Privacy Policy

PRIVACY POLICY

RFPeasy®

A product of Gov Access Solutions, LLC

Effective Date: May 20, 2026

Last Updated: July 21, 2026

Amendments dated July 21, 2026 take effect August 20, 2026.

This Privacy Policy describes how Gov Access Solutions, LLC, a Colorado limited liability company doing business as RFPeasy ("RFPeasy," "we," "us," or "our"), collects, uses, shares, and protects information when you visit https://www.rfpeasy.app and use the RFPeasy software-as-a-service platform (collectively, the "Service"). This Privacy Policy is incorporated into and forms part of our Terms of Service available at https://www.rfpeasy.app/terms (the "Terms").

Capitalized terms used but not defined in this Privacy Policy have the meanings given to them in the Terms.

1. Scope and Applicability

This Privacy Policy applies to information we collect (a) when you access or use the Service, (b) when you communicate with us by email, in-app chat, or other means, and (c) when you visit our marketing pages. It does not apply to information collected by third-party services not operated by us, including the sites of our Subprocessors when you visit them directly.

The Service is a business-to-business product intended for use by federal government contractors, consultants, and similar commercial users. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13. The Service is intended only for users aged 18 and older.

2. Information We Collect

2.1 Information You Provide to Us

When you create an Account, use the Service, or contact us, we collect:

  • Account information: your name, email address, password (hashed), company or organization name, role, and similar registration details;

  • Profile information: company profile data you enter, including business name, NAICS/PSC codes, industry, certifications, past performance, capabilities, financial structure information used for cost modeling, and similar federal-contracting-related information;

  • Customer Content: documents you upload (including RFPs, RFIs, SBIR topics, capability statements, and supporting materials), AI prompts and instructions, generated outputs, and any other content you create, save, or share through the Service;

  • Billing information: while full payment card numbers are collected and stored by Stripe (not by us), we receive limited information from Stripe such as the last four digits of your payment card, card brand, billing ZIP code, and Subscription status;

  • Communications: messages, feedback, and other content you send to us through email, in-app chat, contact forms, or feedback widgets;

  • Invitation data: when you invite a collaborator to your Organization, we collect the invitee's email address.

2.2 Information We Collect Automatically

When you use the Service, we automatically collect:

  • Usage data: pages and features accessed, actions taken (clicks, uploads, exports, generations), session duration, frequency of use, quota consumption, and similar telemetry;

  • Device and technical data: IP address, browser type and version, operating system, device identifiers, screen size, language preference, and referring URL;

  • Log data: server logs of HTTP requests, error reports, performance metrics, and security events;

  • Cookies and similar technologies: session cookies, persistent cookies, and localStorage entries used for authentication, preferences, and analytics. See Section 9 for more on cookies.

2.3 Information from Third Parties

We may receive information about you from:

  • Stripe: payment status, Subscription state, and limited billing metadata;

  • Public federal data sources: when you submit a query (e.g., a NAICS code, agency name, or solicitation number), we retrieve publicly available data from SAM.gov, USASpending.gov, GSA CALC+, GovInfo, and similar federal data sources. We do not control what data those sources publish about you or your company.

  • Other Authorized Users: an Owner who invites you to an Organization may provide your email address; another Organization Member may share Customer Content with you within the Organization.

3. How We Use Information

We use the information we collect for the following purposes:

  • To provide, maintain, operate, and improve the Service;

  • To authenticate you and secure your Account;

  • To process payments and manage your Subscription;

  • To generate AI-produced output in response to your inputs;

  • To send transactional communications, including Account confirmations, invoices, security alerts, quota warnings, beta-expiration notices, and similar Service-related messages;

  • To respond to your support requests and feedback;

  • To monitor and analyze trends, usage, and activity in connection with the Service;

  • To detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms or Acceptable Use Policy;

  • To comply with legal obligations, including responding to lawful requests from public authorities;

  • To enforce our Terms and to protect our rights, property, or the safety of others;

  • To create aggregated, de-identified, and statistical data for analytics, benchmarking, and Service-improvement purposes as described in our Terms; and

  • For any other purpose disclosed to you at the time of collection or for which you have provided consent.

4. AI Processing: Specific Disclosures

The Service uses generative artificial-intelligence models provided by Anthropic, PBC ("Anthropic") and may use other AI providers from time to time. When you submit Customer Content or instructions to AI features of the Service:

  • Your Customer Content and prompts are transmitted to Anthropic's API for processing on our behalf;

  • Anthropic processes that content under its commercial API terms applicable to RFPeasy, which include commitments regarding the handling of customer data;

  • We do not, and we contractually require our AI Subprocessors not to, use your identifiable Customer Content or AI-generated outputs to train, fine-tune, or evaluate any AI or machine-learning model;

  • We may use aggregated, de-identified, and statistical data derived from usage of the Service's AI features to improve, debug, secure, and benchmark the Service, in accordance with our Terms.

5. How We Share Information

We share information in the following circumstances:

5.1 With Subprocessors

We share information with the third-party service providers listed in Section 6 ("Subprocessors") to the extent necessary for them to perform services on our behalf.

5.2 Within Your Organization

If you are a Member of an Organization, Customer Content in an Organization or workspace is visible to all Authorized Users of that Organization or workspace, except files a User keeps in the Personal section of Documents, which are visible only to that User. The Owner of the Organization has administrative visibility into Members' identity (name, email) and the Organization's billing information.

5.3 With Federal Data Sources

When you submit queries (such as company-name lookups, NAICS searches, or solicitation analyses), portions of your query may be transmitted to federal government data sources (SAM.gov, USASpending.gov, GSA CALC+, GovInfo) to retrieve publicly available data responsive to your query.

5.4 For Legal Reasons

We may disclose information when we believe in good faith that disclosure is necessary to (a) comply with applicable law, regulation, legal process, or governmental request; (b) enforce our Terms, including investigation of potential violations; (c) detect, prevent, or otherwise address fraud, security, or technical issues; or (d) protect against harm to the rights, property, or safety of RFPeasy, our users, or the public.

5.5 In Connection with a Business Transaction

If we are involved in a merger, acquisition, reorganization, asset sale, financing, or similar transaction, information may be transferred to the acquiring or successor entity, subject to confidentiality protections. We will notify affected Users by email or in-product notice before any such transfer becomes effective.

5.6 With Your Consent

We may share information with third parties when you have provided consent for such sharing.

5.7 Aggregated or De-identified Information

We may share aggregated, de-identified, or statistical data that does not personally identify you, for any lawful purpose.

We do not sell your personal information for monetary consideration. We do not "share" your personal information for cross-context behavioral advertising as those terms are defined under the California Consumer Privacy Act ("CCPA") as amended by the California Privacy Rights Act ("CPRA").

6. Subprocessors

Our current Subprocessors include:

  • Anthropic, PBC (United States): generative-AI model provider (Claude API); processes prompts and Customer Content to generate outputs.

  • Supabase, Inc. (United States): managed PostgreSQL database, authentication, and object storage; hosts Customer Content and Account data.

  • Vercel, Inc. (United States): application hosting, content delivery network, and serverless functions; serves the Service and processes requests.

  • Stripe, Inc. (United States): payment processing; handles payment-card information and Subscription billing.

  • Resend, Inc. (United States): transactional email delivery; sends Service-related emails including invites, notifications, and alerts.

  • Functional Software, Inc. d/b/a Sentry (United States): error monitoring; receives error reports and limited diagnostic data, which may include IP address and stack-trace context.

  • PostHog Inc. (United States): product analytics; receives usage events, device data, and aggregated behavior data.

  • GoDaddy.com, LLC (United States): DNS services for our domain.

We may update this list from time to time. The current list will be available at https://www.rfpeasy.app/subprocessors. Each Subprocessor is bound by contractual obligations to protect information consistent with this Privacy Policy and applicable law.

7. Data Retention

We retain your information for as long as is reasonably necessary to provide the Service to you, comply with our legal obligations, resolve disputes, and enforce our agreements. Specifically:

  • Account and profile data: retained while your Account is active, and for up to ninety (90) days after Account closure to allow for re-activation, after which it is purged from production systems;

  • Customer Content: retained while your Account is active, and for up to thirty (30) days after Account closure (during which you may request export), after which it is deleted from production systems;

  • Billing and tax records: retained for at least seven (7) years to comply with U.S. federal and state tax-recordkeeping obligations;

  • Security and audit logs: retained for up to two (2) years for security-investigation purposes;

  • Aggregated and de-identified data: retained indefinitely;

  • Backups: information may persist in encrypted backup copies for up to ninety (90) days after deletion from production systems, after which the backups are rotated and the data is removed.

8. Security

We use reasonable administrative, technical, and physical safeguards designed to protect information from unauthorized access, use, disclosure, alteration, and destruction. These include:

  • Encryption of data in transit using TLS;

  • Encryption of data at rest in our database and object storage;

  • Row-Level Security ("RLS") enforced at the database layer to isolate Customer Content between users and organizations;

  • Role-based access controls and the principle of least privilege for employee and contractor access;

  • Multi-factor authentication for administrative accounts;

  • Vendor diligence on Subprocessors;

  • Logging, monitoring, and alerting for security events.

No method of transmission or storage is 100% secure. We cannot guarantee absolute security of your information. You are responsible for maintaining the confidentiality of your Account credentials.

8.1 Security Incident Notification

If we confirm a security incident affecting your personal information, we will notify you in accordance with applicable state and federal breach-notification law:

  • For Customers on the Team or Custom plan: as set forth in our Data Processing Addendum, Section 4.3 (within seventy-two (72) hours).

  • For all other Users: without undue delay and in any event no later than sixty (60) days after confirmation of the incident, or sooner if required by applicable law.

Notifications will describe the nature of the incident, the categories and approximate volume of information affected, the measures taken or proposed, and recommended steps for affected Users. Notifications will be sent to the email address on file for the affected Account.

9. Cookies and Tracking Technologies

We use cookies and similar technologies (such as localStorage and pixel tags) to operate the Service and analyze usage. The categories of cookies we use include:

  • Strictly necessary cookies: required for authentication, session management, and basic functionality. These cannot be disabled without breaking the Service.

  • Functional cookies: remember your preferences (such as UI state or selected scope filters).

  • Analytics cookies: provided by PostHog and used to understand how Users interact with the Service. Analytics cookies do not identify you to advertisers.

We do not use cookies for cross-context behavioral advertising. We do not allow third-party advertising networks to set cookies through the Service.

You may disable cookies through your browser settings, but doing so may impair functionality of the Service.

10. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights with respect to your personal information:

  • Right to access: you may request a copy of the personal information we hold about you;

  • Right to correction: you may request correction of inaccurate or incomplete personal information;

  • Right to deletion: you may request that we delete your personal information, subject to certain exceptions (e.g., tax and audit records);

  • Right to portability: you may request export of your Customer Content in a machine-readable format;

  • Right to restrict or object to processing: you may ask us to restrict or stop certain processing;

  • Right to withdraw consent: where we rely on consent, you may withdraw it at any time (this does not affect prior lawful processing);

  • Right to non-discrimination: we will not discriminate against you for exercising any privacy right.

To exercise any of these rights, email us at dakota@govaccesssolutions.com with subject line "Privacy Request: [Type]" (for example, "Privacy Request: Access," "Privacy Request: Deletion," "Privacy Request: Export"). Include the email address associated with your Account and any details that would help us identify your records. We will acknowledge your request within ten (10) business days and substantively respond within forty-five (45) days as required by applicable law. We may extend the response period by an additional forty-five (45) days where reasonably necessary, with notice to you. We may need to verify your identity before fulfilling certain requests.

11. California Residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the "CCPA"), provides you with the following additional rights:

11.1 Categories of Personal Information Collected

In the past 12 months, we have collected the following categories of personal information described in California Civil Code § 1798.140:

  • Identifiers: name, email address, IP address, account credentials, customer numbers;

  • Commercial information: subscription tier, transaction history, billing records;

  • Internet or network activity: browsing history within the Service, interactions with the Service, log data;

  • Geolocation data: approximate location derived from IP address;

  • Professional or employment information: company name, role, business address, federal-contractor identifiers (CAGE, UEI), NAICS codes;

  • Inferences: derived characteristics from usage patterns for product analytics purposes.

11.2 Sources, Purposes, and Disclosures

We collect personal information from the sources, for the purposes, and disclose it to the recipients described in Sections 2, 3, 5, and 6 of this Privacy Policy. We do not use sensitive personal information for any purpose other than as permitted by the CCPA without offering you the right to limit such use.

11.3 No Sale; No Cross-Context Behavioral Advertising

We do not sell personal information for monetary consideration, and we do not "share" personal information for cross-context behavioral advertising as those terms are defined under the CCPA.

11.4 California Rights

You have the rights to know, delete, correct, and limit the use of sensitive personal information, as described in Section 10 and as further specified by the CCPA. You also have the right to be free from retaliation or discrimination for exercising any of these rights.

11.5 Authorized Agents

You may designate an authorized agent to make a CCPA request on your behalf. We may require the agent to provide proof of authorization and may require you to verify your own identity directly with us.

12. Colorado Residents (Colorado Privacy Act)

If you are a Colorado resident, the Colorado Privacy Act ("CPA") provides you with rights similar to those described in Sections 10 and 11, including the rights of access, correction, deletion, portability, and the right to opt out of targeted advertising, sale of personal data, and certain profiling. We do not engage in targeted advertising or sale of personal data. To exercise CPA rights, follow the procedure in Section 10.

13. Other U.S. State Privacy Laws

Residents of Virginia, Connecticut, Utah, Texas, and other U.S. states with comprehensive privacy laws may have rights similar to those described above. We will honor verified requests in accordance with applicable state law. Contact us at the address in Section 17 to exercise any rights.

14. International Users

The Service is provided from and intended for use in the United States. Our Subprocessors are primarily located in the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States. By using the Service, you consent to such transfer and processing. We are not currently designed for compliance with the EU General Data Protection Regulation (GDPR), the UK General Data Protection Regulation (UK GDPR), or other non-U.S. comprehensive privacy regimes. If you are subject to GDPR, UK GDPR, or similar law, you should evaluate whether the Service is appropriate for your use case.

15. Google User Data (Google Drive and Google Calendar Integrations)

RFPeasy offers optional integrations with Google Drive and Google Calendar. These integrations are strictly opt-in: they remain inactive until you explicitly connect your Google Account, and you may disconnect them at any time from within the Service or at https://myaccount.google.com/permissions. When you connect your Google Account, RFPeasy requests only the narrowly scoped permissions described below.

15.1 Google Account Sign-In (openid, email)

Scopes: openid, email.

We use these solely to verify your identity and associate the connection with your RFPeasy Account. We receive your Google Account's basic identifier and email address. We do not receive, request, or store your Google password.

15.2 Google Drive: drive.file (files RFPeasy creates only)

Scope: https://www.googleapis.com/auth/drive.file.

This is the most restrictive Google Drive permission available, and we chose it deliberately. Under drive.file, RFPeasy can access only the files that RFPeasy itself creates in your Google Drive: the documents RFPeasy exports for you, such as your compliance matrix and formatted proposal, saved to an "RFPeasy" export folder in your Drive. RFPeasy cannot see, read, list, search, download, or otherwise access any of your other Google Drive files, folders, or content, and we never request access to your existing or unrelated Drive files. Our access is limited to the documents RFPeasy places in your Drive on your behalf.

15.3 Google Calendar: calendar.events (deadline events)

Scope: https://www.googleapis.com/auth/calendar.events.

We use this to create and update calendar events for your proposal and solicitation deadlines (for example, a "Proposal due" event) on the Google Calendar you designate. Our access is limited to calendar events, which we use to add, update, and remove the deadline events RFPeasy manages for you. We do not use this permission to read or manage unrelated calendar entries beyond what is necessary to keep the deadline events RFPeasy creates accurate.

15.4 Limited Use of Google User Data

RFPeasy's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Consistent with that policy, we affirm that information obtained through the Google Drive and Google Calendar integrations is:

  • used only to provide and improve the user-facing features described in this Section (exporting your generated documents to Drive and managing your deadline events on Calendar);

  • not sold, and not transferred to third parties except as necessary to provide or improve those features, to comply with applicable law, or in connection with a merger, acquisition, or sale of assets with notice to affected users;

  • not used for serving advertisements; and

  • not used to train, fine-tune, or develop generalized or non-personalized artificial-intelligence or machine-learning models. Information obtained from Google is never sent to the AI Subprocessors described in Section 4.

Humans do not read your Google Drive or Google Calendar data except (a) with your explicit consent (for example, to resolve a support request you initiate), (b) where necessary for security purposes (such as investigating abuse or a vulnerability), or (c) to comply with applicable law.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice by email to the address on file for your Account, by an in-product notice, or by updating the "Last Updated" date at the top of this Privacy Policy and posting the revised Privacy Policy at https://www.rfpeasy.app/privacy. Your continued use of the Service after the effective date of the revised Privacy Policy constitutes your acceptance of the revised Privacy Policy.

17. Contact Us

Questions about this Privacy Policy or to exercise any of the rights described above:

Gov Access Solutions, LLC d/b/a RFPeasy

Attn: Privacy Officer

8225 Fairmount Dr APT 5-108

Denver, CO 80247

Email: dakota@govaccesssolutions.com

Web: https://www.rfpeasy.app/privacy

END OF PRIVACY POLICY