Privacy Policy

This is the short version: we collect what we need to run the product, we don't sell your data, and you can delete your account whenever you want. The rest of this page is the detail in case you want it.

What we collect

When you sign up we ask for your email, name, and company. That's the minimum to give you a login and personalize matches. If you're registered with SAM.gov and enter your UEI, we store it so we can pull your registration data and score opportunities for you.

If you sign in with LinkedIn, we receive your name, email, profile picture URL, headline (when available), and LinkedIn user ID. That's it. We do not access your connections, messages, posts, or anything beyond these basic profile fields.

If you upgrade to a paid plan, Stripe handles your card information directly. We never see or store your full card number — we only get back a customer ID and the last four digits for receipts.

We collect usage analyticsvia Vercel Analytics and the Meta Pixel so we know which features get used and which ads sent you here. That's pages visited, buttons clicked, and broad device/region info — not keystrokes, not your screen content.

How we use it

Four things, in order of how much data each one touches:

• Deliver the product. Score matches, run the Quick Checker, save your pursuits, render your dashboard. None of this works without your profile data.
• Transactional emails. Welcome message, password reset, Quick Checker results, billing receipts. These are tied to your account — you can't opt out without closing the account.
• Marketing emails. Occasional product updates and new-feature notes. Every one has an unsubscribe link in the footer that works in one click.
• Product improvement. Aggregated, de-identified usage data tells us which features earn their keep. We don't train external AI models on your data.

Who we share it with (sub-processors)

We use a small set of vendors to run the service. They only see the data they need to do their job:

• Supabase — hosts the database (your account, matches, pursuits).
• Resend — sends transactional and marketing emails on our behalf.
• Stripe — processes payments and stores card details.
• HubSpot — CRM for our consulting clients only. If you're on the self-service plan, your data doesn't go here.
• Vercel — hosts the website and the app, plus serves the analytics.
• Meta and Google — ad platforms. They get aggregated conversion signals (e.g. "someone from this ad signed up") so we know which ads are working.
• LinkedIn — sign-in provider, OAuth only. Used to authenticate you if you choose "Sign in with LinkedIn."

We don't sell your data to anyone. We don't share it with anyone outside the vendors above without your permission, except when we're legally required to.

Your rights

Whether or not you're in a jurisdiction with formal privacy laws (GDPR in the EU, CCPA in California, etc.), you can ask us to:

• See what we have on you.
• Export your data in a machine-readable format.
• Correct anything that's wrong.
• Delete your account and everything tied to it.
• Unsubscribe from marketing emails (one click in the email footer, or just ask).

Email hello@capturepilot.comfor any of these. We'll respond within seven days, usually within one.

Cookies

Two flavors:

• Session cookies — keep you logged in. Without these, the app doesn't work.
• Analytics cookies — Vercel Analytics and the Meta Pixel. These tell us which pages get traffic and which ads convert.

You can reject any of them in your browser settings. Most browsers let you block third-party cookies by default, which kills the Meta Pixel without breaking the app. If you do this and something stops working, let us know.

Data retention

We keep your data for as long as your account is active. If you delete your account, we delete your personal data within thirty days (some pieces stick around in encrypted backups for up to ninety days before they roll off).

If you stop logging in for three years, we'll email you a heads-up and then close the account if you don't respond. Federal opportunity data and aggregate analytics are kept indefinitely because they're not tied to you.

Children

CapturePilot is a B2B product for federal contractors. It's not designed for anyone under thirteen, and we don't knowingly collect data from children. If you think a child has signed up, email us and we'll delete the account.

Changes to this policy

If we change anything material — new sub-processor, new category of data, new use case — we'll email every active user at least thirty days before it takes effect. Small fixes (typos, clearer wording) we'll just push and update the "last updated" date at the top.

Contact

Questions, requests, complaints — all go to the same place: hello@capturepilot.com. A human answers.