Privacy Policy

Who this policy covers

This policy explains how GovBrain (“GovBrain”, “we”, “us”) handles information on govbrain.org (the “website”) and in the GovBrain application at app.govbrain.org (the “service”). If your firm has a separate agreement with us, that agreement also governs how we handle your firm’s data.

Information we collect

On this website

The website does not set cookies and does not run analytics, advertising or tracking scripts. Like most websites, our hosting provider records standard server logs, such as IP address, browser type, the page requested and the time, which we use to operate and secure the site. If you email us, we receive your email address and whatever you include in your message.

In the service

• Account information: your name, email address, team and role, and the sign-in methods you set up, such as an authenticator app or a passkey. Amazon Cognito manages sign-in for us, and GovBrain does not store your password.
• Customer content: the information your team adds, including firm profiles, Personnel records (such as names, roles, education, registrations and experience), projects, past performance, uploaded files, and the forms and documents you create. It also includes what partners submit through upload links your team sends them.
• Usage information: request logs that record your account ID, IP address, browser and the actions you take, which we use for security, troubleshooting and audit. The application uses your browser’s storage to keep you signed in.
• Public opportunity data: federal contract opportunities and their documents from public sources such as SAM.gov. These can include the names and contact details of government points of contact.

How we use information

We use information to:

• provide the service, including finding opportunities, analyzing solicitations and composing documents when you ask us to;
• keep the service secure, including detecting and preventing misuse;
• send service messages, such as team invitations, partner upload links and security notices;
• answer your questions and requests;
• maintain and improve the service; and
• meet our legal obligations.

We do not sell personal information, share it for cross-context behavioral advertising, or use customer content for advertising.

AI processing

Some features use artificial intelligence. When you analyze a solicitation, ask for Personnel or project recommendations, or work with Brian, the relevant content is sent to our AI provider, OpenAI, to produce the result. OpenAI processes it under its terms for business API customers. Brian’s requests are sent with provider-side storage turned off.

AI output can be wrong or incomplete, so review it before you rely on it or submit it.

How we share information

We share information only as described here.

• Within your team. Members of your team can see your team’s content. Partners you invite through an upload link can submit information, but they cannot see your team’s records.
• Service providers. These providers run parts of GovBrain and process information on our behalf, under terms that limit how they may use it.
• Legal and safety reasons. We may disclose information when the law requires it, or when needed to protect the rights, safety or security of GovBrain, our customers or others.
• Business changes. If GovBrain is part of a merger, acquisition or sale of assets, information may transfer as part of that transaction, subject to this policy.

• Amazon Web ServicesHosting, file storage, sign-in and background processing
• MongoDB AtlasDatabase
• OpenAIAI processing for analysis, recommendations and Brian
• ResendEmail delivery, such as invitations and partner upload links

How long we keep it

We keep account information and customer content for as long as your team’s account is active. When an account closes, or when you ask us to, we delete customer content from our active systems unless we need to keep it to meet a legal obligation, resolve a dispute or enforce our agreements. Server and request logs are kept for a limited time for security and troubleshooting.

Security

We protect information with required multi-factor sign-in, team-scoped access, encryption in transit and at rest, and the other controls described on our Security page. No system is perfectly secure, so we cannot guarantee that information will never be accessed without authorization. If you think your account has been compromised, contact us right away.

Your choices and rights

You can ask us to access, correct or delete your personal information by emailing hello@govbrain.org. Depending on where you live, you may have additional rights under applicable law, and we will respond to requests as that law requires. We will not treat you differently for exercising your rights.

If your information is in GovBrain because a customer added it, for example because your employer listed you as Personnel or a partner firm included you in a submission, please contact that customer first. We will help them respond to your request.

Children

GovBrain is a business service and is not directed to children. We do not knowingly collect personal information from anyone under 16.

Where we process information

GovBrain is operated from the United States, and we process and store information in the United States.

Changes to this policy

We may update this policy. When we do, we will change the date at the top of this page. If a change is significant, we will tell account holders by email or in the application before it takes effect.