Privacy Policy

This policy explains what GCF Data collects about you, why, and what you can do about it. It covers gcfdata.com and the member application.

• Account details: your name, email address and password (stored hashed, never in readable form).
• Company profile: what you tell us or confirm about your business: NAICS codes, certifications, agencies of interest, keywords, and any capability statement you upload or company website you ask us to read.
• Usage: saved records and searches, alert preferences, sign-in times, and technical details such as IP address and browser, which we also use to detect shared accounts.
• Billing: handled by Stripe. We never see or store your card number. We keep a Stripe customer reference, your plan, and licence count.

We do not buy personal data about you, we do not track you across other websites, and we do not run advertising networks on the Service.

To provide the Service: authenticate you, match opportunities to your profile, send the alerts you have asked for, take payment, provide support, and protect the Service from abuse and licence sharing. We rely on performance of our contract with you, and our legitimate interest in operating and securing the Service.

We send transactional email (account, billing, password) and, if enabled, alert email such as saved-search alerts, watch updates and the weekly market brief. You can turn alert email off at any time in Settings without closing your account. Transactional email cannot be disabled while your account is open.

Only the processors we need to run the Service: Stripe (payments), our hosting provider, our email delivery provider, and Anthropic, whose models generate written summaries. Where a summary is generated, the records concerned and a short profile description are sent to that provider for processing; this is not used to train their models. We do not sell your personal data, and we do not share it for advertising.

We may disclose information if legally required, or to protect the Service or its users.

We keep account and profile data while your account is open. If you close it, we delete or anonymise your personal data within 90 days, except records we must keep for tax or accounting purposes. Backups containing your data are retained on a rolling basis and overwritten in the ordinary course.

You can view and edit your profile in Settings, turn off alert email, export your saved records, or ask us to delete your account and personal data. Depending on where you live you may also have rights to access, correct, port or delete your data, and to object to certain processing. Contact us and we will action it.

Access is over HTTPS, passwords are hashed, admin areas are restricted, and repeated failed sign-ins are rate-limited. No system is perfectly secure, and we do not claim to hold any formal security certification.

The federal and state records in GCF Data are public government data. They sometimes contain names and contact details of government officials, published by the agency. That is source data, not information we collected about you.

The Service is for business use and is not directed at anyone under 18.

Questions or requests: see the contact page.

The data controller for the Service is GCF Data LLC.