Privacy Policy

Effective: September 24, 2026

What we do not store

Worth saying first, because it is a design decision rather than an omission: we do not store your procurement portal passwords. Registration records hold the portal name, category, status, renewal date, username and your own notes. There is no password field, and adding one is not on the roadmap.

We also do not run third-party analytics, advertising trackers or session recorders on this site or in the product.

Information you give us

• Account data — name, work email, organization name and role. Sign-in goes through Google, so we receive your email address and profile name. We never see your Google password.
• Workspace content — saved searches, tracking status, notes, tags, assignments, registration records and any files you attach to a submission.
• Messages you send us — anything you write in the contact form or by email, along with the company and categories you tell us about.
• Billing data — paid subscriptions are billed through Stripe. Card details are entered on Stripe’s systems and never reach ours. We keep a customer reference, your plan and your invoice history.

Information we collect automatically

• Product usage — which parts of the app you use and what errors you hit, so we can find and fix problems.
• Server logs — IP address, browser and device type, and timestamps. Contact-form submissions store a one-way hash of the sender’s IP rather than the address itself, which is enough to stop abuse without keeping the address on file.
• Cookies — only what signing in requires. We set no advertising or analytics cookies, so there is no consent banner to click.

One thing to flag because it is a request your browser makes to someone else: this site loads its typefaces from Google Fonts, so your browser fetches those files from Google and Google sees the request.

The opportunity data

Solicitation records come from publicly posted government and institutional procurement notices. They contain no personal data about you, they are shared across all customers, and they are never derived from your workspace content. What you do with an opportunity — your status, notes and assignments — stays private to your organization.

How we use it

To run the service, send the digests and notifications you have configured, answer you when you get in touch, bill you, and keep the system secure and working. We do not sell personal data, we do not share it for advertising, and we do not use your workspace content to train machine-learning models.

Who else processes it

We use these services to operate RFP Docket:

• Google Cloud and Firebase — hosting, database, serverless functions and authentication.
• Resend — transactional and notification email.
• Stripe — payment processing for paid subscriptions.

Each of them processes data only to provide its service to us. We will update this list before adding another, and note the change in the effective date above.

Keeping organizations separate

Each organization’s data is stored under its own tenant, and access rules stop any account from reading another tenant’s tracking, registrations, saved searches or team records. Those rules are covered by automated tests that run before every deployment, so a change that broke the separation would fail the build rather than reach production.

How long we keep it

Workspace content is kept while your account is active. After cancellation it is available for export for 30 days, and then we delete it. Deletion removes it from our live systems straight away; copies can remain in encrypted backups for a short period before they age out.

Contact-form messages are kept while they are useful for the conversation they belong to, and deleted when they are not.

Your rights

You can see and export your workspace content from inside the app at any time, and you can ask us to correct or delete it. We extend the same access, correction, export and deletion rights to everyone who asks, wherever you live, rather than only where a law requires it.

Depending on where you are, laws such as the GDPR or the CCPA may give you further rights, including the right to object to processing or to complain to a supervisory authority. Ask us and we will help you exercise them.

Where data is held

RFP Docket runs on Google Cloud infrastructure in the United States. If you are outside the United States, using the service means your data is processed there.

Children

RFP Docket is a business tool and is not directed to anyone under 18.

Changes to this policy

We post changes here and update the effective date. We email account owners about material ones before they take effect.

Contact

Privacy questions, or a request about your own data: hello@rfpdocket.com.