Legal

Privacy Policy

Effective date: 2026-11-05

This policy explains what information BidOpps AI ("BidOpps AI", "we", "us") collects when you use our website, our waitlist, and our MCP connector, and how we use, store, and protect that information.

1. Who we are

BidOpps AI is an independent product that provides federal contract opportunity intelligence through an MCP (Model Context Protocol) connector. It is built for and tested with Claude; it is also expected to work with other MCP-compatible AI chat clients (such as ChatGPT or Cursor), though we have not verified those integrations ourselves. BidOpps AI is not affiliated with, endorsed by, or sponsored by SAM.gov, GSA, or any U.S. government agency.

2. Information we collect

Waitlist and sign-up email. If you join our waitlist or sign up, we collect the email address you submit and, optionally, a source tag indicating where you signed up. This is also our marketing contact list; see Section 8 for what that means and how to opt out.
Account & identity information. You sign in with a 6-digit code we email to you. There is no password and no third-party login. We store your email address and an account identifier so we can tie your usage and subscription status to a stable account. When you connect an AI client, it receives an access token tied to that account through a standard OAuth authorization step you approve.
Usage & metering data. We log which tools you call through the MCP connector (for example, a search or an enrichment call), timestamps, and counts, tied to your account identifier; for each call we also record how long it took, how many results it returned, whether it succeeded, and which filters were used (their names only, such as "agency" or "set_aside", never the values you searched for). We use this to enforce usage limits (such as each plan's monthly enrichment allowance), to bill correctly, and to improve the product.
Site visits. A short script on our pages sets three first-party cookies: bo_aid, a random identifier; bo_sid, a session identifier that expires after 30 minutes without a page view; and bo_ft, where your first visit came from (the referring site, and any utm_ campaign tags or partner ref tag on the link). The pages report which page you viewed, whether you reached the demo or the pricing, and which sign-up button you clicked, to this site only, with the country your visit came from (never your address or city). When you sign in, we link that identifier to your account so we can see which pages lead to sign-ups. There are no third-party cookies or ad trackers, and the script does nothing if your browser sends Global Privacy Control or Do Not Track.
Sign-up question. When you sign up you can tell us what you use today to find federal work, from four choices. It's optional and stored with your account.
Payment information. Subscriptions are billed through Stripe. We never receive or store your full card number (Stripe handles payment collection and PCI compliance directly); we store only what Stripe shares back with us, such as a customer ID, subscription status, and plan tier.
Technical/log data. Standard request metadata (such as IP address, user agent, and request timing) may be logged by our hosting infrastructure for security, debugging, and abuse prevention.

3. Contact information from public federal solicitations

Some of the procurement data BidOpps AI ingests includes named individuals' contact details (a primary and secondary point-of-contact title, full name, email address, phone number, and fax number) attached to a specific federal contract opportunity notice.

This is not data about you as a BidOpps AI user. It originates entirely from public federal solicitation notices published by contracting agencies through SAM.gov's public bulk data extract (see Section 5 below), the same contact information any member of the public can already see by opening the notice on SAM.gov directly. We do not collect it from any private source, and the individuals named did not submit it to BidOpps AI.
How we use it. When present, this contact information is surfaced to BidOpps AI subscribers alongside the solicitation it's attached to, so a subscriber researching a specific contract opportunity can identify the contracting officer or point of contact named on that notice, the same purpose it serves on SAM.gov itself.
Acceptable use: no bulk contacting. Subscribers may not use contact information surfaced by BidOpps AI for bulk or mass marketing, unsolicited mass email/call campaigns, or any form of automated bulk solicitation of the named individuals. See our Terms of Use for the full acceptable-use policy. If you are a named contact and want your information corrected or removed from BidOpps AI specifically, contact us using the details in the "Contact us" section at the bottom of this policy.

TODO(founder): this section reflects our current handling of solicitation contact data; counsel review of contact-data disclosure and any applicable state contact/privacy-law obligations is still pending (see the top-of-file note).

4. How we use this information

To operate the waitlist and sign-up, and to notify you when BidOpps AI has news.
To authenticate you and maintain your account.
To meter usage against your plan's limits and enforce fair use.
To process payments and manage subscriptions via Stripe.
To monitor, secure, and improve the reliability of the service.
To communicate with you about your account, billing, or material product changes.
To send you occasional marketing emails about BidOpps AI itself and about other products from the same team, such as FARGPT, always with a working way to opt out. See Section 8.
To surface solicitation contact information (Section 3) alongside the notice it belongs to.

We do not sell your data. We do not sell, rent, or trade your personal information or usage data to a third party for their own marketing purposes. This doesn't mean we never email you about anything else we build ourselves. We do, and Section 8 explains exactly what that looks like and how to turn it off.

5. Data sources & attribution

BidOpps AI's opportunity and award data is sourced from public federal procurement systems: SAM.gov (contract opportunity notices, via the permitted bulk CSV extract and SAM.gov's public Opportunities API), FPDS, and USAspending.gov (award/spending records). We ingest this data only through permitted bulk extracts and public APIs, never by scraping or automated harvesting of the SAM.gov website.

Some older SAM.gov award notices (those with an award date before April 4, 2022, when SAM.gov transitioned away from using Dun & Bradstreet DUNS numbers as the primary entity identifier) may include business name and address data originally sourced from Dun & Bradstreet (D&B). D&B is the source of that data. We ingest and store this data as part of the underlying opportunity record, consistent with SAM.gov's Terms of Use governing it, and we do not disseminate it in bulk. BidOpps AI does not display the awardee on award notices dated before April 4, 2022. For later award notices, reading a single notice shows the awardee as recorded on that SAM.gov notice, attributed to SAM.gov.

Separately, the incumbent and award-history tools show contractor (recipient) names, UEIs, and award amounts from USAspending.gov public federal spending records, including how each award was competed and the business size and socioeconomic status recorded on it. To fill in a contractor's location, BidOpps AI may look up that contractor's UEI in USAspending.gov's public API, never your email address or anything about you or your searches. Our internal record of these data-handling decisions, including the questions still pending counsel review, is available on request.

When you ask for a notice's attachments, BidOpps AI fetches them from SAM.gov's public API (only files SAM.gov publishes without sign-in), extracts their text, and returns it to you. The extracted text is kept in our Cloudflare storage for up to 30 days so a repeat request doesn't download the file again; the files themselves are not stored, and nothing about the request is added to your account beyond the usage record.

6. Where your data lives

BidOpps AI runs entirely on Cloudflare: our application logic, static site, and database (Cloudflare D1) are hosted on Cloudflare's global network. Sign-in codes and account links are sent from our own mailbox through our email host, MXroute, which receives your email address and the message for that purpose only. Payment processing is handled by Stripe. Product analytics events (the site visits above, sign-ups, which tools are called and whether they worked, and subscription changes) are kept in our own database and may also be sent to PostHog, our product analytics provider, under your account identifier. We never send PostHog your email address or what you searched for. We do not run our own separate data centers or servers outside of these providers.

7. Data retention

We retain usage and metering logs and site-visit events for approximately 24 months, after which they are deleted or aggregated into non-identifying statistics. Waitlist entries are retained until you ask us to remove them or until the waitlist closes. Account and billing records are retained as needed to comply with tax, accounting, and legal obligations, which may exceed 24 months for financial records specifically. Federal opportunity/award data (Section 5), including solicitation contact information (Section 3), is retained for as long as it remains part of our searchable corpus and is not tied to your personal account-retention timeline. Text extracted from solicitation attachments is deleted after 30 days.

8. Marketing emails & how to opt out

Beyond operational email (login codes and account links; Stripe sends payment receipts), we may email you about BidOpps AI updates and, occasionally, about other products from the same team. Right now, that's FARGPT, a related tool for federal contractors. These are marketing emails: nice-to-know, never required to use BidOpps AI.

We don't hand your email to anyone else for this. These emails come from us, about products we build. We don't sell, rent, or trade your address to a third party so they can market to you (see Section 4's callout).
Every marketing email will have a working unsubscribe. We haven't sent any marketing email yet. When we do, each one will carry an unsubscribe link, and replying with the word "unsubscribe" will work too. Either one will be honored promptly.
You can also opt out directly. Contact us using the details in the "Contact us" section below and ask to be removed from marketing email; we'll confirm once it's done.
Opting out of marketing doesn't touch your account. You'll still get operational email that's necessary to actually run your account: login codes, security notices, and required service updates aren't marketing and aren't covered by this opt-out.

9. Your choices

You can ask us to remove your email from the waitlist at any time.
You can request a copy of, correction to, or deletion of your account data.
You can opt out of marketing email at any time; see Section 8.
You can cancel your subscription at any time through the Stripe customer portal; cancellation stops future billing but does not retroactively delete historical usage logs used for accounting purposes.

10. Security

We rely on Cloudflare's and Stripe's security infrastructure and follow standard practices such as least-privilege access to production data and encrypted transport (HTTPS/TLS) for all requests. No system is perfectly secure, and we cannot guarantee absolute security of information transmitted to us.

11. Children's privacy

BidOpps AI is a business tool intended for professional use and is not directed at children. We do not knowingly collect information from children under 13.

12. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the effective date at the top of this page.

13. Contact us

Questions about this policy or your data can be sent to support@bidoppsai.com.