Privacy Policy
Last updated September 30, 2026
This policy explains what GovCon Starter (govcon.pro) collects, why, who we share it with, and the choices you have. We keep it in plain language on purpose.
What we collect
| Data | Why | Kept |
|---|---|---|
| Account: name, email, optional username, password (hashed) or Google sign-in link | To run your account and sign you in | Until you delete your account |
| Business profile: legal name, entity type, address, NAICS codes, UEI/CAGE, revenue, headcount | To guide registration, certifications, contract matching, and proposals | Until you delete it or your account |
| EIN | To prepare filings. Encrypted at rest (AES-256); shown to you only masked; never included in AI prompts; never shared | Until you delete it or your account |
| Capabilities, saved contracts, proposal inputs and drafts | To build your pipeline and generate proposal drafts | Until you delete them or your account |
| Password-reset tokens | To reset your password securely | 1 hour, single use |
| Usage analytics (pages viewed, basic device info) | To understand what's used and fix problems | Aggregated; no cookies, no cross-site tracking |
| Advertising cookies (only if you allow ads) | Google may measure and personalize ads on free pages | Per Google's policies; you can withdraw consent any time |
Who processes it for us
- Supabase (database hosting, U.S.) and Vercel (application hosting and cookieless web analytics).
- Upstash (short-lived caching and rate-limit counters — no personal data beyond an email or IP address used as a counter key).
- Resend (transactional email: password resets, operational alerts).
- Anthropic (AI provider): when you use proposal analysis or drafting, the solicitation text and your company and capability details are sent to generate the draft. Your EIN is never sent.
- Google AdSense (only after you allow ads): sets cookies to serve and measure ads. We never send Google your account or business data.
- SAM.gov: we read public opportunity data from the government; we don't send them your data.
We don't sell personal information. Partner offers on the site are plain links; we don't pass your data to partners unless you fill in a form that says so explicitly.
Your choices
- Ads: use the "Ad preferences" link in the footer to allow or withdraw advertising cookies at any time.
- Access, correction, deletion: most data is editable in your Profile. To export or delete everything, email support@govcon.pro from your account email; we respond within 30 days.
- California residents (CCPA/CPRA): you have the right to know, delete, and correct your personal information and to opt out of its sale or sharing. We don't sell personal information; allowing advertising cookies may count as "sharing" for cross-context behavioral advertising — withdraw it via "Ad preferences". We don't discriminate for exercising these rights.
Security
Passwords are hashed with bcrypt; EINs are encrypted with AES-256-GCM; connections use TLS; access to production systems is limited. No system is perfectly secure — if we learn of a breach affecting your data, we will notify you as the law requires.
Children
The Service is for businesses and is not directed to children under 16; we don't knowingly collect their data.
Changes and contact
We'll update the date above when this policy changes and announce material changes on the Service. Questions: support@govcon.pro.