Privacy Policy
Effective date: to be published
This policy explains what personal information SunriseBids collects, why we collect it, who we share it with, and the choices you have. We have tried to write it in plain English. If something is unclear, email privacy@sunrisebids.com.
1. Who we are
SunriseBids (sunrisebids.com) is operated by to be published , a sole proprietor doing business as SunriseBids, at SunriseBids staging , Richmond, VA, Richmond, Virginia, USA ("SunriseBids", "we", "us"). We are the controller of the personal information described here, which means we decide how and why it is used.
Privacy contact: privacy@sunrisebids.com
SunriseBids is an independent service. It is not affiliated with, endorsed by, or an official site of the U.S. Government, GSA, or SAM.gov.
2. The short version
- We collect the minimum we need to send you contract alerts: your email address, a business profile you give us, how you use the service, and the feedback you give on matches.
- We do not sell your personal information. We do not share it for targeted advertising. We do not use advertising trackers or ad pixels.
- We use one essential session cookie to keep you signed in. Our analytics do not use cookies.
- Payments are handled by Paddle, our reseller and Merchant of Record. We never see or store your full card number.
- You can export or delete your data at any time by emailing privacy@sunrisebids.com or using the account settings page.
3. What we collect and why
| What | Examples | Why we use it |
|---|---|---|
| Account information | Email address; name (optional); team members' email addresses (Team plan) | To create your account, sign you in with a magic link, and send the digests and reminders you asked for |
| Business profile | Company name, website URL, UEI, NAICS codes, keywords, the set-aside programs you say you qualify for (for example small business, 8(a), HUBZone, WOSB, SDVOSB), states or places of performance, preferred contract size | To match and rank SAM.gov opportunities against your business. This is the core of the service |
| Usage information | Pages viewed in the dashboard, opportunities you follow or dismiss, digest links you click, saved searches, sign-in times, approximate location from IP address, browser type | To run the service (for example deadline reminders for opportunities you follow), keep it secure, fix bugs, and improve ranking |
| Feedback | Thumbs up or down on a match, "not relevant because…" notes, support emails | To improve your future matches and to answer your questions |
| Billing information | Plan, billing status, country, Paddle customer and subscription IDs | To know which features you have paid for. Paddle collects your payment details directly; we do not receive your full card number |
| Technical and security data | IP address, request logs, bot-check results | To prevent abuse, rate-limit sign-ins, and investigate security incidents |
Business profile data that may look sensitive. Your set-aside eligibility (for example, veteran-owned, women-owned, or economically disadvantaged status) is something you tell us about your business so we can filter opportunities. We use it only for matching. We never sell it, share it for advertising, or show it to other users. You can leave any of these fields blank.
Public data. SunriseBids's opportunity data comes from SAM.gov's public data extracts and API. Some notices name government points of contact. That is public government information. We show it as it appears on SAM.gov and do not use it for marketing.
Where we get information. Mostly from you. If you enter a UEI, we may look up your public entity record on SAM.gov. If you enter a website URL, we fetch that public page to suggest keywords and NAICS codes.
4. How AI is used with your data
We use Anthropic's Claude models to summarize SAM.gov notices and score them against your business profile. For that, we send Anthropic the notice text and the relevant parts of your business profile (for example NAICS codes, keywords and set-aside preferences). We do not send your email address or payment information to Anthropic for ranking.
Under Anthropic's commercial terms, data sent through its API is not used to train its models by default. Anthropic may keep API data for a limited period for trust-and-safety purposes, as described in its own policies.
AI output is used only to rank and summarize opportunities for you. It does not make legal, financial, or eligibility decisions about you.
5. Who we share it with
We share personal information only with the service providers ("processors") that help us run SunriseBids, and only as far as each needs it:
| Provider | What they do for us | Data involved |
|---|---|---|
| Cloudflare, Inc. | Hosting, database, content delivery, DNS, security (firewall, rate limiting, Turnstile bot checks), cookieless web analytics, inbound email routing | All data stored by the service; IP addresses and request data |
| Resend | Sending email (sign-in links, digests, reminders, account notices) | Email address, email content, delivery and bounce events |
| Paddle.com | Our online reseller and Merchant of Record: checkout, payment processing, tax, invoices, refunds | Name, email, billing address/country, payment details (collected by Paddle directly). Paddle acts under its own privacy policy for this data |
| Anthropic, PBC | AI summaries and ranking | SAM.gov notice text and your business profile (see section 4) |
| GitHub, Inc. | Source code hosting and automated build/data jobs | Normally no customer personal information. Our scheduled jobs process public SAM.gov data only |
We may also disclose information:
- to professional advisers (for example an accountant or lawyer) under confidentiality;
- if required by law, subpoena or court order, or to protect the rights, safety or property of our users, the public or us;
- to a buyer or successor if SunriseBids is sold or transferred, in which case this policy continues to apply to your information until you are told otherwise.
We do not sell personal information, and we do not "share" it for cross-context behavioral advertising (as those terms are defined in California law). We have not done so in the past 12 months.
6. Cookies and similar technologies
- Session cookie (essential). When you sign in, we set one cookie that keeps you signed in. It is HttpOnly, Secure, and SameSite=Lax. Without it, sign-in does not work.
- Security. Cloudflare may process technical signals (for example for Turnstile bot checks on the sign-up form) to block automated abuse.
- Analytics. We use Cloudflare Web Analytics, which does not use cookies and does not build a profile of you across websites.
- No ad trackers. We do not use advertising cookies, social media pixels, or third-party ad networks.
- Email. [OWNER DECISION: confirm the setting chosen in Resend.] Default stated here: we do not use open-tracking pixels in emails. Links in digests may go through our own domain so we can record which opportunities you clicked, which helps rank future matches.
Do Not Track / Global Privacy Control. Because we do not track you across other websites or sell or share data for advertising, there is nothing for these signals to switch off. We still treat a Global Privacy Control signal as a valid opt-out of sale or sharing.
7. How long we keep it
| Data | How long |
|---|---|
| Account and business profile | While your account is open. Deleted within 30 days after you delete your account |
| Usage data and feedback tied to your account | While your account is open, then deleted with the account. We may keep aggregated statistics that cannot identify you |
| Server and security logs | Up to 30 days, longer only if needed to investigate a specific incident |
| Database backups | Rolling backups are overwritten within 30 days, so deleted data disappears from backups within that window |
| Email suppression list | If you unsubscribe, we keep your email address on a "do not email" list so we can honor that choice |
| Billing records | Paddle keeps transaction records as required for tax and accounting law. We keep our record of your plan history for up to 7 years for tax purposes |
| Inactive free accounts | If a free account has not opened an email or signed in for 24 months, we will email you and then delete the account if you do not respond within 30 days |
8. Your choices and rights
Wherever you live, you can:
- Access and export. Ask for a copy of your personal information. We will provide it in a common machine-readable format (JSON or CSV).
- Correct. Edit your profile in the dashboard at any time, or ask us to fix something.
- Delete. Delete your account in settings, or email privacy@sunrisebids.com. If you have a paid subscription, cancel it first (or ask us to) so Paddle stops billing you.
- Unsubscribe. Every marketing email has an unsubscribe link. Account and security emails (for example sign-in links) are part of the service and will still be sent while you have an account.
- Opt out of sale/sharing. We do not sell or share data, but you can still ask us to confirm this.
We answer requests within 30 days (45 days where a state law allows it, and we will tell you if we need the extension). To protect your account, we confirm requests by email from the address on the account. You can use an authorized agent; we may ask for proof that they act for you. We will not discriminate against you for using any of these rights. If we decline a request, we will tell you why, and you can appeal by replying to our answer with "Appeal" in the subject line. We will respond to an appeal within 60 days.
California residents (CCPA/CPRA)
The California Consumer Privacy Act, as amended by the CPRA, applies to for-profit businesses that meet at least one threshold: annual gross revenue over the inflation-adjusted amount (currently $26,625,000), buying, selling or sharing personal information of 100,000 or more California consumers or households a year, or earning at least 50% of revenue from selling or sharing personal information. SunriseBids does not currently meet these thresholds, so the CCPA may not apply to us. We still provide the following notice and honor the rights in this section voluntarily.
- Categories collected (last 12 months): identifiers (email, name, IP address); commercial information (plan and billing status); internet or other electronic network activity (usage data); professional or employment-related information (business profile); inferences (match scores derived from your profile).
- Sources: you, your device, and public government records (SAM.gov).
- Purposes: as described in section 3.
- Disclosed for a business purpose to: the service providers in section 5.
- Sold or shared: none.
- Sensitive personal information: we do not collect it for the purpose of inferring characteristics about you, and we do not use it for anything other than providing the service.
- Your rights: to know, access, correct, delete, and opt out of sale/sharing, and not to be discriminated against for exercising them.
California's "Shine the Light" law: we do not disclose personal information to third parties for their own direct marketing.
Virginia residents (VCDPA)
The Virginia Consumer Data Protection Act applies to businesses that, in a calendar year, control or process personal data of at least 100,000 Virginia consumers, or control or process personal data of at least 25,000 Virginia consumers and earn more than 50% of gross revenue from selling personal data (Va. Code § 59.1-576). The law also defines "consumer" as a person acting in an individual or household context, not in a commercial or employment context. Most SunriseBids users act for a business. SunriseBids does not currently meet the VCDPA thresholds, so the law likely does not apply to us today.
We still honor the rights the VCDPA describes: to confirm whether we process your data, to access, correct and delete it, to get a portable copy, and to opt out of targeted advertising, sale, and profiling that produces legal or similarly significant effects (we do none of these). You can appeal any decision as described above. If an appeal is denied, you can contact the Virginia Attorney General at https://www.oag.state.va.us/.
Other U.S. states
Several other states have similar privacy laws with their own thresholds. We apply the rights in this section to every user regardless of state.
Visitors outside the United States
SunriseBids is built for U.S. federal contractors and is run from the United States. Our providers store and process data in the United States and other countries. If you use SunriseBids from outside the U.S., your information will be processed in the U.S., where privacy laws may differ from those in your country. Paddle, as Merchant of Record, handles the purchase relationship and the tax and consumer rules of your country for payments.
9. Security
We protect your data with encryption in transit (HTTPS everywhere) and at rest (handled by Cloudflare), passwordless sign-in (we store no passwords), single-use sign-in links that expire after 15 minutes, strict access controls, and isolation so one customer's data cannot be read by another. No system is perfectly secure. If we learn of a breach affecting your personal information, we will notify you as required by law. More detail: Security.
10. Children
SunriseBids is a business service. It is not directed to anyone under 16, and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, email privacy@sunrisebids.com and we will delete it.
11. Changes
If we make a material change to this policy, we will email account holders and update the effective date at least 14 days before the change takes effect, unless the change is required sooner by law. Earlier versions are available on request.
12. Contact
to be published , d/b/a SunriseBids SunriseBids staging , Richmond, VA privacy@sunrisebids.com