Privacy Policy — BidTrakker

1. Introduction

GCExperts LLC ("we," "us," or "our") operates BidTrakker at bidtrakker.com. We are committed to protecting your privacy and handling your personal information with transparency. This Privacy Policy explains what data we collect, how we use it, and your rights regarding that data.

GCExperts LLC
Cedar Park, TX
Email: [email protected]

2. Information We Collect and Retain

To provide federal bid tracking, solicitation matching, desktop document synchronization, and dedicated AI assistant services, we collect and store the following categories of member and client data:

Category	Data Fields & Examples	Purpose & Schema Grounding
Account & Contact Information	Full name, username, business title, primary email, secondary/CC emails, primary phone, alternate phone, fax, company name, physical business address, city, state, and ZIP code.	Account registration, authentication, multi-channel customer support, bid alert delivery, and administrative communication. (clients.name, email, phone, phone2, fax, company_name, company_address; users.username, email)
Federal Contracting & Entity Identification	Unique Entity Identifier (UEI), Commercial and Government Entity (CAGE) code, Data Universal Numbering System (DUNS) number, Taxpayer Identification Number / Employer Identification Number (TIN/EIN), SAM.gov registration status, registration date, expiration date, entity type, congressional district, business size, small business certifications (8(a), HUBZone, SDVOSB, WOSB, EDWOSB, Veteran-Owned, Minority-Owned, Disadvantaged), NAICS industry codes, and past performance summaries.	Matching federal contract opportunities from SAM.gov, verifying government procurement eligibility, tailoring bid recommendations, and populating standard federal bid documentation. (clients.uei, cage_code, duns, tin, sam_registered, sam_expiration, sam_status, entity_type, naics_codes, certifications, past_performance, is_small_business, is_8a, is_hubzone, is_sdvosb)
Financial, Banking & Payment Data	Bank name, bank routing transit number, bank account number, account type (checking/savings), and Electronic Funds Transfer (EFT) acceptance are retained on file only where a member previously provided them. Bonding company, single and aggregate bond limits, bonding agent contact details (name, phone, email), insurance carrier, insurance agent contact details (name, phone), and authorized contract signer credentials are also retained. Payment Processing: Payment card transactions and recurring subscriptions are processed directly through Stripe, Inc. We store Stripe customer identifiers, payment method tokens, card brand, expiration date, card last 4 digits, charge identifiers, and payment intent records. Full card numbers are never stored on our servers.	Supporting existing members' federal EFT payment enrollment forms (SF 3881), verifying bonding and insurance capacity for project requirements, and processing subscription fees and prepaid AI usage balances. (clients.bank_name, bank_routing, bank_account, bank_account_type, accepts_eft, bonding_company, single_bond_limit, aggregate_bond_limit, bonding_agent_name, insurance_carrier, stripe_customer_id; ai_balance.card_brand, card_last4, card_exp_month, card_exp_year; ai_balance_ledger.stripe_payment_intent_id)
Proprietary Bidding & Estimation Data	Tracked bid solicitations, submitted bid amounts, proprietary cost breakdowns (labor, materials, equipment, subcontractor costs, overhead percentage, profit percentage, contingency percentage), opportunity notes, debriefing/protest tracking, and government Contracting Officer (CO) and Contracting Officer Representative (COR) contact records.	Managing member bid pipelines, tracking proposal outcomes, calculating cost breakdowns, and organizing government contracting officer interactions. (tracked_bids.submitted_amount, cost_labor, cost_materials, cost_equipment, cost_subs, cost_overhead_pct, cost_profit_pct, cost_contingency_pct, award_co_name, award_co_email, award_co_phone; bid_notes.body; user_watching)
Uploaded Documents & Synchronized Files	Solicitation packages, plans, specifications, drawings, amendments, subcontractor quotes, sample bids, and proprietary contractor paperwork uploaded through the web platform or synchronized via the BidTrakker desktop sync application (BidTrakkerCloud / ownCloud).	Hosting member project files, enabling desktop-to-cloud folder synchronization, extracting text for opportunity search, and preparing bid takeoff packages. (in_progress_files.file_path, display_name, file_size; clients.sample_bid_file; ownCloud sync storage)
Communications & AI Assistant Interactions	Inbound and outbound email messages, message subject lines, email attachments, conversation histories with dedicated per-client AI assistants (Trip agents), assistant prompt and completion token records, and telephone/voice advisory call metadata (call identifiers, duration, audio recordings, and call transcripts).	Operating dedicated per-client AI assistants (Trip agents) to draft responses, perform takeoff research, manage subcontractor outreach, deliver bid alerts, and log member advisory sessions. (email_history.subject, body, attachments, call_sid, transcript_json; personal_agent_queue.from_addr, to_addr, body, attachment_paths; trip_conversation_log.body)
Technical, Security & Audit Data	Login IP addresses, browser user agent strings, login timestamps, login methods, password reset tokens, desktop sync client versions and heartbeat timestamps, and formal terms acceptance audit logs (timestamp, version, IP address, user agent, legal signature name, form payload).	Ensuring platform security, authenticating authorized members, verifying legal agreements, troubleshooting desktop sync connectivity, and preventing unauthorized access. (user_logins.ip_address, user_agent, logged_in_at, login_method; terms_acceptance_log.accepted_at, accepted_ip, legal_name, raw_form_payload; sync_client_versions; install_heartbeats)

3. How We Use Your Information

We use the data we collect strictly to provide, maintain, and secure the BidTrakker platform, including:

Procurement Matching: Filtering and matching daily SAM.gov federal contract solicitations against your registered NAICS codes, business certifications, bonding capacity, and geographic preferences.
Bid & Proposal Management: Maintaining your private bid tracking pipeline, storing proprietary cost estimates, and organizing procurement documents.
Dedicated AI Assistant Services: Powering your dedicated per-client AI assistant (Trip agent) to review solicitations, analyze plan specifications, draft email communications, and assist with bid takeoff preparations.
File Synchronization: Syncing project files, solicitations, and bid documents between your local workstation and the cloud via the BidTrakker desktop sync application.
Billing & Account Management: Verifying active GCExperts membership, processing recurring subscription charges, managing prepaid AI assistant usage balances, and recording payment transactions via Stripe.
Legal & Security Auditing: Authenticating account access, verifying terms acceptance, monitoring system integrity, detecting abuse, and complying with statutory record-retention requirements.

4. We Do Not Sell Your Data

GCExperts LLC does not sell, rent, lease, or trade your personal information to any third party. We do not participate in data broker networks and we do not monetize your data in any way beyond providing the BidTrakker service to you.

5. Third-Party Services

To operate BidTrakker, we transmit necessary data to the following specific third-party service providers, each subject to their respective privacy policies and security commitments:

Stripe, Inc. — Payment gateway and subscription management. Processes customer contact details, payment card information, subscriptions, and prepaid balances under Stripe's Privacy Policy. We receive and store customer IDs, card brand, last 4 digits, expiration dates, and transaction records.
SAM.gov / U.S. General Services Administration (GSA) — Federal procurement data intake and registration validation. We retrieve public solicitation records and verify vendor registration status (UEI, CAGE, active status) with federal systems.
Anthropic, PBC — Artificial intelligence language model infrastructure. Processes solicitation text, user prompts, email correspondence, and proposal notes through Claude models to provide automated analysis and draft assistance for per-client Trip agents.
OpenAI, LLC — Artificial intelligence language model infrastructure. Processes solicitation summaries, categorization, and report generation queries.
Twilio, Inc. — Telecommunications infrastructure. Processes phone calls, call audio, and transcription services for voice-assisted advisory interactions.
Dedicated Mail Infrastructure (Mailcow / AWS) — Hosted mail services operating at mail.gcexperts.ai on dedicated cloud infrastructure for inbound and outbound communication managed by per-client AI assistants.
Amazon Web Services (AWS) — Core cloud infrastructure provider. Hosts application servers, databases, and file storage on secure, U.S.-based cloud servers.
Cloudflare, Inc. — Network transit, content delivery, DDoS mitigation, and edge security (including Cloudflare Tunnel and Turnstile verification). Processes visitor IP addresses and technical request headers at the network edge.
Google LLC (Google Analytics) — Aggregate web analytics. Collects aggregate page views and usage metrics strictly with user cookie consent (never tracking credentials, form inputs, or private files).

We do not sell, rent, or share your personal information with any third party for marketing, advertising, or data-broker purposes.

6. Cookies

BidTrakker uses essential session cookies to keep you logged in and secure your session. With your consent only, we also use Google Analytics cookies to measure aggregate site usage (page views and page titles). We never use advertising cookies, we never use analytics to track you across other websites, and we never send your account credentials, form entries, or private file names to analytics. You may accept or reject analytics at any time via the cookie banner or our Cookie Policy.

7. Data Storage & Physical Locations

Member data resides across several dedicated physical and cloud storage locations on U.S.-based infrastructure provided by Amazon Web Services (AWS):

Primary Relational Databases: Relational PostgreSQL databases storing member profile records, contracting credentials, proprietary bid tracking data, and audit logs.
BidTrakkerCloud (ownCloud) Storage: Dedicated storage volumes housing synchronized member project directories, bid document archives, and specifications.
Server File Stores: Dedicated server directories housing uploaded paperwork, proposal PDFs, and sample bid files.
Per-Client AI Mailboxes & Attachment Stores: Dedicated mailboxes and attachment directories supporting client-specific email agents (Trip agents).

Security Measures: We implement administrative, physical, and technical safeguards, including:

Mandatory encryption in transit (TLS 1.2/1.3) for all web traffic, API calls, and database connections.
Role-based access controls restricting database and server access to authorized systems.
Tokenized payment processing via Stripe, ensuring complete payment card details remain off application servers.
Regular operational and configuration security reviews.

While we implement reasonable safeguards to protect your information, no electronic transmission or storage method is completely secure, and absolute security cannot be guaranteed.

8. Your Rights

You have the following rights regarding your personal data:

Right to Know: You may request a summary of the personal information we have collected about you.
Right to Delete: You may request deletion of your personal data. We will comply within 45 days, subject to legal obligations requiring data retention.
Right to Correct: You may request correction of inaccurate personal information.
Right to Opt-Out: Since we do not sell personal data, this right is satisfied by default.
Account Removal: You may request complete removal of your BidTrakker account and associated data.
Non-Discrimination: We will not discriminate against you for exercising any of these rights.

To exercise any of these rights, contact us at [email protected]. We will verify your identity before processing any request.

9. State Privacy Law Compliance

GCExperts LLC complies with applicable U.S. state privacy laws, including but not limited to:

California Consumer Privacy Act (CCPA/CPRA): California residents have the rights described in Section 8 above. We do not sell personal information as defined under the CCPA.
Texas Data Privacy and Security Act (TDPSA): Texas residents have the right to access, correct, delete, and obtain a copy of their personal data.
Other State Laws: We extend equivalent rights to residents of all U.S. states with comprehensive privacy legislation, including Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and others as enacted.

10. Data Retention & Deletion Procedure

We retain your personal data and proprietary bidding records only for as long as necessary to fulfill the service purposes described in this policy:

Active Membership: Member profiles, contracting credentials, tracked bids, synchronized project files, and communication histories are retained throughout the duration of your active subscription to maintain your service history and sync capability.
Lapsed or Cancelled Accounts: Following account cancellation or membership lapse, your data is retained for a grace period of up to 90 days to permit account reactivation without loss of bid history.
Account Deletion Procedure: Upon receiving a verified deletion request or following the 90-day post-termination window, we initiate a multi-store deletion procedure that removes your data from our primary databases, local data mirrors, BidTrakkerCloud (ownCloud) storage volumes, uploaded file directories, and AI assistant attachment archives, except where retention is strictly required for tax, accounting, dispute resolution, or legal compliance.

11. Children's Privacy

BidTrakker is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected data from a minor, please contact us immediately at [email protected].

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with a revised "Last Updated" date. For material changes, we will make reasonable efforts to notify you via email or through the Service. Your continued use of BidTrakker after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact:

GCExperts LLC
Cedar Park, TX
Email: [email protected]