Privacy Policy
This Privacy Policy describes how FedM8 ("FedM8," "we," "us," or "our") collects, uses, and shares information in connection with the FedM8 AI websites and applications, including ai.fedm8.com and scan.fedm8.com (together, the "Service"). By using the Service, you agree to the collection and use of information as described in this Policy.
1. Information we collect
Information you provide.
- Account information — email address and a password, or credentials received from a third-party sign-in provider you choose (such as LinkedIn or Google). We receive your name and email from that provider; we never see your password for it.
- Business profile and Veteran Directory information — details you choose to enter, such as company name, NAICS codes, certifications, capability statements, and contact preferences. You control what is publicly visible in the Directory; identifiers such as CAGE, UEI, email, and phone remain hidden unless you choose to show them.
- Support communications — the contents of tickets you submit through our support form.
- Preferences — saved searches, alert settings, walkthrough progress, and email digest choices.
Information collected automatically. Log and usage data such as IP address, browser type, pages viewed, and timestamps; and locally stored data (localStorage) used to remember your session and in-app progress. We use Microsoft Clarity to understand how the Service is used (heatmaps and anonymized session replay). Clarity may set its own cookies; see Microsoft's documentation for details. We do not use third-party advertising cookies.
Activity and AI conversation history. So a real person can troubleshoot your account when you ask for help, we keep a support record of what you did in the app — pages opened, searches run, tools used, and errors — together with the full text of your FedM8 AI prompts and the replies you received. Only FedM8 administrators can read it, you can request your own copy at any time, and it is automatically deleted after 90 days. It is never sold, never used for advertising, and never used to train third-party AI models.
Payment information. Payments are processed by Stripe. Your full card number never reaches our systems; we store only a customer reference, subscription status, and billing history.
What we deliberately do not collect. We never ask for discharge papers, DD-214s, disability ratings, or other personal service records. We do not ask for and do not store SAM.gov or Login.gov credentials.
2. How we use information
- To provide, maintain, and improve the Service, including personalizing opportunity matching to the profile you provide
- To process subscriptions and send transactional messages (receipts, alerts you request, account notices)
- To respond to support requests
- To protect the Service, including fraud prevention, abuse detection, and enforcing our Terms of Service
- To comply with legal obligations
We do not sell your personal information, and we do not share it with third parties for their own advertising.
3. AI features
Paid AI features (such as notice summaries and win briefs) send the relevant government notice text, your prompt, and the business profile fields you have provided to our AI infrastructure to generate a response. AI outputs are generated for you and are not used to train third-party foundation models. AI outputs can be inaccurate; verify them against the official solicitation.
4. How we share information
We share information only with service providers who process it on our behalf under contractual restrictions, including: Supabase (authentication and database), Stripe (payments), Railway and GitHub Pages (hosting), our email delivery provider (transactional email), and AI model providers (for the AI features described above). We may also disclose information if required by law or legal process, to protect the rights, safety, or property of FedM8 or others, or in connection with a merger, acquisition, or sale of assets (in which case this Policy will continue to apply to previously collected data unless you are notified otherwise).
Veteran Directory. Directory fields you mark visible are shared with other users of the Service by design. You can change visibility or remove your listing at any time.
5. Government data
The Service displays data from public government sources, including SAM.gov and USAspending.gov. That data is public information published by the U.S. Government and is not governed by this Policy. FedM8 is not affiliated with, endorsed by, or sponsored by the U.S. Government.
6. Data retention
We retain personal information for as long as your account is active or as needed to provide the Service, resolve disputes, and meet legal and tax obligations. Specific periods:
- Account and profile data (including your veteran directory listing): the life of your account, plus up to 30 days after deletion for backups to cycle out.
- Support tickets: 24 months from the last activity on the ticket.
- Activity and AI conversation history used for support troubleshooting: deleted automatically after 90 days.
- Error and abuse logs: 90 days, and they store a one-way hash rather than your IP address.
You can delete your directory listing or your entire account yourself, immediately, from the Account screen — deletion removes your personal records and returns a receipt of what was removed. Payment records are held by Stripe under its own retention rules; we never store your card details.
7. Security
We use commercially reasonable technical and organizational measures to protect personal information, including encryption in transit, access controls, and row-level security on our database. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
8. Your choices and rights
Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, and to object to or restrict certain processing. You can exercise these choices by:
- Editing your profile and Directory visibility directly in the app
- Unsubscribing from digest emails via the link in each email or in Account settings
- Submitting a request through our support form — we will verify the request against your account email and respond within the time required by applicable law
We honor verified requests regardless of your state or country of residence where reasonably practicable. We do not discriminate against you for exercising privacy rights.
9. Children
The Service is a business tool intended for adults. It is not directed to children under 18, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us through the support form and we will delete it.
10. International users
The Service is operated from the United States. If you access it from elsewhere, you understand your information will be processed in the United States, where data protection laws may differ from those in your jurisdiction.
11. Changes to this Policy
We may update this Policy from time to time. Material changes will be posted on this page with a new effective date, and where required by law we will provide additional notice. Continued use of the Service after changes take effect constitutes acceptance of the revised Policy.
12. Contact
Questions or requests about this Policy: use our support form. A real person reads every submission. See also our Refund & Cancellation Policy.