Legal
RFP Command ("we," "us," or "our") operates the RFP Command platform, accessible at rfpcommand.com and associated subdomains (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.
By using RFP Command, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.
When you register for an account, we collect:
| Data Type | Examples | Purpose |
|---|---|---|
| Name | First and last name | Account identification and personalization |
| Email address | work@yourcompany.com | Account login, notifications, and support |
| Password | Stored as a bcrypt hash — never in plaintext | Authentication |
| Organization name | Your business name | Team workspace identification |
| Billing information | Credit card (last 4 digits only), billing address | Paid plan processing via Stripe — we do not store full card numbers |
The core of RFP Command is your bid pipeline. Information you enter into the Service — including opportunity titles, solicitation numbers, agency names, contract values, compliance notes, bid decisions, tags, and any other data you input — is stored on our servers on your behalf. This data is your data. We treat it as confidential business information and do not use it for any purpose other than providing the Service to you.
We automatically collect certain technical information when you use the Service:
We use privacy-respecting analytics (not Google Analytics by default) and do not build individual behavioral profiles for advertising purposes.
If you contact us for support or send us feedback, we retain the content of that communication and your contact information to respond and to improve the Service.
We use the information we collect for the following purposes:
We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following limited circumstances:
| Provider | Purpose | Data Shared |
|---|---|---|
| Supabase | Database hosting and authentication | Account data and pipeline data — stored in US-based servers |
| Stripe | Payment processing | Billing information — RFP Command never stores full card numbers |
| Vercel | Application hosting and CDN | Request logs and IP addresses |
| Resend / similar | Transactional email delivery | Email address and message content for emails you trigger |
All service providers are contractually bound to use your data only to provide services to us and to protect it in accordance with applicable law.
If you use RFP Command as part of an organizational account, your account information and the pipeline data you enter is visible to other members of your team workspace that you or your administrator have authorized.
We may disclose your information if required by law, subpoena, court order, or governmental authority, or when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.
If RFP Command is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice on the Service before your information is transferred and becomes subject to a different privacy policy.
We retain your personal information for as long as your account is active or as needed to provide you the Service. Specifically:
To request early deletion of your account and data, contact us at the address in Section 11.
We implement industry-standard technical and organizational security measures to protect your information:
We use cookies and similar technologies to operate and improve the Service. We do not use advertising cookies or third-party tracking pixels.
| Cookie Type | Purpose | Can You Opt Out? |
|---|---|---|
| Session cookies | Maintain your logged-in state while using the Service | No — required for the Service to function |
| Preference cookies | Remember your settings (e.g., dashboard filters) | Yes — clearing cookies removes these |
| Analytics cookies | Understand aggregate usage patterns to improve the Service | Yes — contact us to opt out |
We do not use Google Analytics, Facebook Pixel, or other advertising network trackers. We have no advertising business model.
Depending on your location, you may have rights regarding your personal information. We honor these rights regardless of whether applicable law requires it:
To exercise any of these rights, contact us at hello@rfpcommand.com. We will respond within 30 days. We will never discriminate against you for exercising your privacy rights.
Under the California Consumer Privacy Act, California residents have additional rights including the right to know, right to delete, and right to opt out of the sale of personal information. We do not sell personal information. To submit a CCPA request, use the contact information in Section 11.
Residents of Virginia (VCDPA), Colorado (CPA), and Connecticut (CTDPA) have similar rights to access, correct, delete, and obtain a copy of their data. To exercise these rights, contact us at hello@rfpcommand.com.
RFP Command is a professional business tool and is not directed to individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If we become aware that we have inadvertently collected personal information from a minor, we will delete it promptly. If you believe we have collected information from a minor, please contact us at hello@rfpcommand.com.
The Service may contain links to third-party websites or services — for example, links to SAM.gov, state procurement portals, or SBA resources. These sites have their own privacy policies, and we are not responsible for their practices. We encourage you to review the privacy policies of any third-party sites you visit. The inclusion of a link does not imply our endorsement of that site or its privacy practices.
We may update this Privacy Policy from time to time. When we make material changes, we will:
Your continued use of the Service after the effective date of a revised policy constitutes acceptance of the updated policy. If you do not agree to the updated policy, you should stop using the Service and may request account deletion.
If you have questions about this Privacy Policy, wish to exercise your rights, or need to report a security concern, please contact us:
We aim to respond to all privacy-related inquiries within 5 business days and will complete all data requests within 30 days.