Privacy Policy

1. Scope and our roles

This Policy covers the Service, our website at govsmith.com, our public legal pages, and the emails we send. It does not cover how we handle the personal data of our own employees and contractors as staff, which their agreements with us cover.

We act in two roles:

• As a controller for the personal data we need to run our business: account and contact details, billing, security logs, support requests, and messages sent through our website.
• As a processor (a service provider) on behalf of each client company for the Client Content its people share with us or that we prepare for it: documents, company profile data, pursuits, Briefs, Deliverables, messages, contacts and connector data. The client company decides why that data is collected; we process it under our Terms of Service, its Service Agreement and this Policy.

If you are on a client company's team, its Owner and Admins manage its people in the Service, and the vCMs assigned to it work with the data it shares. Questions about how your company uses the Service should go to your Owner.

2. Information we collect

Information you give us

• Account: first and last name, email, username, password (hashed, never stored in clear), profile photo, job title, and the multi-factor or passkey credentials you register (we store a public key or an encrypted authenticator secret, never a private key).
• Company profile: company name, website and logo, addresses, UEI and CAGE codes, NAICS and PSC codes, certifications, past performance, key documents, partners and contacts.
• Client Content: files you upload or import, files you share with your vCM, messages to your vCM, meeting requests, approvals, pursuits, the submissions you record, and anything else you enter.
• Connector data: when you connect Google Drive, OneDrive, SharePoint or another app, the files and data those connectors are permitted to read within the scopes you approve, and the files you choose to import.
• Team and billing: the names and emails of people you invite, who may approve quotes, your acceptance of the Service Agreement and of each Quote, and your billing address. Card and bank details are entered with Stripe and never reach our servers.
• Support and website: bug reports and support requests (with the page you were on and your browser details), and the discovery inquiries and demo requests you send through the forms on govsmith.com.

Information we create while doing the work

• Briefs, recommendations and win estimates about opportunities for your company; Quotes; Deliverables; and the notes, internal estimates and time records our staff keep about the engagement, some of which are not shown in the Portal.
• The GovSmith AI conversations, workspaces and memories our staff use to do your work.

Information collected automatically

• Usage: the pages and features you use, the delivery time used, and timestamps. This powers Settings, Usage and Billing.
• Device and connection: IP address, browser and operating system, screen size, language, and approximate location derived from IP.
• Security logs: sign-ins and sign-outs, failed attempts, MFA and passkey events, session records, and administrative actions, kept in an audit log.
• Error reports: when something breaks, an error report with your user ID and organization ID, and for some sessions a replay in which all text, inputs and media are masked.
• Cookies and browser storage: see section 7.

Information from others

• Sign-in providers: if you sign in with Google or Microsoft we receive your name, email and profile photo.
• Payment processor: Stripe tells us whether a payment succeeded and the brand and last four digits of the card or bank account.
• Public sources: company details from SAM.gov and USAspending, opportunity data from the government sources in section 5, and company logos looked up from a website domain.
• Your company: the Owner or an Admin gives us your name, email and role when they invite you.

3. How we use information and our legal bases

We use information for the purposes below. Where the GDPR or UK GDPR applies, the legal basis for each is shown.

We do not use Client Content to build profiles for advertising, and we do not make automated decisions about you that have legal or similarly significant effects.

4. How AI processing works

• The Portal has no AI chat. Our staff use AI tools, including GovSmith AI, on your Client Content to do the work you engaged us for. When they do, the request, the relevant context (documents, company profile, pursuit details) and their instructions are sent to an AI provider to produce a result. The providers and their purposes are in the table in section 5.
• Model calls go through OpenRouter, which forwards each one to the provider that runs the model; if OpenRouter is unavailable, we may call Anthropic or OpenAI directly on our own accounts. OpenRouter does not store prompts or answers, and we send it a one-way hash of the organization ID, never a name or an email.
• Work on solicitations and your company's documents, including document extraction and the search index over your files, runs only on Anthropic and OpenAI. Anthropic and OpenAI keep API data for a short period to detect abuse, under their own terms, and do not train on it. Every other model runs only through providers that keep no data after answering (zero data retention).
• We do not use your personal data, Client Content or AI outputs to train or fine-tune large language models, ours or anyone else's, and our settings with OpenRouter forbid training on them. This statement is made for the purposes of state privacy laws that require it, including Connecticut's.
• Files are split into passages and turned into embeddings (numeric representations) so the Service can find relevant passages. Embeddings are stored in our database, each marked with the client company it belongs to and kept apart by row-level security.
• GovSmith AI can keep short memories for the staff member using it, so later work can use them. Staff can see and delete them in Settings, Data controls, and turn the feature off.
• When GovSmith AI searches the web, the search query goes to the model provider's own search tool or to OpenRouter's web search tool (powered by Exa).
• Read-aloud sends only the text of a reply to ElevenLabs through OpenRouter; dictation runs in the browser.
• Our staff review AI output before it reaches you in a Brief or a Deliverable, but it can still be wrong. The Terms of Service explain your responsibilities.

5. Who we share data with

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the preceding 12 months.

We share information only as follows:

Subprocessors and service providers

The vendors below process data for us under terms that limit their use of it to providing their service, require confidentiality and security, and do not allow them to train AI models on it. We will update this table at least 30 days before a new subprocessor begins processing Client Content; client companies may object in writing on reasonable grounds. OpenRouter's own subprocessors are listed at trust.openrouter.ai.

Retiring at the cutover

The vendors below served the platform GovSmith replaces and are struck from the table above. Records from that platform stay with them only until they move to GovSmith's own systems; GovSmith's own systems never read or write them, and each is shut down at the cutover gate.

GovSmith staff

The vCMs assigned to your company and our administrators see your data as section 6 describes. Our staff may be employees or independent contractors; we are responsible for how they handle your data.

Inside your company

Your teammates see the company's Portal. The Owner and Admins can see the team, its roles and quote approvers, and Library activity, and can add or remove people. If you leave the company's team, the content you contributed stays with the company.

Legal, safety and corporate

• To comply with a law, regulation, subpoena, court order or lawful government request, including export control and sanctions requirements. Where lawful and practical, we notify the affected client company first.
• To protect the rights, property or safety of GovSmith, our clients or the public, including investigating fraud, abuse or security incidents.
• In a merger, acquisition, financing or sale of assets, in which case the successor is bound by this Policy for the data transferred, and we will notify you.
• With your direction or consent, for example when you share a file with your vCM, invite a teammate, or connect a third-party account.

6. Who can see your company's data

• Your company's own people: everyone your Owner or an Admin invites can use the Portal. The Owner and Admins can also see the team, its roles and quote approvers, and Library activity.
• Your vCMs: GovSmith staff with an active assignment to your company. When an assignment ends, so does that person's access.
• View as client: a vCM serving your company may open a read-only preview of your Portal to see exactly what a member of your team sees. The preview changes nothing and sends nothing.
• GovSmith administrators: the people who run the business can see every client's data for assignments, quality review, billing, security and support. They must use multi-factor authentication.
• GovSmith AI Workspaces: a staff member's AI workspace that covers your company is shared only with vCMs assigned to your company.
• Staff-only records, such as internal notes, estimates and the cost of our own work, are not shown in the Portal. You can still ask for any personal data in them (section 10).
• When your Owner or an Admin removes you, your access ends at once. What you contributed stays with the company.

7. Cookies and browser storage

The Portal uses only the cookies and browser storage it needs to work. It sets no analytics or advertising cookies, and we do not sell or share what any of them record.

Our website at govsmith.com uses no analytics or advertising cookies or scripts, and neither does the Portal.

You can clear cookies and browser storage in your browser. Doing so signs you out and resets preferences on that device. Because we do not sell or share personal information, there is nothing to opt out of; we nonetheless honor Global Privacy Control (GPC) signals as an opt-out of any sale or sharing.

8. How we protect information

• Encryption in transit with TLS, and at rest: our files, secrets and backups with keys held in AWS Key Management Service, and the database with Neon's encryption at rest.
• Passwords hashed with a modern algorithm; multi-factor authentication required for all GovSmith staff and administrators and available to every client user, with a passkey or an authenticator app; single-use, expiring links for password reset; sessions that end after 60 minutes idle or 24 hours.
• Client isolation enforced in every query and, as a second wall, by database row-level security; staff access limited to the clients an active assignment names; an automated isolation test on every change.
• Malware scanning of uploaded files (Amazon GuardDuty), threat detection and audit trails on our cloud account (GuardDuty and AWS CloudTrail), and vulnerability scanning (Amazon Inspector).
• Audit logs of sign-ins, security events, assignments, approvals and administrative actions; least-privilege access to production, with production credentials kept only in AWS Secrets Manager.
• Nightly encrypted backups locked against change, restores drilled before launch and every quarter, and a written incident response plan.
• We self-assess against CMMC Level 1, the basic safeguarding of Federal Contract Information. We are not assessed at CMMC Level 2, we are not FedRAMP authorized, and GovSmith does not handle Controlled Unclassified Information (CUI). Do not share CUI or classified information with us.

No method of transmission or storage is completely secure. If we confirm a breach that affects your personal data or Client Content, we will notify the Owner of the affected client account without undue delay and within 72 hours of confirming it, and individuals and regulators where the law requires.

9. How long we keep information

We may keep de-identified or aggregated data that cannot reasonably be linked to you or your company for as long as it is useful.

10. Your privacy rights and choices

Wherever you live, you can do the following in the Service:

• See and update your profile in Settings, Account; manage sign-in security in Settings, Security & login.
• Download your data in Settings, Data controls.
• Ask to delete your company's data with Delete all data in Settings, Data controls. The request goes to your vCM, who confirms the scope with you before anything is removed.
• Request deletion of your own account in Settings, Account. We process it within 7 days.
• Choose which GovSmith notifications you get, by email or in the app, in Settings, Notifications. Email about your account, security and billing cannot be turned off while the account exists.

Depending on where you live you may also have the right to: access the personal data we hold about you and receive a copy in a portable format; correct inaccurate data; delete your data; restrict or object to certain processing; opt out of targeted advertising, sale, sharing or profiling (we do none of these); withdraw consent where processing is based on consent; and not be discriminated against for exercising your rights.

To exercise a right that the Service does not let you exercise yourself, email legal@govsmith.com with the subject "Privacy request". We verify requests using the email on the account and may ask for more information. We respond within 45 days under U.S. state laws (extendable once by 45 days with notice) and within one month under the GDPR (extendable by two months for complex requests). An authorized agent may submit a request with your written permission. If we deny a request, we explain why, and you may appeal by replying to our decision; we answer appeals within 45 days.

If you are on a client company's team, we may refer your request to that company's Owner, because the company controls its Client Content.

11. Notice for California residents

This section supplements the rest of the Policy for California residents under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA).

We do not sell personal information and do not share it for cross-context behavioral advertising. We do not use or disclose sensitive personal information for purposes other than those permitted by the CCPA. We honor Global Privacy Control signals. California residents have the rights to know, delete, correct, and to limit the use of sensitive personal information, and the right not to be discriminated against; section 10 explains how to exercise them.

12. Notice for residents of other U.S. states

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Indiana, Tennessee, Delaware, New Jersey, New Hampshire, Kentucky, Nebraska, Maryland, Minnesota, Rhode Island and other states with comprehensive privacy laws have the rights listed in section 10, including the right to appeal a denied request. We do not sell personal data, engage in targeted advertising, or profile you in furtherance of decisions that produce legal or similarly significant effects.

Connecticut residents: we do not collect, use or sell personal data for the purpose of training large language models. Where a state law requires it, we treat a browser or device opt-out preference signal such as Global Privacy Control as a valid opt-out.

13. International data transfers

The Service is hosted in the United States (AWS us-east-1), and our subprocessors are mainly in the United States; some AI providers in section 5 may answer a request from their own regions. If you use the Service from outside the U.S., including from the European Economic Area, the United Kingdom or Switzerland, your information is transferred to and processed in the U.S., where privacy laws may differ from those in your country.

For transfers from the EEA, UK and Switzerland we rely on the European Commission's Standard Contractual Clauses and the UK Addendum with our clients and subprocessors, and on the necessity of the transfer to perform our contract with you. Client companies that need signed clauses should email legal@govsmith.com. We have not appointed an EU or UK representative; contact us directly.

14. Children

The Service is for business use and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

15. Government contractor considerations

• GovSmith does not handle Controlled Unclassified Information (CUI) or classified information. Do not upload or share either. If either reaches us, we will tell you and remove it, and we may be required to report it.
• You decide whether Client Content includes technical data controlled under ITAR or the EAR or other regulated data, and you share it only as our Terms of Service allow.
• Public procurement data we use (SAM.gov, USAspending, Grants.gov, SBIR.gov and international sources) is public information and is not personal data we collect from you, although it may name government officials and business contacts.
• We may be required to preserve or disclose data in response to lawful process, including subpoenas related to your government contracts; we notify you where the law allows.
• We do not offer a HIPAA Business Associate Agreement. Do not share protected health information with us.

16. Automated decision-making and profiling

Our staff use AI and simple scoring tools to draft, summarize, classify and recommend, for example how well an opportunity fits your company or a suggested win estimate. A person at GovSmith reviews these before they reach you, and you decide what to do with them. We do not use automated decision-making to make decisions that produce legal or similarly significant effects about you, such as denying you access, pricing you differently, or evaluating your employment.

17. Third-party sites and connectors

The Service links to government portals, source documents and third-party sites, and can connect to your accounts with other providers. Those sites and providers have their own privacy practices. Our use of information from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements: we use Google user data only to provide the connector features you asked for, never for advertising; our staff read it only where you have shared it with your vCM, for security, or as the law requires; and we do not transfer it except as needed to provide those features, for security, or as the law requires.

18. Marketing and product communications

We send email about your account, security events, team invitations, your engagement (Briefs, Quotes, Orders, messages and meetings), billing and support; you cannot turn off email about your account, security and billing while you have an account. You choose which other notifications you get in Settings, Notifications. Any news or announcement email we send carries an unsubscribe link. We do not send SMS marketing.

19. Changes to this Policy

We will post any changes here and update the effective date. For material changes we will notify the Owner of each client account by email or a notice in the Portal at least 30 days before they take effect. Earlier versions are available on request.

20. Contact us

Questions, requests and complaints about privacy:

• Blacksmith AI LLC DBA "GovSmith"
• 1611 N. Broadway Ave.
• Oklahoma City, OK 73103
• United States
• Legal and privacy requests: legal@govsmith.com
• Support: support@govsmith.com
• Web: https://govsmith.com

If you are in the EEA or UK and are not satisfied with our response, you may lodge a complaint with your local data protection authority. Previous version: October 21, 2026. This version is effective October 31, 2026.