Privacy policy

Last updated September 9, 2026.

What we collect

• Account data: your name, work email, password (stored only as a salted hash), and team membership.
• Company data you enter: profile, certifications, keywords, past performance, notes, and pipeline stages.
• Documents you upload or paste, and their extracted text, tied to a specific notice.
• Usage data: which analyses and drafts you run, token counts, and timestamps, used for plan limits, billing, and product analytics.
• Technical data: IP address and request logs used for security and rate limiting.
• Free-tool submissions: the company details and email you enter to generate a capability statement, and the email, optional US mobile number, company name, and game score you enter after NONRESPONSIVE.
• Evaluation requests: company, work email, buying role, response frequency, public solicitation reference, optional deadline, and permission to contact you about the requested evaluation.
• Evaluation feedback: your selected notice, usefulness assessment, optional time spent, notes, and next task, stored with the workspace and the state of the work at the time.

How we use it

To run the service, to match and analyze notices for you, to bill you, to secure accounts, to understand which product steps people complete, and to send the emails and texts you request (verification, password resets, team invitations, a capability statement, a NONRESPONSIVE CPARS card or challenge link), responses to your guided-evaluation request, and service notices. Evaluation requests do not subscribe you to marketing. We do not sell personal data and we do not run advertising.

Who else sees it

• Our configured AI service (OpenRouter or Anthropic), and the model provider serving the request, receive your company information and solicitation material to generate analyses, drafts and other requested outputs, under terms that exclude training on it. OpenRouter requests disable data collection. The security page identifies the configured service and model.
• Stripe processes payments; we never see your full card number.
• Our hosting and database providers store the data on our behalf in the United States.
• Our email provider delivers the messages listed above.
• If you ask for a text, our SMS provider (Twilio) receives your number and the message body only.
• PostHog, a product-analytics processor in the United States, receives product-usage events (for example sign-up, evaluation, analysis, drafting, and billing). We send identifiers and event properties, not solicitation files, drafts, or prompt text.

Public notice data comes from SAM.gov and is public record; it is not personal data about you.

Retention and deletion

Your workspace data stays until the owner deletes the workspace from Settings, which removes it from the live database immediately. Nightly backups are kept for about five weeks, so deleted data leaves the backups within that time. Rate-limit and request logs are kept for 30 days. Free-tool submissions are kept for 12 months unless you ask us to remove them. Guided-evaluation requests have the same 12-month retention period. Workspace evaluation feedback is removed when the workspace is deleted.

Your rights

You can export your drafts at any time, correct your data in the app, and delete the workspace yourself. To access, correct, or delete anything else, or to ask a question, email support@worthchase.com.

Cookies

We set a session cookie so you stay logged in, and a first-party PostHog identifier so we can tell which product steps a browser completes. There are no advertising cookies.

Changes

We will email account owners before any material change to this policy takes effect.