Privacy Policy
Effective date: July 17, 2026
This Privacy Policy explains how Bidstrike ("BidStrike," "we," "us," or "our") collects, uses, shares, and protects information in connection with the BidStrike platform available at bidstrike.io and its associated application, sites, and services (collectively, the "Service"). By using the Service, you agree to the practices described here.
Plain-English summary: we collect what we need to run your account and generate your proposals, we send your content to our AI provider only to produce your outputs, we don't sell your data, and your proposals are not used to build products for other customers. BidStrike is not a system for Controlled Unclassified Information (CUI) — don't put CUI in it.
1. Information We Collect
Information you provide
- Account information: name, email address, password (managed by our identity provider), and optional profile details such as a phone number or avatar.
- Company profile: business name, NAICS codes, certifications (e.g., 8(a), SDVOSB, WOSB, HUBZone), UEI/CAGE codes, capabilities, rates, key personnel, and past performance you enter to power matching and proposal generation.
- Content: proposals, drafts, capability statements, library items, documents you upload (e.g., insurance certificates, capability statements), messages you send to our AI Copilot or support channels, and screenshots you attach.
- Billing information: processed by our payment providers. We store plan and subscription status; we never store full card numbers.
- Communications: emails, support requests, and problem reports you send us.
Information collected automatically
- Usage data: pages viewed, features used, actions taken in the app (including an audit log of AI-assistant actions on your account).
- Device and log data: IP address, browser type, operating system, timestamps, and similar diagnostic information.
- Cookies and similar technologies: used for authentication, session management, preferences, and analytics. You can control cookies through your browser; some are required for the Service to function.
Information from public sources
- The Service aggregates publicly available government-contracting data — solicitations and notices (e.g., SAM.gov, state and local portals, Grants.gov), public award records (e.g., FPDS, USASpending), public business registries (e.g., SBA DSBS, SAM entity records), and contracting-officer contact details published in government notices. This data relates to business entities and public officials acting in their official capacities.
2. How We Use Information
- Provide, operate, and secure the Service — matching contracts to your profile, scoring win probability, generating and reviewing proposals, tracking your pipeline and awards.
- Generate AI outputs: your profile, relevant contract data, and your content are sent to our AI provider (Anthropic) solely to produce the drafts, briefs, scores, and reviews you request. We do not sell your content, and we do not use your proposals to build or market products for other customers.
- Process payments, manage plans and limits, and administer your subscription.
- Communicate with you: transactional messages (deadline alerts, submission confirmations, account notices) and — with your consent where required — product updates and marketing. Marketing emails always include an unsubscribe link. If you opt in to text messages, you can opt out at any time by replying STOP.
- Provide support, investigate problems, and enforce our Terms.
- Comply with legal obligations.
3. How We Share Information
We do not sell your personal information. We share it only with:
- Subprocessors that host and operate the Service on our behalf: Vercel (hosting), Supabase (database and file storage), Clerk (authentication), Anthropic (AI processing), Stripe (payments), Resend (email delivery), and Svix (webhook delivery). Each is bound to use your data only to provide its service to us.
- Your workspace: teammates and administrators in your account can see content and activity consistent with their roles and permissions.
- Recipients you direct: when you submit a proposal or response, we send it — with the documents you attach — to the government contact you direct it to.
- Legal: when required by law, subpoena, or to protect the rights, safety, and property of BidStrike, our users, or the public.
- Business transfers: in connection with a merger, acquisition, or sale of assets, in which case this Policy continues to apply until amended.
4. Data Retention
We retain your information while your account is active and as needed to provide the Service. After account closure we delete or de-identify personal information within a reasonable period, except where retention is required for legal, billing, dispute, or security purposes (including audit logs). You may request deletion sooner (Section 7).
5. Security
Data is encrypted in transit (TLS 1.2+) and at rest by our infrastructure providers. Workspaces are tenant-isolated; access is role-based and enforced server-side; uploaded documents are stored in private buckets; and AI-assistant actions are permission-checked and audit-logged. No system is perfectly secure — if we learn of a breach affecting your personal information, we will notify you as required by law. Details: Security page.
6. The CUI Boundary
The Service is designed for pre-award, publicly sourced information and your own business content. It is not authorized to store or process Controlled Unclassified Information (CUI), classified information, or ITAR-controlled technical data, and you agree not to submit such material to the Service.
7. Your Rights and Choices
- Access, correction, deletion: you can edit most information in the app; for anything else — including account deletion or a copy of your data — email privacy@bidstrike.io.
- Marketing opt-out: unsubscribe link in every marketing email; reply STOP to any marketing text.
- Cookies: manageable in your browser settings.
- US state privacy rights: depending on your state of residence, you may have rights to access, delete, correct, or obtain a copy of your personal information, and to opt out of certain processing. We honor verified requests sent to privacy@bidstrike.io and will not discriminate against you for exercising them.
- Public-records data: if you are a business or public official whose publicly published information appears in our aggregated government data and you have a correction, contact us and we will review it.
8. Children
The Service is a business tool for adults. It is not directed to anyone under 18, and we do not knowingly collect information from children.
9. International Users
The Service is operated from the United States and intended for US-market use. If you access it from elsewhere, you understand your information will be processed in the United States.
10. Changes to This Policy
We may update this Policy from time to time. Material changes will be announced by email or in-app notice before they take effect. The "Effective date" above always reflects the current version.
11. Contact
Privacy questions or requests: privacy@bidstrike.io
General: bidstrike.io/contact
