Privacy Policy
Effective date: July 6, 2026
CaptureAgent ("we," "us") provides an AI-assisted capture and proposal management platform for government contractors at captureagent.us (the "Service"). This policy explains what we collect, how we use it, and the choices you have. It is written to comply with applicable U.S. privacy laws, including the California Consumer Privacy Act as amended by the CPRA ("CCPA") and similar state privacy statutes.
Information we collect
- • Account data — name, work email, password (stored only as a salted bcrypt hash).
- • Organization data you enter — company profile details (UEI, CAGE, certifications, capabilities, past performance), opportunities you track, and proposal content you create.
- • API keys you bring — encrypted with per-organization envelope encryption before storage; displayed only as masked previews; every use is written to your organization's audit log. We do not use your keys for anything except the actions you trigger.
- • Usage and log data — authentication events, IP-based login-attempt throttling records, and audit-log entries of actions inside your workspace.
- • Cookies — see "Cookies" below.
How we use information
- • To provide the Service: storing your pipeline, generating AI drafts you request, sending transactional email (verification, password reset, invitations, approval notices).
- • To secure the Service: login throttling, audit trails, role-based access control.
- • We do not sell or share your personal information for cross-context behavioral advertising, and we do not use your proposal content to train AI models.
AI processing
When you press an AI action, relevant workspace content (for example, an opportunity description and your company profile) is sent to the AI provider whose key your organization configured (Anthropic, OpenAI, Emergent, or AskSage), under your agreement with that provider. Choose providers whose data-use terms fit your needs; API traffic to these providers is generally excluded from model training under their API terms.
Cookies
We use strictly necessary cookies only: encrypted, HttpOnly session cookies that keep you signed in. We do not use advertising or cross-site tracking cookies. A consent notice is shown on your first visit; your choice is stored in your browser.
Sharing
We share data only with the service providers that make the platform run — database hosting (Supabase/PostgreSQL), email delivery, and the AI providers you configure — each bound to process data only to provide their service. We may disclose information if required by law. In a merger or acquisition, data may transfer subject to this policy.
Security
TLS in transit; encryption at rest for the database; envelope encryption with per-organization keys for API credentials; salted bcrypt password hashing; role-based access control with audit logging; login throttling. No method is 100% secure, but security is a first-class design goal. Do not store classified information, CUI, or ITAR-controlled technical data in the Service.
Your rights
Depending on your state, you may have rights to access, correct, delete, or export your personal information, and to non-discrimination for exercising them. Organization administrators can edit or delete workspace data directly. For anything else — including account deletion — email privacy@captureagent.us. We respond within the timelines your state's law requires (45 days under CCPA).
Data retention
Account and workspace data persist until you delete them or your organization asks us to. Audit logs are retained for security purposes. Password-reset and email-verification tokens expire automatically.
Children
The Service is for business use and not directed to children under 13; we do not knowingly collect their data.
Changes
We'll post updates here and change the effective date; material changes will be announced in-app or by email.
Contact
CaptureAgent · captureagent.us · privacy@captureagent.us