Privacy Policy

1. Information We Process

• Account and billing information, including purchaser name and email, company name when supplied, authentication state, subscription status, legal-consent records, and Stripe customer and subscription references. GovBiz does not store full card numbers.
• Catalog queries and explicit filters, API and OAuth credential hashes, scopes, usage counters, tool-call audit records, and operational metadata needed to provide and secure access. Do not send private company documents or complete conversations to catalog tools.
• Historical email-agent messages, attachments, company knowledge, and feedback may remain in protected storage under the retention policy. New opportunity email intake and digest delivery are retired. Account verification, recovery, billing, and security emails remain operational.
• Contact-form submissions include your name, follow-up email, optional company, message, and requested capacity. If you request a callback, we also collect your phone number and optional preferred time and time zone to coordinate a conversation. Signed-in requests are associated with your workspace. Authorized system administrators review these requests; Cloudflare Turnstile and rate limits help prevent spam.
• Security, device, connection, audit, support-access, source-health, and service-reliability records.

2. How We Use Information

• To authenticate users, enforce tenant access and subscription limits, retrieve public records, meter usage, manage billing, respond to support requests, prevent abuse, and maintain reliability. Query records may reveal research interests; avoid including unnecessary private information.
• GovBiz does not sell personal information or share it with advertisers.

3. Service Providers and Public Data

• Stripe processes checkout and subscription payments. Resend processes essential transactional email. Hosting, storage, security, malware-scanning, monitoring, and model providers process only the data needed for their contracted function.
• Catalog tools retrieve supported public government records. Your selected agent provider receives the results and handles them under its own terms and permissions.
• A current subprocessor list and additional data-processing information are available through our contact form at /contact.

4. Isolation, Security, and Support Access

• Tenant and company-profile controls isolate customer memory, messages, documents, search plans, executions, recommendations, and feedback. Sensitive message and extracted-document content is encrypted at rest and is excluded from ordinary operational logs.
• Full email, service-feedback, or attachment content is not the default support view. Access is tenant-scoped, reason-bound, time-limited, and audited. Ordinary content-access grants require approval from a second platform administrator; emergency break-glass access expires within 30 minutes.
• Tenant administrators can review all service feedback reported by their tenant, customer-visible activity, and the tenant support-access grant history. Protected content access is also recorded in the platform audit trail.
• We use signed provider webhooks, authorized-sender checks, attachment type and size limits, malware scanning, rate limits, managed secrets, signed and expiring feedback actions, backups, and deletion workflows.

5. Retention and Deletion

• We retain account, subscription, consent, audit, security, and transaction records as needed to provide the service, satisfy legal obligations, prevent fraud, and resolve disputes. Company messages, documents, extracted text, knowledge, plans, execution records, and feedback are retained while the service is active and for a limited recovery and compliance period after cancellation.
• Deletion requests remove or de-identify customer content according to the applicable retention schedule, except where law, security, fraud prevention, backup rotation, or dispute preservation requires temporary retention.
• You may request access, correction, export, or deletion by using our contact form at /contact. Identity verification may be required.

6. Contact

• For privacy questions, support-access questions, or data requests, use our contact form at /contact.

Website activity and your choice

Added October 12, 2026.

GovBiz measures page views, visits, and clicks with first-party browser identifiers. A visit ends after 30 minutes without recorded activity.

Signed-in activity is linked to your account and tenant. System administrators can review these statistics.

We don’t collect form contents, search text, URL query values, or IP addresses in these statistics. We store page routes, control categories, device groups, and referring domains.

Visitor cookies expire after 90 days without activity. We honor Do Not Track and Global Privacy Control browser settings.