Should You Bid

Privacy Policy

Last updated: October 21, 2026.

This policy explains what Aeroswipe LLC ("we," "us," "our") collects when you use Should You Bid at shouldyoubid.com (the "Service"), why, and what you can do about it. It includes disclosures required by the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA) and, where applicable, the EU/UK General Data Protection Regulation (GDPR).

We sell bid analysis reports. We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

1. What we collect

Information you give us

  • Account information. Your email address, and the account identifier assigned by Amazon Cognito when you register. If you set a display name, that too.
  • Listings you submit. The web address of each listing you ask us to analyse, and any note you add to it.
  • Support correspondence. Anything you write to us by email.

Information created by using the Service

  • Reports. The analyses we generate for you, stored against your account so you can read them again.
  • Usage and billing records. How many reports you have run, which credits were consumed and when, and whether your free report has been used.

Information collected automatically

  • Log data. IP address, browser user agent, pages requested and timestamps, kept for security, abuse prevention and debugging.
  • Cookies. See Section 5.

Information we do not collect

  • We never receive your full payment card number. Card details go directly to Stripe. We store only Stripe's customer and transaction identifiers and the information Stripe returns to us, such as the last four digits and card brand.
  • We do not ask for government identifiers, and you should not send them to us.

2. Automated analysis, and what is sent where

This is the disclosure that matters most, so it gets its own section.

When you submit a listing, our servers fetch that public page. The contents of that page — its description, its specifications, its comment thread and its photographs — together with publicly available comparable sales data, are sent to a large language model running on Amazon Bedrock in order to produce your report. The models used are Anthropic's Claude models, accessed through Amazon Bedrock in the AWS us-east-2 region.

When you run a car search, the same thing happens with the brief instead of a listing. The description you type is sent to the model, as are the listings we find for you — their titles, prices, mileages and photographs. Your brief is also used to build search URLs that are requested from third-party listing sites; those sites therefore see the vehicle, price range and search area you asked about, and the request comes from our servers rather than from your browser. We do not send them your name, your email address or your account identifier.

Three things follow:

  • Anything you type into a listing note or a search brief is included in what we send to the model. Do not put sensitive personal information there.
  • That content is not used to train models. Amazon Bedrock does not use inputs or outputs submitted through it to train any model, and Bedrock does not share them with model providers. Our account is configured to use Bedrock only.

Reports and searches are produced entirely automatically. No human at Aeroswipe LLC reads your listings, briefs or reports in the ordinary course of operating the Service. We may look at a specific record when you ask us for support, or when we are investigating abuse or a technical fault.

3. Why we use it, and our legal bases

  • Create and operate your account — to give you the Service. Legal basis: contract.
  • Generate and store reports and car searches — to deliver what you paid for. A search brief is stored with your account so that re-running it is free. Legal basis: contract.
  • Take payment through Stripe — to charge for reports and searches. Legal basis: contract.
  • Send service email (receipts, password resets) — to operate the account. Legal basis: contract.
  • Keep logs, rate limit and prevent abuse — to keep the Service working and unbilled by strangers. Legal basis: legitimate interests.
  • Understand aggregate usage — to decide what to build. Legal basis: legitimate interests.
  • Meet tax, accounting and legal obligations — because we must. Legal basis: legal obligation.

We do not use your information for advertising, and we do not profile you for automated decisions that produce legal or similarly significant effects about you.

4. Who we share it with

We share personal information only with service providers who process it on our behalf, under contract, for the purposes above:

  • Amazon Web Services — hosting, storage, databases, authentication (Cognito), email delivery, and model inference (Bedrock). Primarily the us-east-2 region in the United States.
  • Stripe, Inc. — payment processing. Stripe is an independent controller of the payment data it collects and applies its own privacy policy.

We may also disclose information if required by law, to enforce our terms, or to protect the rights and safety of users or the public. If the business is sold or merged, information may transfer as part of that transaction; we will say so beforehand where we are able.

We have not sold or shared personal information in the preceding twelve months, as those terms are defined by the CCPA/CPRA.

5. Cookies and similar technologies

We use a minimal set of first-party cookies. There is no third-party advertising, no cross-site tracking and no advertising pixel on this Service.

  • Session cookies set by Amazon Cognito — keep you signed in. Duration: the session, or until you sign out.
  • ww_fp — a random identifier for an anonymous browser, set at the edge on first visit. Used to meter free usage and to prevent abuse before you have an account. Not linked to personal information unless you create an account. Duration: 1 year.

Blocking the session cookies will sign you out. Blocking ww_fp simply means a new identifier is assigned on your next visit.

6. How long we keep it

  • Account information — while your account exists, and up to 90 days after you close it.
  • Reports — while your account exists, so you can read them again. You can delete an individual report at any time.
  • Billing records — up to seven years, because tax and accounting law requires it.
  • Logs — generally up to 90 days, longer for a record tied to an investigated incident.

7. Your rights

Everyone. You may ask us to show you what we hold, correct it, delete it, or send you a copy. Email support@shouldyoubid.com and we will respond within 30 days. We will not treat you worse for asking.

GDPR / UK GDPR. You additionally have rights of access, rectification, erasure, restriction, portability, and objection to processing based on legitimate interests. Where we rely on consent you may withdraw it at any time. You may complain to your supervisory authority.

California (CCPA/CPRA). You have the rights to know, delete, correct, and to opt out of sale or sharing — though as stated we do neither. We do not use or disclose sensitive personal information for purposes requiring a right to limit. You may use an authorised agent.

Note that we may need to keep some records, such as billing history, to meet a legal obligation even after you ask for deletion. We will tell you if that applies.

8. Security

Data is encrypted in transit and at rest using AWS-managed encryption. Access to production systems is restricted and authenticated. Passwords are handled by Amazon Cognito and are never visible to us. No system is perfectly secure, and we cannot guarantee absolute security; if a breach affects your personal information we will notify you as the law requires.

9. International transfers

We operate in the United States and process information there. If you use the Service from outside the United States, you understand that your information will be transferred to and processed in the United States, which may not provide the same protections as your home jurisdiction. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses with our processors.

10. Children

The Service is not directed to children under 13 and we do not knowingly collect their personal information. Accounts require you to be 18 or older. If you believe a child has given us information, write to support@shouldyoubid.com and we will delete it.

11. Changes to this policy

We may update this policy. Material changes will be reflected in the date above and, where we reasonably can, notified to you.

12. Contact

Aeroswipe LLC — support@shouldyoubid.com Privacy, GDPR and CCPA requests: support@shouldyoubid.com

See also our Terms of Service.