Privacy Policy

We do not sell your personal information. We do not use your documents or your questions to train AI models.

We do advertise. When you arrive from a Google ad, Google's measurement tag records that the visit happened and whether it led to a signup, so we can tell which advertising is worth paying for. That uses a cookie and it tells Google a conversion occurred. It does not tell Google what you search for in InstantSam, what you save, or what you bid.

Those are commitments, not marketing. If any of them ever changes we will tell you by email before it takes effect, and update the date at the top of this page.

InstantSam LLC, 3120 Southwest Freeway, 1st Floor, Houston, TX 77098. Privacy questions go to privacy@instantsam.com.

Account and identity.

• Email address.
• Password, stored only as a hash by our authentication provider. We never see it.
• Full name and company name, if you give them.

Your business profile, because it changes what we show you.

• NAICS codes you are registered under.
• Set-aside statuses you hold, such as small business, 8(a), WOSB, SDVOSB or HUBZone.
• States you are willing to work in.

What you do in the product.

• Saved searches and their keywords, codes and filters.
• Opportunities you save, and the pipeline stage you put them in.
• Bid amounts and outcome notes you record.
• Questions you ask about a solicitation, and the answers returned.
• Which features you use and when, so we know what to improve.
• Notification and digest settings.

Subscription and payment.

• Which plan you are on, whether it is active, when it renews, and where you bought it.
• A payment processor customer identifier.
• We never receive or store your full card number.

Device and technical.

• Push notification token, if you turn notifications on.
• IP address and browser or device type, in server logs.
• Error and crash information.

Support. Anything you write to us, and our replies.

Almost all of it comes from you, directly. The rest comes from our payment processor, which tells us whether a subscription is active, and from Apple or Google when you subscribe through a store.

The opportunity and award information in InstantSam comes from public United States Government sources, principally SAM.gov and USAspending.gov. That is information about government contracts and about companies that have won them. It is public, it is not collected from you, and it is not about you unless your company appears in it.

• To create your account and sign you in.
• To run your searches and match opportunities to what you are looking for.
• To send the alerts, digests and amendment notices you asked for.
• To read solicitation documents and answer questions about them.
• To warn you when a notice needs a status your profile does not list.
• To track your pipeline and tell you when something you were chasing is awarded.
• To take payment and manage your subscription.
• To answer your support messages.
• To keep the service secure and prevent fraud and abuse.
• To find and fix problems, and to understand which features are used.
• To meet our legal and tax obligations.

We do not build advertising profiles and we do not run advertising SDKs in the app.

We use service providers to run InstantSam. They process data on our instructions, under contract, and for no purpose of their own.

• Supabase: database, authentication and file storage.
• Railway: application hosting.
• Stripe: payment processing for purchases made on instantsam.com.
• RevenueCat: subscription status for purchases made in the mobile apps.
• Apple and Google: payment processing for App Store and Google Play purchases.
• Resend: transactional and alert email delivery.
• Expo: push notification delivery to your device.
• Anthropic: the AI model that reads solicitation documents and answers questions about them.
• Google: advertising measurement, so we can tell which ads bring people here.

Documents and questions sent to our AI provider are processed to produce your answer and are not used to train models. We do not permit it and our provider agreement does not allow it.

We may also disclose information if the law requires it, to protect the rights or safety of users or the public, or in connection with a merger, acquisition or sale of the business, in which case we will tell you.

Vague promises about keeping data as long as necessary are not useful, so here are the actual periods.

• Account record: for as long as the account exists, then deleted within 30 days of a deletion request.
• Saved searches, saved opportunities and pipeline: for as long as the account exists.
• Questions you ask about a solicitation, and the answers returned: 6 months, then deleted automatically. You can delete them sooner, at any time, from the app or your account page.
• Solicitation text we extract from SAM.gov attachments: kept as a shared cache rather than as your data. It is public material published by the government, the same notice is read by many people, and it is not linked to you or deleted with your account.
• Which features you used and when: 12 months, then deleted.
• Payment and invoice records: 7 years, because tax law requires it. These survive account deletion.
• Server and security logs: held by our hosting providers under their own retention periods. We keep no separate copies, and use them only to diagnose faults and prevent abuse.
• Support messages: 24 months.
• Encrypted backups: up to 35 days, after which they age out automatically.

You can delete your account from Settings inside the app, or on the delete account page on this site. Both do the same thing.

Deleting your account and cancelling your subscription are different actions. If you have an active subscription, cancel it first, in the place you bought it. Deleting an account does not automatically stop an Apple or Google subscription, because we cannot cancel those for you.

When you delete an account we remove your profile, saved searches, saved opportunities, pipeline, questions and answers, and device tokens from the live service within 30 days. Backups age out within 35 days. Payment and invoice records are kept for 7 years because tax law requires it, and are not used for anything else.

We may ask you to confirm the request from the email address on the account, so that nobody can delete an account belonging to somebody else.

You can do all of these yourself, without asking us:

• See and change your profile, searches and pipeline in the app or on the site.
• Download everything we hold about you as a file, from your account page. Or have it emailed to you, from More inside the app.
• Delete every question you have asked about a solicitation, and the answers, at any time.
• Turn email alerts and the daily digest off in your settings.
• Turn push notifications off in your device settings.
• Delete your account.

You do not have to ask us for any of that, and you do not have to wait. If you would rather we did it, or you want something the buttons do not cover, write to privacy@instantsam.com and we will respond within 45 days. We offer this to everybody regardless of where you live, rather than only where a statute requires it.

Data is encrypted in transit, and at rest by our database and storage providers. Passwords are hashed by our authentication provider and never stored by us. Access to production systems is limited, uses multi-factor authentication, and credentials are held in a secrets manager rather than in code.

No service can promise perfect security and we are not going to pretend otherwise. If a breach affects your information we will notify you and any regulator we are required to notify, without unreasonable delay.

instantsam.com uses cookies to keep you signed in and to keep the site working. Those are not optional, because without them you cannot stay signed in.

We also run Google's advertising measurement tag, which sets a cookie so Google can connect an ad click to a signup. You can block it with any ad blocker or with your browser's tracking protection, and nothing on this site will stop working. The InstantSam mobile apps contain no advertising or analytics SDKs at all.

InstantSam is for businesses pursuing federal contracts and is not intended for anybody under 18. We do not knowingly collect information from children. If we learn we have, we will delete it. If you believe a child has given us information, write to privacy@instantsam.com.

If we make a material change we will email the address on your account at least 14 days before it takes effect, and update the date at the top of this page. Smaller corrections are made with the date updated.