Privacy Policy

This Privacy Policy explains how GovBid Finder, LLC ("GovBid Finder," "we," "us") collects, uses, stores, shares, and protects information when you use the GovBid Finder website and application (the "Service"). It applies to information we process about account holders, prospective users, and the contractor businesses they represent.

GovBid Finder is a discovery, qualification, and pipeline-management platform for government contracting. It is a business-to-business tool used by contractor businesses; it is not directed to consumers or to children. By using the Service, you agree to this Policy and to our Terms of Service.

We collect the following categories of information, almost all of which you provide directly:

• Account & authentication. Your email address and password (passwords are hashed by our authentication provider; we never see or store them in plaintext), plus session cookies used to keep you signed in.
• Company profile. The contractor-business information you enter during onboarding — company name, states served, trades/services and NAICS codes, years in business, employee count, revenue range, contractor licenses, bonding capacity, insurance limits, past projects, government experience, contract preferences, and your business contact email and phone.
• Uploaded documents. Files you upload — your capability statement, and bid-package evidence such as cost, technical, past-performance, insurance, and bond documents, and submission confirmation receipts.
• Bid pipeline & outcomes. The opportunities you track, pipeline stages and their history, bid submissions (portal, confirmation number, date), outcomes (won/lost/no-bid and your notes), and award watchlist entries.
• Financial information (for success-fee invoicing). Contractor-reported award amounts, computed success-fee amounts, invoice status, and payment terms. We do not collect or store credit-card numbers, CVCs, or bank-account details (see Section 4).
• CRM / agency contacts. The agency accounts, contacts, interactions, and follow-ups you choose to record about your own business dealings.
• Marketplace information. If you opt in to the subcontractor marketplace, your marketplace profile, posted subcontractor needs, match records, and partner invitations.
• Usage & technical data. Anonymous, cookie-free page-view analytics and standard server logs (request path, status, timing) used to operate and secure the Service.

We use the information above to:

• Authenticate you and secure your account;
• Score and match opportunities to your profile, calculate bid viability, and assemble bid-package drafts;
• Operate your pipeline, CRM, alerts, and (if you opt in) the subcontractor marketplace;
• Calculate, invoice, and collect the 3% success fee on contracts you win through the Service (see our Terms);
• Verify reported wins against public government award data;
• Operate, maintain, debug, secure, and improve the Service;
• Communicate with you about your account, alerts you opt into, and service updates.

Where relevant law requires a legal basis (e.g., GDPR), we rely on performance of our contract with you, our legitimate interests in operating and improving the Service, and your consent where applicable (for example, opt-in email alerts).

We do not sell or rent your information. We share it only with the service providers ("sub-processors") that make the Service work, and only as needed for the purposes above:

• Supabase — database, authentication, and file storage (hosts the application data described above).
• Vercel — application hosting, CDN, and content delivery.
• Stripe — payment processing for success-fee invoices (receives your email, the award amount as an invoice line item, and an account identifier).
• Resend — transactional and alert email delivery (receives your email and the alert content, such as opportunity titles and deadlines).
• GoDaddy — domain registrar only (no application data).

Each sub-processor is bound by its own data-processing terms. We may also disclose information if required by law, to enforce our Terms, to protect the rights, safety, or property of GovBid Finder or others, or in connection with a merger, acquisition, or sale of assets (with notice as required by law).

We may use de-identified, aggregated data (for example, average win rates by trade or geography) to improve the Service or share industry statistics, in a form that cannot reasonably be linked back to you.

AI note: we do not send your personal information, financial figures, or uploaded documents to third-party AI providers. If we introduce an AI feature that transmits any data to an external model, we will update this Policy and limit what is sent to non-personal opportunity text.

Success-fee payments are processed by Stripe through a Stripe-hosted invoice. We never receive or store your card number, CVC, or bank details — those go directly to Stripe, a PCI-compliant payment processor. We store only opaque Stripe identifiers (customer and invoice IDs) and invoice status. Stripe's handling of your payment information is governed by Stripe's own privacy policy and terms.

The subcontractor marketplace is opt-in. If you set your profile to be marketplace-visible, other marketplace members whose service areas overlap with yours may see your marketplace profile and any subcontractor needs you post, and may see match records in which you both participate. You can change your marketplace visibility at any time in your profile. If you do not opt in, your profile is not visible to other contractors.

The Service displays government procurement opportunities and award data gathered from public government sources. This public data is not your personal information; we process it to operate the shared opportunity catalog and the award-detection feature. We do not send your information to those public sources — the data flow is inbound only.

We use only essential cookies required to keep you signed in (session cookies set by our authentication provider). We do not use advertising cookies or third-party tracking cookies.

For analytics we use a privacy-respecting, cookie-free page-view measurement service (Vercel Analytics) that records anonymous page views and referrers and does not build a profile of you or track you across other sites.

We keep information for as long as needed for the purposes it was collected, then delete or de-identify it:

• Account & company profile, CRM, marketplace data: for the life of your account.
• Bid-package evidence, financial/invoice records, and bid submissions: up to 7 years, to maintain the audit trail that supports the success-fee accounting model and to meet recordkeeping needs.
• Pipeline status, stage history, and award watchlist: up to 5 years.
• Alert logs: up to 2 years. Analytics: ~30 days. Server/query logs: short-term (hours to days).

After you delete your account, we remove your account data and, after a short grace period, hard-delete your records; copies may persist in encrypted backups until those backups age out (generally within 7–30 days). Records we are required to retain for legal, tax, or success-fee-audit reasons are kept for the applicable period described above.

We use industry-standard safeguards, including: encryption in transit (TLS 1.2+); encryption at rest (AES-256) at our database and storage provider; row-level security that scopes every read and write to your own account so other users cannot see your data; private, non-public storage buckets for your uploaded documents, with downloads streamed only through access-controlled server routes; and hashed passwords managed by our authentication provider. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security.

You can review and update most of your profile information directly in the app. You may also request to access, correct, export, or delete your personal information by emailing andrew@blackmarketgrp.com. We will respond within the time required by applicable law.

Depending on where you live, you may have additional rights — for example, California residents (under the CCPA/CPRA) and individuals in the EU/UK (under the GDPR/UK GDPR) may have rights to access, correct, delete, port, or restrict certain processing, and to object to processing based on legitimate interests. We do not sell or "share" your personal information as those terms are defined under California law. To exercise any right, contact us at the email above; we will not discriminate against you for doing so.

Our CRM lets you record business-contact details of government-agency personnel you deal with. That is professional, business-context information you collect from your own dealings; we do not contact those individuals or share their details with anyone else. You are responsible for handling such information lawfully.

The Service is a business tool intended for users 18 and older and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.

We operate in the United States, and our database and storage are hosted in a U.S. region. If you access the Service from outside the United States, you understand your information will be processed in the United States, where data-protection laws may differ from those in your location.

We may update this Policy from time to time. If we make a material change, we will update the "Last updated" date above and, where appropriate, notify you via the email on your account. Your continued use of the Service after a change takes effect constitutes acceptance of the updated Policy.

Questions, requests, or concerns about this Policy or your data? Email andrew@blackmarketgrp.com, or write to GovBid Finder, LLC, Utah, United States.