Privacy Policy

We collect information you provide directly to us, including:

• Email Address: when you create an account or subscribe to our service.
• Name and Contact Information: if you voluntarily provide it through forms or inquiries.
• Payment Information: processed securely by our payment provider (Stripe). We do not store full card details on our servers.
• Usage Data: information about how you interact with our website (pages visited, time spent, clicks, etc.).
• Device Information: browser type, operating system, IP address, and device identifiers.
• Communication Data: records of any communications you have with us.

When you visit our website, we automatically collect certain information using cookies and similar tracking technologies:

• Cookies: we use cookies to remember your preferences and keep you signed in.
• Analytics: we use Google Analytics and PostHog to understand how visitors use our site.
• Conversion Tracking: we track conversions using Google Ads and other advertising platforms.
• Bot Protection: we use security measures to detect and prevent malicious activity.

We use the information we collect for the following purposes:

• Providing, maintaining, and improving our services
• Processing payments and managing your subscription
• Sending you service and marketing communications (marketing with your consent)
• Responding to your inquiries and providing customer support
• Analyzing website usage patterns and optimizing experience
• Measuring advertising effectiveness and campaign performance
• Detecting and preventing fraud and security threats
• Complying with legal obligations and enforcing our terms

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the Internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

We share information with third-party service providers to support our operations:

• Payments: Stripe processes subscription payments.
• Authentication & Database: Supabase stores account data and manages sign-in.
• Email: Resend delivers transactional and service emails.
• Analytics: Google Analytics and PostHog for usage analysis.
• Advertising: Google Ads and similar platforms for advertising and conversion tracking.
• Hosting: our infrastructure runs on dedicated servers (Hetzner).
• ChatGPT plugin: when you use the GovContractScout plugin, OpenAI's ChatGPT client transmits your search requests to our servers. See Section 11.

We do not sell your personal information to unaffiliated third parties for their marketing purposes.

You have the following rights regarding your personal information:

• Access: request a copy of the personal information we hold about you.
• Correction: request that we correct or update inaccurate information.
• Deletion: request that we delete your personal information.
• Opt-Out: opt out of marketing communications at any time.
• Cookie Management: control cookie preferences through your browser settings.

We retain personal information only as long as needed for the purposes described in this policy:

• Account data (email, profile): kept while your account is active and as long as needed to provide the service; deleted when you close your account.
• Plugin connection credentials: authorization codes expire after 10 minutes; refresh tokens are valid up to 30 days and rotate on each use. Tokens are deleted when you disconnect the plugin or when we revoke the connection.
• API request logs: retained up to 13 months for quota metering, abuse detection, and security, then deleted or aggregated.
• Search queries: parameters you send through the plugin or API are processed to return results and are retained within the request logs described above. We do not receive or store ChatGPT conversation transcripts.
• Payment data: processed by Stripe; we do not store full card details on our servers.

If you are a resident of the European Union, GDPR applies to our processing of your personal data. If you are a resident of California, CCPA provides certain rights and protections.

To exercise your rights under GDPR or CCPA, please contact us at [email protected]. We will respond within the timeframe required by applicable law.

Our services are not directed to children under 13 years of age, and we do not knowingly collect personal information from children. If we become aware that we have collected information from a child under 13, we will promptly delete such information.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. We will notify you of material changes by updating the "Last updated" date and posting the revised policy on our website.

When you use the GovContractScout plugin inside ChatGPT, you first sign in with your GovContractScout account. We link the connection to that account and use it to authenticate every tool request.

Through the plugin we process:

• Your search requests: the states, NAICS codes, keywords, and business profile details you provide, transmitted from ChatGPT to our servers to find and score contracts.
• Connection credentials: short-lived access tokens issued during sign-in, plus an account API key issued by GovContractScout that the connection uses. Both are stored in encrypted form only to keep your connection working, are scoped to your account, and are revoked when you disconnect the plugin.
• Usage data: tool calls are metered under the same per-account limits as our API and appear in your account usage.

We do not store ChatGPT conversation transcripts or chat history. You can disconnect the plugin at any time from your ChatGPT settings, which revokes the connection credentials on our side.

Questions about this policy? Email [email protected]. A real person answers.