This policy explains what information GovConHouse ("we") collects when you use the Platform at govconhouse.com, how we use it, and who receives it. The Platform is a business tool for government contractors; our Terms of Service require users to be at least 18 and to use it on behalf of an organization.
1. Information We Collect
- Account information: name, email address, and a hashed password. If phone verification is enabled, your phone number. If you turn on multi-factor authentication, its secret and backup codes.
- Company information: your supplier profile (UEI, CAGE, NAICS codes, certifications) and the team member details you enter, which can include name, email, phone, and security clearance level. If you use the export-control features, the U.S. person records you enter.
- Content you add: uploaded documents, proposals, bids and pricing, support tickets, and survey responses.
- Usage and device information: IP address on requests and sign-ins, browser and device details, a device fingerprint at signup used to stop abusive signups, and the searches you run.
- Integration settings: push notification tokens and the Slack or Microsoft Teams webhook addresses you configure.
- Public government data: federal contracting opportunity and award data from public sources.
2. How We Use Information
We use this information to operate the matching, analytics, and bid-preparation features you use, to secure accounts and prevent abuse, to provide support, and to bill paid plans. AI features process your content to produce outputs for your account.
We do not use your data to train models shared with other customers. We do not sell personal data.
3. Who Receives Your Information
We share information only with these service providers, or as required by law.
Always used
- Supabase: database hosting
- Fly.io: API and background job hosting
- Vercel: web application hosting
- Upstash: job queue and cache
- Anthropic: AI processing of solicitation and proposal text when AI features run
- OpenAI: text embeddings for search
- Stripe: payments (card details go to Stripe, not to us)
- Our email delivery provider: account and notification email
- Cloudflare: hosting for our documentation, help, and compliance sites (no account data)
Used only if enabled
- Twilio: phone verification at signup, only if phone verification is enabled
- PostHog, Plausible, and Sentry: product analytics, web analytics, and error monitoring, only when enabled and, where required, with your consent
- Google Firebase Cloud Messaging: push notifications, only if you turn them on
- DeepSeek: alternate AI provider, off by default
Integrations you connect
If your company connects an integration such as Google Workspace, Microsoft 365, Slack, Microsoft Teams, HubSpot, Salesforce, or DocuSign, we send that service the data your configuration calls for.
This section is the current list. When it changes we update this page and the "Last updated" date above. For a copy or a question about a specific provider, write to support@govconhouse.com.
4. Staff Access
GovConHouse staff with administrator access (the platform staff role) can view customer data to provide support and operate the Platform. Changes made through that access are recorded in our audit log.
5. Cookies
These cookies are strictly necessary to sign in and are always set when you log in:
govcon_session: Keeps you signed in. HttpOnly, so page scripts cannot read it. Lifetime: 30 minutes.govcon_refresh: Renews your session without a new sign-in. HttpOnly. Lifetime: 7 days if you choose “Remember me”, otherwise until you close the browser.govcon_remember: Records whether you chose “Remember me”. Holds no personal data. Lifetime: Same as govcon_refresh.
Your browser's local storage also keeps preferences such as your theme.
Optional analytics: PostHog (which sets ph_* cookies), Plausible (no cookies), and Sentry error monitoring run only when enabled and, where required, with your consent.
6. Storage and Security
Data is stored with the providers listed above in the United States and sent over HTTPS. Access within a company account is role-scoped: company administrator (tenant_admin) and team member (end_user). Do not upload Controlled Unclassified Information (CUI); the Platform is not authorized to hold it.
7. Retention
We keep account data while your account is active. Audit logs are retained for security and compliance. To have your account deleted, see Your Choices below.
8. Children
The Platform is not directed to children under 13 and we do not knowingly collect their information. If you believe a child has given us information, contact support@govconhouse.com and we will delete it within 30 days.
9. Your Choices
To request a copy of your data or deletion of your account, email support@govconhouse.com. Support handles these requests within 30 days.
10. Contact
Privacy questions: support@govconhouse.com.