Privacy Policy

1. Information We Collect

Account information

Sign-in uses a one-time magic link sent to your email address through Supabase Auth. We do not use passwords. When you first sign in we create a profile record containing your email address, your name if your sign-in provider supplies one, and your plan (free by default). The profile can also hold business details you choose to add, such as company name, UEI, CAGE code, NAICS and PSC codes, set-aside types, states, preferred agencies, and award-size ranges, which we use to match contract opportunities to you.

Email-only sign-ups and alerts

Some features ask only for an email address and do not require an account:

• Email gate.To unlock some contract details we ask for your email. We store the email address, the page you were on, and the time you last visited. The address is also kept in your browser's local storage so the prompt is not repeated.
• Contract alerts. We store your email address and the filters you choose (state, keywords, NAICS code, set-aside).
• SAM NAICS Watchlist (paid). We store your email address, up to three NAICS codes, and your subscription status. A magic link emailed to you lets you manage the subscription.

Saved searches

If you save a search, we store its name, filters, and alert frequency against your account.

Referrals

If you use the referral program, we store a referral code for your account and the status of people who sign up with it. If you arrive through a referral link, we set a cookie (see Cookies below) so we can credit the referrer.

Payment information

Payments are processed by Stripe. We do not receive or store your full card number. We keep your Stripe customer ID and your plan, and we receive payment status events from Stripe.

Email activity

We keep a log of the alert and welcome emails we send you (which user, which type of email) so we do not send duplicates.

Usage, device, and network data

Our analytics provider (Google Analytics 4) records page views, events such as sign-ups, checkout steps, and page-speed measurements, along with approximate location and device data. When you submit your email through the email gate, the event sent to Google Analytics includes the domain part of your email address (for example, example.com) but not the full address. Your IP address is used to apply rate limits (see Third-Party Services). We read the country that our hosting provider attaches to each request to block automated scraping of our contract pages from certain regions; we do not store it.

2. Public Government Data We Republish

The contract awards, opportunities, and entity data shown on the Service come from public government sources, primarily USAspending.gov and SAM.gov. This data can include business names, UEIs, locations, and, on some opportunity notices, the name, email address, and phone number of the government point of contact that the agency published. We display this data as published and do not collect it from you. If you believe a published record about you should be removed, contact us; in many cases the correction has to be made at the source agency.

3. How We Use Information

• Provide sign-in, search, exports, alerts, and subscriptions.
• Send transactional email: sign-in links, welcome messages, the alerts you asked for, and watchlist digests.
• Process payments and manage your plan.
• Prevent abuse, such as signup farming and automated scraping, using rate limits.
• Understand aggregate usage and improve the Service through Google Analytics.
• Send ourselves a notification when someone signs up or uses their first free export (see Third-Party Services).

4. Third-Party Services

We share information with these service providers only as needed to run the Service:

• Supabase hosts our database and provides authentication, including sending the sign-in magic link.
• Stripe processes payments. Your email address is passed to Stripe at checkout. See Stripe's Privacy Policy.
• Resend delivers our email (alerts, welcome messages, watchlist digests and manage links) from the palavir.co domain. Your email address and the message content pass through Resend.
• Google Analytics 4 receives the usage data described above. See Google's Privacy Policy.
• Vercel hosts the Service and, like any host, processes request data such as IP addresses and user agents in its logs.
• Upstash (Redis) holds short-lived rate-limit counters keyed by IP address, and your remaining free-export credits keyed by your account ID.
• A private internal notification service we operate alerts Palavir staff. When a new user signs up or redeems a first free export, a message containing that user's email address is sent to it. It is not sent to other users.
• Anthropic (Claude API) is used to write short summaries of public contract opportunities for the NAICS Watchlist digest. Only the public opportunity text is sent. No subscriber or account information is sent.
• RapidAPI. If you reach our data through our RapidAPI listing, RapidAPI is the intermediary for that access, and its own terms and privacy policy govern the account you hold there.

We do not sell your personal information. We may disclose information if required by law or to protect our rights, and if Palavir is involved in a merger, acquisition, or sale of the Service, your information may be transferred to the successor, which will be bound to honor this policy. We will tell you before that transfer and offer you the chance to delete your account.

5. Cookies and Local Storage

• Sign-in session cookies set by Supabase Auth keep you signed in.
• govbids_ref is set for 30 days when you arrive through a referral link, to credit the referrer.
• _ga and _ga_* are Google Analytics cookies that distinguish visitors and sessions.
• Local storage holds the email you entered at the email gate so you are not asked again.

The Service does not currently show a cookie-consent banner. You can block or delete cookies and local storage in your browser settings, though parts of the Service may not work without the sign-in cookies.

6. Retention and Deletion

We retain your personal information, including account, subscription, lead, alert-subscriber, and email-log records, for as long as your account is active or as needed to provide you services. Lead and inquiry form submissions are retained for up to 24 months. Free-export credit counters expire 90 days after they are set, and rate-limit counters expire within the limit window. If you request deletion of your data, we will remove it within 30 days, except where we are required by law to retain it (for example, financial records for tax purposes).

To delete your account or remove your email from alerts, leads, or the watchlist, email support@palavir.co. Alert emails also carry an unsubscribe link.

7. Security

Traffic to the Service is encrypted in transit (HTTPS), access to our database is restricted to our server code, and the paid data endpoints require authentication. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

8. Children

The Service is intended for businesses and professionals and is not directed to children under 13. We do not knowingly collect personal information from children.

9. Your Rights

You may ask us to access, correct, or delete the personal information we hold about you by emailing support@palavir.co. Depending on where you live, including California and other US states or Canada, you may have rights to access, correct, or delete your personal information. This policy is governed by the laws of the State of Michigan, USA.

10. Changes to This Policy

We may update this policy from time to time. We will change the "Last updated" date above and, for material changes, notify account holders by email.

11. Contact

Palavir LLC, a Michigan limited liability company
22515 Pontchartrain Dr, Southfield, MI 48034
support@palavir.co