Privacy Policy

1. SCOPE AND APPLICATION

1.1 Who This Policy Applies To. This Privacy Policy applies to visitors of our website, individual users of the Platform, members of Organization Accounts, and administrators of subscribing organizations.

1.2 Relationship With Organization Customers. When you use the Platform as part of an Organization Account, your employer or the organization that provisioned your account is our customer, and we process your personal information on that organization's behalf under our Terms of Service and any Data Processing Addendum. The organization determines what data you may upload, who may access it, and how long it is retained. Please contact your Organization Administrator with questions about how your organization uses the Platform.

1.3 Third-Party Websites. This Privacy Policy does not cover third-party websites, applications, or services that may link to or from the Platform, including SAM.gov, PASSPort NYC. Those sites are governed by their own policies.

2. INFORMATION COLLECTED

We collect information in the following categories.

2.1 Account Information. When you register, we collect your full name, email address, password (stored in hashed form by our authentication provider), organization affiliation, job title, phone number if provided, preferred interface language (English or Arabic), and time zone.

2.2 Organization Information. When your organization creates an Organization Account, we collect the legal name of the organization, business address, primary contact information, tax identification information where required for billing, and information about members added to the Organization Account.

2.3 Government Contract Information. When you use the Platform to track opportunities, proposals, and contracts, we collect and store contract records, opportunity data ingested from public government sources including SAM.gov, PASSPort NYC, proposal drafts, pricing calculations, capture information, past performance records, notes, comments, and workflow status.

2.4 Uploaded Documents. When you upload files to the Platform, we store the file itself along with metadata including the filename, file size, content type, upload timestamp, uploading user, and any tags or classifications you apply. Common uploaded file types include PDF solicitations, Word proposals, Excel pricing workbooks, capability statements, past performance references, and compliance documentation.

2.5 Communications. When you contact support, submit feedback, or communicate through in-application messaging, we collect the content of those communications along with routing information.

2.6 Usage and Device Information. When you use the Platform, we automatically collect information about your device and interactions, including IP address, browser type and version, operating system, device type, referring URL, pages viewed, features accessed, timestamps, and diagnostic information about errors and performance.

2.7 Cookies and Similar Technologies. We use cookies and similar technologies to maintain your session, remember preferences, and analyze Platform usage. See Section 6 (Cookies and Analytics) for details.

2.8 Payment Information. When you subscribe to a paid plan, our payment processor Stripe Inc. collects your payment card or bank information directly. We receive from Stripe a masked card identifier, cardholder name, billing address, and transaction status. We do not directly store full payment card numbers.

2.9 AI Feature Inputs and Outputs. When you use AI Features, we log the inputs you submit and the outputs generated, associated with your account, for the purposes of feature operation, quality monitoring, and error debugging. See Section 5 (AI Processing).

2.10 Information Received From Third Parties. If you sign in through a third-party identity provider or connect an external integration, we may receive limited profile information from that provider. If publicly available government data sources include information about you or your organization, that information may become part of your Platform records.

3. GOVERNMENT CONTRACT INFORMATION

3.1 Nature of This Category. Government contract information is a central category of data processed by the Platform. This includes public solicitation records, award notices, contractor registrations, and contract vehicle information drawn from official government sources, along with your organization's private capture strategy, pricing, teaming arrangements, and internal notes.

3.2 Ingestion From Public Sources. The Platform ingests publicly available opportunity and award data from SAM.gov, PASSPort NYC. Because this data is public, no confidentiality is asserted over the raw source records themselves, but your annotations, ratings, notes, capture strategy, and derived analytics are treated as your confidential information under Section 20 of our Terms of Service.

3.3 Prohibited Categories. As stated in the Terms of Service, you may not upload to the Platform classified information, SP-CUI requiring FedRAMP High controls, ITAR-controlled technical data, EAR export-restricted technical data, source selection sensitive information not authorized for commercial cloud storage, or Covered Defense Information subject to DFARS 252.204-7012 obligations that AlBaraka does not currently meet.

3.4 Use of Government Contract Information. We process your government contract information to operate the Platform features you use, including opportunity tracking, proposal management, pricing calculations, and compliance workflow. We do not sell or share your government contract information with third parties except as described in Section 8 (Information Sharing).

4. UPLOADED DOCUMENTS

4.1 Storage. Uploaded documents are stored in Supabase Object Storage within United States infrastructure regions. Access is restricted by PostgreSQL Row Level Security policies to your organization and authorized users within your organization.

4.2 Processing. We process uploaded documents to (a) display them within the Platform, (b) generate previews and thumbnails, (c) extract text content for search, (d) perform metadata indexing, and (e) submit relevant excerpts to AI Features when you invoke them.

4.3 Retention. Uploaded documents are retained for the duration of your Subscription and for the Retention Period defined in the Terms of Service after termination, unless earlier deleted by you or your Organization Administrator.

5. AI PROCESSING

5.1 AI Features. When you invoke AI Features, including opportunity analysis, bid recommendation, proposal drafting assistance, pricing suggestions, compliance checks, and document summarization, the Platform transmits relevant inputs to Anthropic PBC ("Anthropic") for processing by Claude language models.

5.2 What Is Sent to Anthropic. The specific inputs sent to Anthropic depend on the feature invoked and may include portions of your uploaded documents, opportunity descriptions, proposal drafts, pricing data, and your written prompts. We do not send personal identifiers such as your name, email address, or account credentials to Anthropic unless they appear within the content you submit to the AI Feature.

5.3 Anthropic Data Handling. We access Anthropic's Claude models through its Application Programming Interface. Under Anthropic's applicable API policies as of the Effective Date, inputs sent to Anthropic through the API are not used to train Anthropic's models. Anthropic may retain inputs and outputs for a limited period to detect abuse and provide the service. Anthropic's applicable data handling terms are available at https://www.anthropic.com.

5.4 Purpose Limitation. We use AI Feature inputs and outputs only to (a) generate the requested output for you, (b) monitor feature quality and detect errors, (c) prevent abuse, and (d) improve Platform performance in aggregated and de-identified form.

5.5 Human Review. AI Feature inputs and outputs may be reviewed by AlBaraka personnel or authorized service providers under confidentiality obligations for troubleshooting, quality assurance, and abuse detection.

5.6 Opt-Out. You may disable AI Features for your Organization Account through settings. Disabling AI Features prevents further transmission of your data to Anthropic through the API for AI Feature operation.

6. COOKIES AND ANALYTICS

6.1 Cookies We Use. We use the following categories of cookies and similar technologies:

(a) Strictly Necessary. These cookies maintain your authenticated session, protect against cross-site request forgery, and enable core functionality. You cannot disable these cookies without losing access to the Platform.

(b) Preference. These cookies remember your interface preferences, including language selection between English and Arabic, and display settings.

(c) Analytics. These cookies help us understand how the Platform is used in aggregate, so we can improve performance and features. Analytics data is limited to first-party observations by the Platform and does not include third-party advertising trackers.

6.2 Error Monitoring. We use Sentry (operated by Functional Software Inc.) to collect diagnostic information about application errors and performance. Sentry may collect IP address, browser type, session identifiers, and stack traces. This helps us identify and fix bugs. IP addresses are truncated where feasible.

6.3 No Advertising Tracking. We do not use third-party advertising cookies or share your information with advertising networks. We do not participate in cross-site behavioral advertising.

6.4 Do Not Track. Because there is no consensus industry standard for Do Not Track signals, our Platform does not currently respond to them. We do not track you across other websites regardless.

6.5 Managing Cookies. You may manage cookies through your browser settings. Blocking strictly necessary cookies will prevent you from logging in or using the Platform.

7. HOW INFORMATION IS USED

We use the information we collect for the following purposes:

7.1 Providing the Platform. To operate, maintain, and deliver the features of the Platform, including authenticating your access, storing your data, generating AI Output, processing payments, and delivering notifications.

7.2 Improving the Platform. To analyze usage patterns, diagnose errors, measure performance, and develop new features. Analysis is performed on aggregated and, where feasible, de-identified data.

7.3 Communicating With You. To send transactional emails through Resend Inc., including account verifications, password resets, receipt confirmations, subscription notices, feature announcements affecting your Subscription, security alerts, and responses to support requests.

7.4 Security and Abuse Prevention. To detect, investigate, and prevent fraudulent activity, unauthorized access, abuse of the Platform, and violations of the Terms of Service or Acceptable Use Policy.

7.5 Legal Compliance. To comply with applicable law, respond to lawful requests from public authorities, enforce our Terms of Service, protect our rights and property, and protect the safety of users and the public.

7.6 Business Operations. For internal business purposes including accounting, auditing, insurance, corporate development, and legal matters.

7.7 With Your Consent. For any other purpose disclosed to you and to which you have provided consent.

8. LEGAL BASES WHERE APPLICABLE

Where United States privacy law applies, we rely on the following legal bases and interests to process personal information:

8.1 Contract Performance. Processing necessary to provide the Platform to you and your organization under our Terms of Service.

8.2 Legitimate Interests. Processing necessary for our legitimate interests in operating a secure, reliable, and improving software service, provided such interests are not overridden by your rights and interests.

8.3 Legal Obligation. Processing required by law, including tax reporting, responses to subpoenas, and cooperation with lawful government investigations.

8.4 Consent. Where required by law, we obtain your affirmative consent, for example before enabling optional features that involve additional processing.

For users in other jurisdictions with data protection laws that impose specific legal basis requirements, we apply the closest analogous basis where United States law permits.

9. INFORMATION SHARING

We do not sell your personal information. We share personal information only as described below.

9.1 Within Your Organization. Members and Administrators of your Organization Account may access your Platform activity, uploaded documents, and User Content in accordance with role-based permissions configured by the Administrator.

9.2 With Service Providers. We share information with service providers who help us operate the Platform. See Section 10 (Service Providers).

9.3 In Business Transactions. If AlBaraka is involved in a merger, acquisition, financing due diligence, or sale of all or substantially all assets, personal information may be transferred to the successor entity or advisor under confidentiality obligations, subject to continuing protection consistent with this Privacy Policy.

9.4 Legal Requirements. We may disclose personal information if required by law, in response to valid legal process, or where we reasonably believe disclosure is necessary to (a) comply with a subpoena, court order, or other legal obligation, (b) protect the rights, property, or safety of AlBaraka, our users, or the public, or (c) investigate fraud or violations of our Terms of Service.

9.5 Aggregated and De-Identified Data. We may share aggregated statistics or de-identified data that cannot reasonably be used to identify you or your organization, for research, benchmarking, or product improvement.

9.6 With Consent. We share information with third parties when you direct us to do so, such as when you connect an integration or authorize a specific export.

10. SERVICE PROVIDERS

We rely on the following third-party service providers to operate the Platform. Each provider is subject to contractual obligations to protect personal information and use it only for the purposes we specify.

10.1 Vercel Inc. Hosts the Platform application and delivers static assets through a content delivery network. Vercel processes IP addresses, request metadata, and application traffic. Vercel operations are primarily in United States regions.

10.2 Supabase Inc. Provides authentication services, PostgreSQL database hosting, and object storage for uploaded documents. Supabase stores your account credentials in hashed form, your account and organization records, your government contract data, and your uploaded files.

10.3 Cloudflare Inc. Provides domain name services, network security including denial-of-service protection, and traffic routing. Cloudflare may temporarily process request metadata including IP addresses and browser characteristics.

10.4 Stripe Inc. Processes payment transactions for paid Subscriptions. Stripe collects payment card or bank account information directly from you and shares limited transaction metadata with us.

10.5 Resend Inc. Sends transactional email including verification emails, password resets, receipts, and account notifications. Resend processes recipient email addresses, message content, and delivery status.

10.6 Sentry (Functional Software Inc.). Collects diagnostic information about application errors and performance, including stack traces, browser information, and truncated IP addresses.

10.7 Anthropic PBC. Provides the Claude language models that power AI Features. Anthropic processes inputs sent through the Application Programming Interface as described in Section 5.

11. DATA RETENTION

11.1 General Approach. We retain personal information for as long as your account is active and for a reasonable period afterward as required to fulfill the purposes described in this Privacy Policy, comply with legal obligations, resolve disputes, and enforce agreements.

11.2 Account Data. Account information is retained for the duration of your account and for up to twelve (12) months after account closure, after which it is deleted or de-identified, subject to backup rotation periods of up to ninety (90) days.

11.3 Uploaded Documents and User Content. Uploaded documents and User Content are retained for the duration of your Subscription and for the thirty (30) day Retention Period after termination described in the Terms of Service. After the Retention Period, User Content is deleted from primary storage. Backup copies may persist for up to ninety (90) days before rotation.

11.4 Payment Records. Transaction records are retained for a minimum of seven (7) years to comply with tax and accounting obligations.

11.5 Communications. Support communications are retained for up to twenty-four (24) months.

11.6 Log Data. Server logs, error reports, and diagnostic data are retained for up to ninety (90) days for security monitoring and troubleshooting, after which they are deleted or aggregated.

11.7 Legal Holds. If personal information is subject to a legal hold, subpoena, or ongoing dispute, we may retain it for the duration of the applicable legal requirement.

12. SECURITY MEASURES

12.1 Existing Security Controls. As of the Effective Date, we implement the following technical and organizational security measures:

(a) Encryption in transit. All connections between your browser and the Platform are secured through Transport Layer Security (TLS 1.2 or higher).

(b) Encryption at rest. Database contents and object storage in Supabase are encrypted at rest using industry standard algorithms managed by our cloud infrastructure providers.

(c) Authentication. User authentication is provided through Supabase Auth. Passwords are stored as cryptographic hashes and are not accessible to AlBaraka personnel in plaintext.

(d) Access controls. PostgreSQL Row Level Security policies enforce data isolation between organizations and role-based access within organizations.

(e) Network protection. Cloudflare provides denial-of-service protection and network filtering at our public perimeter.

(f) Application monitoring. Sentry provides real-time error monitoring, enabling rapid detection of anomalies.

(g) Audit logging. The Platform maintains an audit trail of significant actions including document access, permission changes, and administrative operations.

(h) Least privilege administration. Access to production systems by AlBaraka personnel is limited to those with a documented business need and is subject to authentication.

(i) Vendor due diligence. We rely on third-party providers with established security programs and require appropriate contractual protections.

12.2 Roadmap Security Enhancements. The following controls are planned but not yet in place as of the Effective Date. No timeline or guarantee of implementation is provided, and no representation should be made that the Platform currently satisfies these controls: (a) Formal SOC 2 Type II attestation; (b) ISO 27001 certification; (c) FedRAMP authorization; (d) Cybersecurity Maturity Model Certification (CMMC); (e) Independent third-party penetration testing on a scheduled cadence; (f) Formal Business Continuity Plan and disaster recovery exercises; (g) Customer-managed encryption keys; (h) Single sign-on and multi-factor authentication enforcement for enterprise plans.

12.3 No Absolute Security. No system can be guaranteed to be completely secure. You are responsible for protecting your credentials, using strong passwords, and reporting suspected security incidents promptly to [email protected].

12.4 Data Breach Notification. If we become aware of a breach of security that has resulted or is reasonably likely to result in unauthorized access to your personal information, we will notify affected users and, where required, regulatory authorities as promptly as practicable and in any event within the timeframes required by applicable law.

13. INTERNATIONAL TRANSFERS

13.1 Primary Processing Location. Platform infrastructure operates primarily in United States regions. If you access the Platform from outside the United States, your personal information will be transferred to and processed in the United States.

13.2 Service Provider Locations. Certain service providers may process personal information in other jurisdictions in accordance with their respective policies.

13.3 Transfer Mechanisms. For users in jurisdictions requiring specific data transfer mechanisms, we rely on the transfer safeguards required by the applicable law and available under United States commercial practice. We do not currently offer data residency options outside the United States.

14. USER RIGHTS

Depending on your jurisdiction, you may have the following rights regarding your personal information.

14.1 Access. You may request confirmation of whether we process personal information about you and a copy of that information.

14.2 Correction. You may request that we correct inaccurate or incomplete personal information.

14.3 Deletion. You may request deletion of your personal information, subject to legitimate exceptions including legal retention obligations, fraud prevention, and enforcement of agreements.

14.4 Portability. You may request a copy of personal information you provided to us in a structured, commonly used, machine-readable format.

14.5 Restriction. You may request restriction of processing in certain circumstances.

14.6 Objection. You may object to processing based on legitimate interests.

14.7 Withdrawal of Consent. Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

14.8 Complaints. You have the right to lodge a complaint with a data protection authority in your jurisdiction.

14.9 Organization Account Users. If you are a member of an Organization Account, your Organization Administrator may control the exercise of certain rights. Requests should be directed to your Administrator in the first instance. We will refer your request to the Administrator where the Administrator controls the underlying processing.

14.10 How to Exercise Rights. To exercise any of these rights, contact [email protected] with a description of your request and information sufficient to verify your identity. We will respond within the time periods required by applicable law.

14.11 Verification. To protect your privacy, we may request additional information to verify your identity before responding to a request. If we cannot verify your identity, we may decline the request.

14.12 No Discrimination. We will not deny service, charge a different price, or provide a different quality of service based on your exercise of privacy rights, except where a difference is reasonably related to the value of the personal information to us.

15. CALIFORNIA PRIVACY RIGHTS

15.1 Applicability. This section applies to California residents under the California Consumer Privacy Act as amended by the California Privacy Rights Act (collectively, the "CCPA").

15.2 Categories of Information Collected. In the preceding twelve (12) months, we may have collected the following CCPA categories of personal information: identifiers, commercial information, internet or other electronic network activity information, geolocation data derived from IP address, professional or employment-related information, and inferences drawn from the foregoing.

15.3 Sources. We collect personal information from you directly, from your organization, from third-party service providers listed in Section 10, and from public government data sources.

15.4 Purposes. Personal information is used for the purposes described in Section 7.

15.5 Disclosures. In the preceding twelve (12) months we have disclosed personal information for business purposes to the service providers listed in Section 10.

15.6 No Sale or Sharing. We do not sell personal information as defined by the CCPA. We do not share personal information for cross-context behavioral advertising.

15.7 Sensitive Personal Information. We do not use or disclose sensitive personal information for purposes other than those permitted under the CCPA without providing you the right to limit such use.

15.8 California Rights. California residents have the right to (a) know what personal information we collect, use, disclose, and sell or share, (b) delete personal information, subject to CCPA exceptions, (c) correct inaccurate personal information, (d) opt out of the sale or sharing of personal information (not applicable because we do not sell or share), and (e) not be discriminated against for exercising rights.

15.9 Authorized Agents. You may designate an authorized agent to make requests on your behalf. The agent must provide written proof of authorization, and we may require verification directly from you.

15.10 How to Submit Requests. California residents may submit CCPA requests by contacting [email protected].

15.11 Shine the Light. California residents may request a notice describing what categories of personal information we share with third parties for their direct marketing purposes. We do not currently share personal information with third parties for their direct marketing purposes.

16. OTHER STATE PRIVACY RIGHTS

16.1 State-Specific Rights. Residents of certain other United States states, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws, may have rights similar to those described in Section 14 and Section 15.

16.2 How to Exercise Rights. State residents may submit rights requests by contacting [email protected]. We will respond within the timeframes required by the applicable state law.

16.3 Appeals. If we deny your rights request, you may appeal by responding to our decision. If your appeal is denied, you may contact your state attorney general.

17. CHILDREN'S PRIVACY

17.1 Age Requirement. The Platform is not directed to children under eighteen (18) years of age, and we do not knowingly collect personal information from anyone under eighteen (18). Account registration requires an affirmation that you are at least eighteen (18) years old.

17.2 Discovery. If we learn we have collected personal information from a child under eighteen (18), we will delete that information promptly.

17.3 Parental Contact. Parents or guardians who believe a child has provided personal information to the Platform may contact [email protected].

18. POLICY UPDATES

18.1 Modifications. We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. The Effective Date at the top of this Privacy Policy will reflect the latest revision.

18.2 Notice of Material Changes. For material changes, we will provide advance notice by email to the address associated with your account or through in-application notification.

18.3 Continued Use. Your continued use of the Platform after the effective date of an updated Privacy Policy constitutes acceptance of the changes. If you do not agree, you must stop using the Platform.

18.4 Historical Versions. Prior versions of this Privacy Policy will be made available upon request to [email protected].

19. CONTACT INFORMATION

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices:

For time-sensitive privacy requests, please use the subject line "Privacy Request" to help us route your inquiry appropriately.