Privacy Policy

1. Information We Collect

We collect information in several ways depending on how you interact with the Service:

1.1 Information You Provide

• Account information: Email address, name (if provided), and authentication credentials when you create an account
• Company profile: Business name, NAICS codes, keywords describing your capabilities, set-aside certifications, and other profile data you enter
• Communication data: Any information you provide when contacting us, including support requests and feedback
• Payment information: Billing details processed through our third-party payment processor (Stripe). We do not store full credit card numbers on our servers.

1.2 Information Collected Automatically

• Usage data: Pages visited, opportunities viewed, searches performed, features used, and interactions within the Service
• Device information: Browser type, operating system, device type, screen resolution, and language preferences
• Log data: IP address, access times, referring URLs, and server response codes
• Cookies and similar technologies: As described in our Cookie Policy

1.3 Information from Third Parties

• Authentication providers: If you sign in using Google, we receive your email address and basic profile information as authorized by your Google account settings
• Public data sources: We aggregate publicly available federal contracting data from SAM.gov and other government databases

2. How We Use Your Information

We use the information we collect for the following purposes:

• Provide the Service: Match you with relevant federal contracting opportunities, deliver daily digest emails, send deadline reminders and amendment alerts
• Improve and personalize: Analyze usage patterns to improve our AI matching algorithms, search functionality, and user experience
• Communications: Send you transactional emails (account confirmation, password resets), service announcements, and product updates
• Customer support: Respond to your inquiries, troubleshoot issues, and provide technical assistance
• Security: Detect, investigate, and prevent fraudulent, unauthorized, or illegal activity
• Legal compliance: Comply with applicable laws, regulations, and legal processes
• Analytics: Generate aggregated, anonymized analytics about Service usage to guide product development

3. How We Share Your Information

We do not sell, trade, or rent your personal information to third parties. We may share information only in the following limited circumstances:

• Service providers: We share information with trusted third-party vendors who assist us in operating the Service, including cloud hosting (Vercel, Supabase), email delivery, payment processing (Stripe), and analytics (Amplitude). These providers are contractually obligated to use your data only to perform services on our behalf.
• Legal requirements: We may disclose information if required by law, subpoena, court order, or governmental regulation, or when we believe disclosure is necessary to protect our rights, enforce our Terms, or ensure the safety of our users.
• Business transfers: In connection with a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of the transaction. We will provide notice before your information becomes subject to a different privacy policy.
• With your consent: We may share information with third parties when you explicitly consent to such sharing.

4. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS/SSL
• Encryption of sensitive data at rest
• Role-based access controls limiting employee access to personal data
• Regular security assessments and monitoring
• Secure authentication via Supabase Auth with support for magic links and OAuth

While we strive to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security and encourage you to use strong, unique passwords and protect your account credentials.

5. Data Retention

We retain your personal information for as long as your account is active or as reasonably needed to provide the Service to you. We may also retain certain information as necessary to comply with legal obligations, resolve disputes, enforce our agreements, and for legitimate business purposes such as analytics and record-keeping. When we no longer have a legitimate need to process your information, we will delete or anonymize it.

If you request account deletion, we will delete your personal data within 30 days, except where retention is required by law or for legitimate business purposes (e.g., billing records required for tax compliance).

6. Your Rights and Choices

Depending on your location and applicable law, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete personal information
• Deletion: Request deletion of your personal information, subject to certain legal exceptions
• Data portability: Request an export of your data in a structured, machine-readable format
• Opt-out of marketing: Unsubscribe from marketing emails by clicking the "unsubscribe" link in any marketing email or updating your notification preferences in account settings
• Opt-out of analytics: You can opt out of analytics tracking through your browser settings or by using browser extensions that block tracking scripts

To exercise any of these rights, please contact us at privacy@fedoverwatch.com. We will respond to your request within 30 days.

7. California Privacy Rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights regarding your personal information. You have the right to:

• Know what personal information we collect about you and how it is used and shared
• Request deletion of your personal information
• Opt out of the sale of your personal information (we do not sell personal information)
• Not be discriminated against for exercising your privacy rights

8. International Users

The Service is operated from the United States. If you access the Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States where our servers are located and our central database is operated. By using the Service, you consent to the transfer of your information to the United States.

9. Children's Privacy

The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child, we will take steps to delete such information promptly.

10. Third-Party Services

Our Service integrates with or links to the following categories of third-party services, each with their own privacy practices:

• Supabase: Database hosting and authentication
• Vercel: Application hosting and edge delivery
• Stripe: Payment processing
• Amplitude: Product analytics
• Google: OAuth authentication
• Resend: Transactional email delivery

We encourage you to review the privacy policies of these third-party services to understand how they handle your information.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. If we make material changes, we will notify you by email or through a prominent notice on the Service at least 30 days before the changes take effect. We encourage you to review this page periodically. Your continued use of the Service after any changes constitutes acceptance of the updated policy.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: