported mobile apps, website, web app, and related integrations.
We use reasonable administrative, technical, and physical safeguards designed to protect personal information and support account security. Safeguards depend on the information involved, the feature, the risks, and the relevant provider arrangements. No transmission or storage system is completely secure, and no service can guarantee prevention of every incident.
The RhinoBid Privacy Policy explains collection, use, sharing, permissions, retention, and privacy rights. The Terms of Service and applicable supplier, payment, and subscription agreements continue to govern their subjects. This policy does not expand content licenses or AI-training permissions, change payment fees or refunds, create a new liability cap, or waive legal rights. A security limitation does not excuse obligations imposed on RhinoBid by law or an applicable agreement.
This is an information-security policy, not certification of the safety, quality, licensing, or performance of a contractor, supplier, product, floor plan, or estimate.
2. Accounts, permissions, and sensitive changes
Use an individual authorized login and protect its credentials. Business administrators should grant only the permissions a person needs, review access when responsibilities change, and promptly remove access that is no longer authorized. Do not share a login to avoid user limits or give another person unrestricted access to your business workspace.
Our account and workspace access controls are intended to restrict private records to authorized users and permitted service processing. Sensitive recovery, ownership, access, or financial changes may require proportionate verification. Public information, such as a supplier's phone number, pickup address, or invoice number, is not by itself sufficient proof of authority. A successful login is not conclusive proof that every action was authorized.
Where password sign-in is used, passwords are stored in hashed form, as described in the Privacy Policy. Use a strong, unique password and any additional security protections actually available for your account. Secure the email account and devices used to access RhinoBid as well.
RhinoBid Support will not ask you to send your password, sign-in or recovery code, Apple Account password, banking password, secret API key, or full payment-card credentials by email, chat, or telephone. Enter codes only in the legitimate sign-in or verification flow you initiated. If evidence is necessary, we will identify an appropriate verification or transfer process.
3. Mobile, web, and shared project information
RhinoBid's supported mobile apps and web app use your account and relevant business workspace. Supported saved floor plans, scans, designs, estimates, photographs, documents, and project updates can be uploaded and made available across connected devices. For example, a floor plan scanned and saved on your phone can also be available in the web app through the same authorized account and workspace.
Availability depends on successful upload and synchronization. Unsaved or device-only work is not available elsewhere merely because you are signed in. Connectivity, processing, and conflicting edits can delay updates, and supported functions may differ across devices. Check that important work is saved before removing a local copy or leaving the device.
Authorized administrators, team members, and recipients can access records according to their permissions and your sharing choices. Select the correct business workspace and recipients. Depending on the sharing method, a forwarded link may let another person view the linked information; use available access controls and contact support when access needs review. Downloaded or independently saved copies may remain with their recipients after access to a live link changes.
Account synchronization does not make private work public or promise end-to-end encryption. RhinoBid and its providers may process information for the authorized service, support, security, and other purposes described in the Privacy Policy. Saving a scan does not itself authorize advertising or AI-model training. This policy does not claim that only the person holding a device can ever access synchronized content.
4. Public supplier information and private records
Supplier listings intentionally display approved product details and designated business information, including pickup addresses, phone numbers, and hours. A home address or personal number may become visible if the supplier designates it for public pickup or contact. Only submit information you have authority to publish.
Private customer records, unpublished supplier drafts, identity documents, bank information, and confidential verification evidence are not public listing content merely because a supplier uses RhinoBid. Access for RhinoBid personnel and service providers is limited to authorized purposes described in our Privacy Policy and the applicable agreements, not unrestricted access for unrelated use.
Suppliers control their source product facts and prices. Suspected unauthorized edits, false contact details, suspicious links, and misuse of photographs should be reported to support. We may request corrections or restrict a listing under the supplier agreement; moderation does not certify inventory, ownership, product safety, or fulfillment.
Editing or removing a listing affects future display and use as described in the supplier agreement and Privacy Policy. Previously issued project documents may retain historical content. A historical copy is not confirmation of current stock, pricing, or a new right to advertise withdrawn content.
5. Payment tools and Apple subscriptions
Stripe invoice payments and web subscriptions. Contractor and supplier invoice payments use the Stripe integration described in the payment agreements. The collecting business is the seller for its invoice. Stripe also processes direct web subscriptions purchased from RhinoBid; those subscription purchases are separate from payments to a contractor or supplier.
Payment credentials should be entered only through the designated payment flow. RhinoBid does not store full payment-card numbers on its servers, as stated in our Privacy Policy, but does process relevant transaction references, limited payment-method information, verification status, and other authorized payment records. Do not place full card numbers, security codes, bank credentials, or identity documents in project notes, public fields, or ordinary support attachments.
A refund, account change, or other sensitive payment instruction must come through an authorized process. Support messages, screenshots, or a browser success page alone should not be treated as conclusive proof of payment or authority. Stripe processing, payment confirmation, and bank payout are different stages; a delayed payout does not mean a customer must pay an otherwise completed transaction again.
Apple-billed subscriptions. Apple handles subscriptions purchased through Apple In-App Purchase. RhinoBid uses relevant purchase-verification, subscription-status, and account-linking information to administer access. We do not ask for your Apple Account password. Using an eligible Apple subscription through the same RhinoBid account on the web does not itself create a separate Stripe subscription or transfer Apple's payment credentials to RhinoBid.
Contact RhinoBid Support for payment-tool or subscription-access problems. Contact the seller for its products, work, or purchase-refund eligibility. Apple-billed cancellation and refund requests use Apple's supported processes. Report suspected unauthorized payments promptly to your bank or payment provider as appropriate; do not wait for RhinoBid to finish investigating before exercising a time-sensitive right.
Use of Stripe or Apple does not remove RhinoBid's own security obligations, certify the seller, insure the purchase, or make RhinoBid an escrow service.
6. AI processing and permitted improvement use
Requested AI features may process relevant inputs through a provider as explained in the Privacy Policy and feature notice, with required permission. Uploading a document or scanning a room is not an instruction to analyze every file in the account. Private records must not become public catalog results merely because an AI feature can retrieve information.
Eligible project scope descriptions may be used to improve RhinoBid's own systems only within the Privacy Policy's permissions, safeguards, and choices. Those limits include minimization of unnecessary identifiers, restricted access, prior-data permissions, retention controls, and the available exclusion process. They do not automatically include entire estimates, customer contact records, payment information, photographs, floor plans, or LiDAR scans.
The restriction on training third-party AI models remains unchanged. Supplier content is subject to its separate license. Instructions hidden in a product listing, document, or AI response do not authorize account access, data disclosure, a payment, or a change to your permissions. Report a result that appears to expose another business's private information without exploring or copying more of that information.
7. Service providers, communications, and security review
RhinoBid uses providers for functions such as hosting, storage, authentication, communications, payments, subscription verification, and relevant AI processing. Providers acting on our behalf receive information for authorized purposes under appropriate use and security restrictions. Some providers, including Stripe and Apple, also have independent responsibilities described in their notices.
Provider selection and configuration are part of our security responsibilities. A provider's certification or security statement does not automatically certify RhinoBid, cover every integration, or eliminate our duties. This policy does not claim a particular audit, certification, independent penetration-test result, or compliance status for RhinoBid.
Use official RhinoBid apps and the HTTPS web service reached from our official website. Do not enter credentials after a browser or device warns that a site's identity cannot be verified. A padlock or HTTPS address alone is not proof that an unfamiliar payment request or business is legitimate. Check the identity of the seller and the destination of links independently when something appears unusual.
We may review relevant authentication, access, transaction, diagnostic, and security records to investigate misuse and protect the service, within the Privacy Policy's limits. Security work does not authorize unrelated surveillance, unrestricted retention, or new use of project content for advertising or training. We assess reported weaknesses and prioritize appropriate corrective action according to risk; we do not promise detection of every attack or uninterrupted availability.
8. Retention, deletion, recovery, and device safety
Retention and deletion follow the Privacy Policy and applicable law. Necessary financial, consent, security, dispute, and historical project records can have different retention needs. Account suspension is not account deletion, and required retention is not permission to keep every category indefinitely.
Deleting a live file or changing its access may not immediately remove every cached, backup, or independently retained copy. Retained copies remain limited to their authorized purposes and applicable removal requirements. They are not a basis for new advertising or unapproved training.
Synchronization is not a promise of unlimited backups, permanent version history, immediate restoration, or recovery of every lost or deleted record. Keep independent copies appropriate to your business and legal obligations, using available export or download features. This recommendation does not transfer RhinoBid's own security or agreed recordkeeping duties to you.
Protect phones, tablets, computers, and the associated email account with device locks and supported updates. Sign out of shared devices. If a device is lost or an account appears compromised, use available recovery and session controls and contact support promptly. Do not erase relevant evidence or repeatedly initiate financial actions while trying to diagnose a suspected incident.
9. How to report a security concern
Email: support@rhinobid.com
Subject: Security Report — RhinoBid
Use this route for suspected unauthorized account access, exposed private records, cross-business access, altered supplier or payout details, suspicious RhinoBid messages, or a potential vulnerability in our software. You do not need to prove a breach or perform further testing before making a report. A person without a RhinoBid account may report a concern.
Include a concise description of what happened; the affected app, page, or feature; approximate date, time, and time zone; relevant business, project, or transaction references you are authorized to provide; and a safe contact method. Screenshots or steps that demonstrate the issue can help, but remove unrelated personal information and secrets. Say whether the issue appears ongoing or may involve someone else's data.
Do not email passwords, sign-in codes, full payment credentials, private keys, or bulk copies of exposed records. A full payment or document link may contain an access token; initially provide a redacted reference or description. Ask for an appropriate transfer method when evidence itself is sensitive. Do not put incident details in public supplier listings or customer reviews as a substitute for a security report.
If your usual account or inbox may be compromised, tell us through a safe contact channel so that recovery can be verified appropriately. Privacy requests, appeals, and legal notices may be sent to Legal@rhinobid.com. Routine purchase or workmanship disagreements belong with the seller, but a suspected account or payment-security problem should still be reported.
10. Our handling of suspected incidents
We assess credible reports, investigate as appropriate, and take reasonable steps to contain and address confirmed risks. Depending on the circumstances, steps may include restricting affected functionality, reviewing permissions or records, helping verify account recovery, coordinating with a provider, preserving necessary evidence, and correcting a vulnerability.
We may need to act without advance notice to prevent harm or meet legal requirements. A protective restriction is not a conclusion that the user committed wrongdoing and does not authorize confiscating funds or disregarding privacy or refund rights. Information about an investigation is shared only with appropriate parties; we may be unable to disclose details that expose another person's information or increase security risk.
When an incident triggers a legal or contractual notification obligation, we provide the required notices within the applicable time requirements. A support ticket, routine status update, or third-party referral does not replace those notices. We do not make every incident subject to one universal notification period or condition required notices on a completed investigation.
We prioritize reports according to potential impact and urgency. This policy does not promise a particular acknowledgment time, repair deadline, around-the-clock live staffing, or payment for a report. These limits do not excuse prompt action or notification required by law or an applicable agreement.
11. Responsible reporting and testing boundaries
We welcome good-faith reports and will not suspend an account or retaliate solely because a person responsibly reports a suspected problem or makes a lawful complaint. Reporting a concern does not require first agreeing that RhinoBid is free from responsibility or waiving a legal right.
This policy provides a reporting channel, not blanket authorization to scan, probe, exploit, or penetration-test our systems. Obtain prior written authorization from RhinoBid specifying scope before conducting active security testing beyond ordinary permitted use. Any permission applies only to the identified systems and activities we are authorized to approve; it does not authorize testing Stripe, Apple, hosting providers, suppliers, or another person's account.
Do not disrupt availability, use deception to obtain credentials, test using real unauthorized payments, install persistent access, or alter or download other users' records to prove impact. If you unexpectedly encounter private information, stop the activity, do not investigate further, and report the minimum details needed for us to locate the issue. Do not publicly disclose or retain unnecessary copies of that information.
Please give us a reasonable opportunity to investigate and coordinate any public technical disclosure so that users are not exposed to avoidable harm. This request is not an indefinite secrecy requirement and does not restrict legally protected reporting, required disclosures, or access to legal advice. A report alone does not create a bug-bounty reward, a testing contract, or a legal safe harbor binding third parties.
12. Updates and contact
We may update this policy as the service, risks, and security practices change. We will revise the dates and provide any notice or obtain any acceptance required by applicable law or existing agreements. A technical security improvement does not authorize a materially broader data use or silently weaken an existing privacy, content, billing, or notice commitment.
Rhino Bid LLC
Security reports, account recovery, and product support: support@rhinobid.com
Privacy requests and legal notices: Legal@rhinobid.com
Related notice: RhinoBid Privacy Policy
The Terms of Service and feature-specific policies remain available through the relevant service. This Security Policy does not replace them or excuse RhinoBid's duties concerning its own systems and conduct.