Privacy Policy

Gaia Bull LLC, a Wyoming limited liability company doing business as GovBeacon ("GovBeacon," "we," "us," or "our"), operates the GovBeacon platform (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our Service. By accessing or using the Service, you agree to this Privacy Policy.

We collect personal information that you voluntarily provide to us and a limited set of technical information generated automatically when you use the Service. We do not buy personal information from data brokers or scrape it from third-party sources. Account credentials (provided by you at signup). Email address and password. Your password is stored only in hashed form by our authentication provider; we never see your plaintext password. Sign-in via Google (optional, alternative to email/password). If you choose to sign in with Google, Google sends us — through our authentication provider — your Google account email address, a Google user identifier, and basic profile fields (typically your name, and an avatar URL if your Google account has one). We use this information solely to create and access your GovBeacon account. We do not receive your Google password, your contacts, your Gmail content, your calendar, or any other Google service data, and we do not request any Google API scopes beyond basic profile and email. You can disconnect Google sign-in at any time by deleting your GovBeacon account or by revoking GovBeacon's access from your Google Account's "Third-party apps with account access" settings. Profile and company information (provided by you, optional). Information you choose to enter in your profile and account settings to personalize search results and recommendations, including: full name, role or job title, phone number, company name, company website, company size band, SAM.gov UEI, CAGE code, preferred NAICS codes, preferred PSC codes, preferred U.S. states, preferred set-aside categories, and small-business certifications you hold (for example, 8(a), HUBZone, SDVOSB, WOSB). All of these fields are optional. You may add, edit, or remove any of them at any time from Account → Profile. Billing information (collected by Stripe). If you subscribe to a paid plan, our payment processor Stripe collects your billing name, billing address, and payment card details directly. We do not store full payment card numbers on our servers. We receive from Stripe a customer identifier, your subscription status, plan, billing interval, and the last four digits and brand of your card. User-generated content (provided by you while using the Service). Saved searches, pipeline notes you attach to tracked opportunities, contracts you choose to share, and any feedback or support messages you send us. Usage and device data (collected automatically). IP address, browser type and version, operating system, pages visited, search queries you run on the Service, features used, and timestamps of those actions. We use this information to operate the Service, diagnose technical issues, prevent abuse, and improve features. Cookies. We use essential cookies to maintain your session and authentication state. We also use the analytics cookies described in the next paragraph. We do not use advertising cookies, we do not participate in any advertising network, and we do not sell or share personal information for cross-context behavioral advertising. Google Analytics 4 (analytics, not advertising). We use Google Analytics 4 ("GA4"), a web-analytics service operated by Google LLC, to understand how visitors find and use the Service so we can improve it. GA4 sets first-party cookies on your device — typically named _ga and _ga_<ID> — that store a randomly-generated client identifier and session information. GA4 collects standard web-analytics data including your IP address (which Google uses to derive approximate geographic location and then discards), the URLs you visit on the Service, the page titles, the referring URL, your browser and device characteristics, and the events we explicitly fire (page views and a one-time sign_up event when you create an account). We do not pass your name, email address, account user ID, profile fields, or any other directly identifying information to GA4, and we have not enabled Google Signals or any advertising-personalization features. Google processes the analytics data on our behalf under Google's terms; Google's own use of that data is governed by its Privacy Policy. You can opt out of GA4 across all sites by installing Google's Google Analytics Opt-out Browser Add-on, or by blocking analytics cookies in your browser settings. GA4 is not loaded on local development or preview environments where it has not been configured. Vercel Speed Insights (performance monitoring). We use Vercel Speed Insights, a service operated by Vercel Inc., to measure how quickly our pages load for real users (Core Web Vitals such as Largest Contentful Paint, First Input Delay, and Cumulative Layout Shift) so we can identify and fix performance regressions. Speed Insights does not set cookies, does not assign a persistent client identifier, and is not used for advertising or behavioral tracking. It collects only anonymous performance measurements tied to the URL path that produced them. Vercel's handling of this data is governed by Vercel's Privacy Policy. What we do not collect. We do not knowingly collect government-issued ID numbers (Social Security number, driver's license), precise geolocation, biometric identifiers, health information, racial or ethnic origin, religious beliefs, sexual orientation, or any other category of sensitive personal information as defined under California law.

We use the information we collect to: provide and maintain the Service; process transactions and send related information (confirmations, invoices); send administrative messages such as security alerts and account notifications; respond to your comments, questions, and support requests; monitor and analyze usage trends to improve the Service; and detect, prevent, and address technical issues or fraudulent activity.

The contract opportunity and award data displayed in the Service is sourced from publicly available federal procurement records, including SAM.gov, the DLA Internet Bid Board System (DIBBs), and the SBIR/STTR awards database. This is public government data and is not subject to personal information protections. We do not collect personal information from these government data sources.

We do not sell, trade, or rent your personal information to third parties. We may share information with: service providers who assist in operating the Service (e.g., hosting, payment processing, email delivery), provided they agree to keep your information confidential; law enforcement or government agencies if required by law or in response to a valid legal request; and a successor entity in the event of a merger, acquisition, or sale of assets, with prior notice to affected users.

Certain features of the Service use third-party artificial intelligence providers to analyze publicly available federal solicitation documents and to support related platform features. We do not send your account information, profile, billing details, or any personal information to these providers as part of those features. The providers we use to deliver AI features may change over time as the underlying technology evolves.

We implement industry-standard security measures to protect your information, including encrypted data transmission (TLS/SSL), secure password hashing, and access controls on our infrastructure. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security. Security incident notification. If we confirm a security incident that has resulted in unauthorized access to, or disclosure of, your personal information, we will notify you without undue delay and in any event within 72 hours of confirming the incident, unless a longer period is required by law enforcement or by an applicable legal obligation. Our notice will describe, to the extent then known: the nature of the incident, the categories of personal information affected, the steps we are taking to investigate and remediate, and any actions you should consider taking to protect yourself. We will provide additional updates as material new information becomes available. Where state or federal law requires us to notify a regulator in addition to affected users, we will do so within the applicable statutory deadline.

We retain your account information for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete your personal information from our active application databases within 30 days, except as described below. Database backups. Our database provider maintains point-in-time recovery snapshots (approximately the most recent 7 days) and periodic snapshot backups for operational resilience. We cannot surgically remove individual records from backups; data in a backup ages out as the backup itself is rotated under our provider's retention policy. Backups are not used to repopulate deleted user data. Billing and transaction records. Records of subscription payments, invoices, and refunds are retained for up to 7 years to comply with U.S. tax and accounting requirements. Your payment card details remain with our payment processor (Stripe) under their retention policies; we hold only customer identifiers and subscription metadata. Operational logs. Platform logs from our hosting and database providers (request logs, error logs, authentication events) are retained approximately 30 days under those providers' default policies. Application-level usage data we collect (pages visited, searches run, feature usage) is retained while your account is active and deleted with the rest of your account data. Aggregated data. De-identified aggregate data — for example, total searches per day across all users, or counts of users by industry — that does not identify any individual user may be retained indefinitely for analytics and product improvement. Legal holds. If we are subject to a legal hold, subpoena, or other binding legal obligation that requires us to preserve specific data, we will retain only the data covered by that obligation for the duration it remains in effect, then delete it.

You may: access, update, or delete your account information through your account settings; request a copy of the personal data we hold about you; opt out of non-essential communications; and request deletion of your account by contacting us at support@govbeacon.io. We will respond to data access or deletion requests within 30 days.

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA"), gives you specific rights regarding your personal information. Categories of personal information we collect. In the past 12 months we have collected the following CCPA categories of personal information about California residents who use the Service: identifiers (name, email address, account user ID, IP address); commercial information (subscription plan, billing history, transaction records via Stripe); internet or other electronic network activity information (pages visited, searches performed, features used, device and browser information); professional or employment-related information (company name, role, small-business certifications, SAM.gov UEI, CAGE code, NAICS and PSC code preferences); and inferences drawn from the above to personalize search results and recommendations. The specific categories collected from a given user depend on what that user voluntarily enters into their profile. Sources of personal information. Directly from you when you create an account, complete your profile, subscribe to a paid plan, or use the Service. Automatically from your device when you visit the Service. From Stripe in connection with subscription billing. From Google, if you choose to sign in using your Google account, limited to the identity fields described in Section 2. Purposes of collection and use. To provide, maintain, and improve the Service; to process transactions; to communicate with you about your account; to personalize search results based on your profile; to comply with legal obligations; and to detect and prevent fraud or abuse. Categories of third parties we disclose to. Our service providers (hosting, payment processing, email delivery, rate-limiting infrastructure, AI providers as described in Section 6, the Google Analytics 4 web-analytics service described in Section 2, and Vercel Speed Insights for anonymous performance monitoring as described in Section 2), each bound by contract or by their own terms of service to keep your information confidential and to use it only to provide services to us. We may also disclose information in response to a valid legal request, or to a successor entity in a merger or acquisition. We do not sell or share your personal information. We do not sell personal information for monetary or other valuable consideration, and we do not share personal information for cross-context behavioral advertising, as those terms are defined under California law. We have not done so in the past twelve months. Because we do not engage in any sale or sharing of personal information as those terms are defined under the California Consumer Privacy Act, there is no opt-out mechanism required, and there is nothing for you to opt out of. If our practices ever change, we will update this Privacy Policy and provide a clear opt-out mechanism before any such sale or sharing begins. Sensitive personal information. We do not knowingly collect sensitive personal information as defined under California law, and therefore there is no collection or use of such information to limit. Your California rights. California residents have the right to: (a) know what personal information we have collected about you, the sources, purposes, and third parties we disclose to; (b) access a copy of the specific pieces of personal information we hold about you; (c) correct inaccurate personal information; (d) delete personal information we have collected, subject to legal exceptions; (e) opt out of any sale or sharing of personal information for cross-context behavioral advertising (we do neither, so there is nothing to opt out of); and (f) be free from discrimination for exercising any of these rights. How to exercise your rights. You can exercise the access, correction, and deletion rights for most personal information directly from Account → Profile in your dashboard. To submit a formal CCPA request — including a request for the specific pieces of personal information we hold about you, a categorized access report, or an account deletion — email support@govbeacon.io with the subject line "California Privacy Request." We will verify your identity by confirming the request from the email address associated with your account and will respond within 45 days as required by California law (we may extend by an additional 45 days where permitted, with notice to you). Authorized agents. You may designate an authorized agent to submit a request on your behalf. The agent must provide written, signed authorization from you, and we may require you to verify your own identity directly with us before fulfilling the request. "Shine the Light" (Cal. Civ. Code § 1798.83). California residents may request information about the categories of personal information (if any) we have disclosed to third parties for their direct marketing purposes during the prior calendar year. We do not disclose personal information to third parties for their direct marketing purposes.

The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal information, we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised "Last updated" date. Your continued use of the Service after changes are posted constitutes acceptance of the revised policy.

If you have questions about this Privacy Policy or our data practices, contact us at support@govbeacon.io or by mail at: Gaia Bull LLC d/b/a GovBeacon 30 N Gould St, Ste R Sheridan, WY 82801 United States