The short version
We store what you put into the product so the product can work for you. We do not sell your data, we do not rent it, and we do not use it to train AI models. A small number of service providers process it on our behalf, and they are all named below. You can ask us to delete everything, and we will.
What we store
- Account and profile. Your email address, your name if you give it, your password (hashed by our authentication provider, never readable by us), and your subscription plan and its status.
- Company data. The company name, identifiers such as a UEI or CAGE code, NAICS and PSC codes, certifications you tell us about, past performance entries, and team member details you enter. You choose what to enter, and you can edit or remove it.
- Your activity in the product. Saved opportunities and favorites, the statuses you set, notes you write, auto-alerts you create, bid packets you start, compliance checklist state, and outreach pipeline statuses.
- Documents and generated text. Documents you generate or upload, and generated content such as cover letters, capability statements, outreach drafts, and AI summaries.
- Billing records. Your Stripe customer and subscription identifiers and your subscription status. We never receive or store your card number. Stripe holds that, and it is Stripe that charges it.
- Email delivery records. Which transactional emails were sent and when, so a notification is not sent to you twice.
Who processes it
These are the services that can touch your data. Each one is named with what it does for us, so you can judge it yourself.
- Supabase hosts our database, our file storage, and our authentication. Your profile, company data, favorites, documents, and notes live here.
- Vercel hosts the application and runs our scheduled jobs (the daily opportunity and award ingestion, the alert digest, and the weekly setup reminder).
- Stripe handles subscriptions and payments. It receives your payment details directly and stores them. We only see a customer identifier and a subscription status.
- Resend delivers the transactional emails the product sends (welcome, plan changes, payment problems, alert digests, setup reminders). It receives the recipient address and the email content.
- OpenAI generates the numeric embeddings that make Knowledge Base search work. Only the text of the Knowledge Base articles and your question are sent for this, for the purpose of finding the relevant article.
- DeepSeek runs the language model behind AI summarising, relevance scoring, and document drafting. When you use one of those features, the relevant company profile fields and the specific opportunity or award data needed for that feature are sent to generate the output.
- PostHog records product analytics: which features are used and which flows are completed. Events are tied to your account id, never to your email address. We deliberately do not send search terms, saved search names, solicitation titles, alert keywords, or anything you typed into a text field.
- Sentry records errors so we can fix them. It is configured to drop any event containing an email address or a request body, to strip cookies and query strings, and to discard breadcrumb payloads. Its session recording feature is switched off.
- Crisp runs the live chat, so we can answer your questions. It only receives what you type into the chat and the email address you give it if you ask us to reply later.
We do not sell your data. We do not share it with advertisers. We do not use it to train our own models or anyone else's.
Government data is public data
Opportunity and award information in the product comes from public federal sources (SAM.gov and USASpending.gov). That data is not yours or ours, and it is fetched on a schedule rather than in response to your searches.
Deleting your data
You can edit or delete most of what you enter from inside the product, and you can delete saved opportunities, alerts, bid packets, and documents yourself at any time.
To have your account and everything in it deleted, ask us. When you ask, we delete your profile, your company record and everything attached to it, your documents, your saved records, and your email log entries. We will also cancel your subscription, so tell us if you want the deletion to take effect at the end of a period you have already paid for rather than immediately.
Two honest caveats. First, records Stripe is required to keep for tax and accounting purposes stay with Stripe, not with us, and they are governed by Stripe's own policies. Second, deleting your account removes it permanently. We cannot restore it afterwards, so download anything you want to keep first.
Security
Data is encrypted in transit. Access to your records is restricted to your own account by database-level access rules, and administrative access to the service role is limited to server-side operations. No system is perfect, and we will not pretend otherwise. If we ever learn that your data has been exposed, we will tell you.
Cookies and local storage
We use cookies to keep you signed in, which is what makes the product usable at all without re-entering a password on every page. We use local storage for two small preferences: whether you have collapsed the sidebar, and whether an analytics event has already been reported. Product analytics is configured to keep its session in memory rather than writing it to your device.
Children
BidTrail is a business tool for people registering a company and bidding on federal contracts. It is not intended for anyone under 18, and we do not knowingly collect data from anyone under 18.
Changes to this policy
If what we store or who processes it changes, we will update this page and the date at the top. If the change is significant, we will tell you in the product as well.
Contact
BidTrail is operated by Technoor. For anything on this page, including a deletion request, contact us through the address shown on your account or onboarding correspondence. See also our Terms of Service.