Privacy policy

Information you provide

Account and alert workflows collect an email address, saved-search filters, alert frequency, and account or organization settings. Paid workflows may store Stripe customer and subscription identifiers, but GovBidStream does not receive full payment-card numbers from Stripe Checkout.

Information collected automatically

The service may record security, performance, and product events such as page type, search-to-detail action, saved-alert activation, connector health, and delivery status. Production analytics should be configured to minimize personal data and should not record search-form contents by default.

How information is used

• Authenticate accounts and secure sessions.
• Run saved searches and deliver requested alerts.
• Manage plan entitlements and billing state.
• Prevent abuse, debug failures, and audit sensitive changes.
• Measure whether visitors reach a useful result.

Email choices

Opportunity alerts require confirmation and include one-click unsubscribe. Pausing an alert stops matching deliveries for that search. A suppression list is retained as needed to honor opt-out requests.

Retention and deletion

Production retention schedules should keep account and delivery data only as long as needed for the service, legal obligations, security, dispute handling, and suppression. Requests can be sent to privacy@govbidstream.com.

Service providers and transfers

Hosting, database, email, error-monitoring, analytics, and payment providers process limited data to deliver the service. Production deployment must document the selected providers and applicable transfer safeguards before accounts are opened to the public.

Security

The application uses secure cookies, hashed tokens, same-origin request checks, server-side entitlements, input validation, delivery idempotency, and audit logging. No system is risk-free; report a suspected issue to security@govbidstream.com.