PRIVACY POLICY

1. Who We Are

SAY, BOSS. (“we,” “us,” or “our”) operates sayboss.com, an AI proposal platform for small federal contractors. We turn solicitations into compliance matrices, capability statements, and proposal skeletons, and scan SAM.gov for opportunities matched to your company profile. Questions: hi@sayboss.com.

2. What We Collect

• Account data — email address, authentication credentials, and subscription/billing status. Payment is processed by Stripe; we never see or store card numbers.
• Company profile — company name, UEI, CAGE code, website, NAICS codes, set-aside eligibility, capture keywords, capabilities narrative, and past-performance records you enter. This data exists solely to score opportunities and generate your documents.
• Uploaded solicitation documents — RFPs, RFQs, and related files you upload for processing.
• Usage data — document generation events, API usage metrics, and standard server logs (IP address, browser type) used for abuse prevention. No third-party advertising trackers.

3. Your Documents Are Not Used to Train AI Models

We process your solicitation documents and company profile with the Anthropic API, which does not train models on customer data submitted via its API. We do not use your documents, profile, or generated outputs to train any AI model, and we do not sell your data. Your uploads are visible only to your company’s account.

4. Storage, Security, and Retention

• All customer data is stored in the United States.
• Uploaded solicitations and generated documents live in private, access-controlled storage, encrypted at rest and in transit. Download links are signed and expire.
• Uploaded solicitation files are deleted after 90 days by default. Generated documents remain in your library until you delete them or close your account.
• Row-level security isolates every tenant — your data is never visible to another customer.

5. Subprocessors

We use the following subprocessors to operate the service:

• Anthropic — AI document processing (no training on customer data)
• Google — AI research and scanning phases (Gemini API)
• Supabase — database, authentication, and file storage (US region)
• Stripe — payment processing
• Vercel — application hosting
• Resend — transactional email

6. Public Data Sources

Opportunity data in your pipeline comes from the SAM.gov public API. It is public federal procurement information and is not subject to this policy’s confidentiality provisions.

7. Your Choices

• Edit or delete your company profile at any time in Settings.
• Delete generated documents from your library.
• Request full account deletion at hi@sayboss.com — we remove your account data, uploads, and generated documents within 30 days.

8. Compliance Notes

SAY, BOSS. is not FedRAMP authorized and is not intended for processing government data — it processes your own pre-award business development documents. Do not upload classified, CUI, or export-controlled material. If your organization has specific compliance requirements, contact us before uploading.

9. Changes

We’ll post material changes here and update the date above. Continued use after changes means you accept the updated policy.