DRAFT — NOT LEGAL ADVICE. This template reflects how the Bulwark Aegis platform actually handles data. It must be reviewed and adapted by a licensed attorney before use. Complete all [bracketed] items.
Privacy Policy
Effective date: [Effective Date] Version: 1.0
This Privacy Policy explains how [Company Legal Name] ("Bulwark," "we") collects, uses, and protects information when you use the Bulwark Aegis platform (the "Service"). It is written for a business-to-business service used by government contractors.
1. Information we collect
- Account information: name, email, organization, and role.
- Company / capability profile: the business data you enter to tailor the Service — for example legal name, UEI, CAGE code, socioeconomic status, NAICS and PSC codes, points of contact, capability statement text, and past-performance posture.
- Opportunity and pipeline data: opportunities you track, statuses you set, and drafts and compliance reviews the Service generates for you.
- Uploaded documents: files you upload (such as a capability statement), from which we extract text to populate your profile and drafts.
- Usage and technical data: log data, IP address, timestamps, and events needed to operate, secure, and improve the Service.
2. How we use information
We use information to: provide and operate the Service; generate drafts and compliance/go-no-go assessments grounded in your data; authenticate you and secure your account; meter usage and bill paid plans; provide support; and maintain, troubleshoot, and improve the Service. We process your data on your behalf to deliver the Service to you.
3. AI processing
The Service sends relevant portions of your data (such as a solicitation's public text and your approved company/capability data) to third-party AI model providers to generate drafts. We do not use your Customer Data to train shared or third-party AI models. Outputs are drafts for your review, as described in the Terms of Service.
4. How we share information
We share information only with: service providers ("subprocessors") that help us operate the Service — for example, AI model providers, cloud hosting, and (if you subscribe) a payment processor; and as required by law or to protect rights and safety. We do not sell your personal information. A current list of subprocessors is available on request. [List subprocessors, e.g., the AI provider, hosting provider, and payment processor.]
5. Government and public data
The Service retrieves opportunity data from public U.S. Government sources (such as SAM.gov). Your searches and the opportunities you track are treated as your Customer Data.
6. Controlled and sensitive information
Unless separately agreed in writing, the Service is not intended for Controlled Unclassified Information (CUI), classified information, or export-controlled technical data, and is not represented as FedRAMP-authorized or CMMC-certified. Do not submit such information without an agreement that permits it.
7. Data retention
We retain Customer Data for as long as your account is active and as needed to provide the Service, then delete or de-identify it within a reasonable period, except where longer retention is required by law or legitimate business need. You may request export or deletion of your Customer Data as described below.
8. Security
We use administrative, technical, and organizational safeguards designed to protect your information, including tenant isolation, access controls, encryption in transit, hashed credentials, and audit logging. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
9. Your choices and rights
You may access and update your account and company data in the Service, request an export, or request deletion by contacting us. Depending on your jurisdiction, you may have additional rights; we will honor applicable rights and respond within the time required by law.
10. International processing
Your information may be processed in the United States. Where required, we take steps to provide appropriate safeguards for cross-border processing.
11. Changes to this Policy
We may update this Policy; material changes take effect on notice or on your next acceptance. The "Effective date" and "Version" reflect the current Policy.
12. Contact
Privacy questions or requests: [Privacy Contact Email], [Company Legal Name], [Company Address].