Privacy Policy

We do not sell your personal information. We do not use your documents or your questions to train AI models.

We measure this site ourselves. A page view is counted on our own server with no cookie and no identifier, so we know which pages are read and nothing about who read them. Pressing a Get button on the pricing page and starting a checkout are counted the same way, as numbers, so we know how many people reach each step. Visits from search engines and other programs that say what they are are not counted. If you arrive from a link that carries campaign parameters, your browser keeps them in its own storage until you sign up, so the account can be credited to the campaign that brought it. No advertising network receives anything, and nothing on this site loads a tag, a pixel or a script from one.

Those are commitments, not marketing. If any of them ever changes we will tell you by email before it takes effect, and update the date at the top of this page.

InstantSam LLC, 6464 Savoy Drive, Suite 777, Houston, TX 77036. Privacy questions go to privacy@instantsam.com.

Account and identity.

• Email address.
• Password, stored only as a hash by our authentication provider. We never see it.
• Full name and company name, if you give them.
• If you turn on two-factor authentication, the secret key your authenticator app uses, held by our authentication provider.

Your business profile, because it changes what we show you.

• NAICS codes you are registered under.
• Set-aside statuses you hold, such as small business, 8(a), WOSB, SDVOSB or HUBZone.
• States you are willing to work in.
• Your UEI and CAGE code, certifications, past performance, including the name, email address and phone number of each reference you list, and the contact details on your capability statement.

What you do in the product.

• Saved searches and their keywords, codes and filters.
• Opportunities you save, and the pipeline stage you put them in.
• Bid amounts and outcome notes you record.
• Proposal files you upload to a pursuit, and their versions.
• Questions you ask about a solicitation, and the answers returned.
• Which features you use and when, so we know what to improve.
• A short note about a review, if you choose to send one: whether it helped or missed something, and what you wrote. If you also tick the box that allows it, the first name and company you give, so that we can quote you on this website.
• Notification and digest settings.
• Notes, tasks, go or no-go decisions and files you add to a pursuit, and the teaming partners you record.
• The people on your team, and the email address of anybody you invite.
• A record of changes made in your team: who made each one, with their email address, and what changed.
• Webhook addresses and API key names, if your team sets up integrations. We keep a hash of each key, not the key itself.

Subscription and payment.

• Which plan you are on, whether it is active, when it renews, and where you bought it.
• A payment processor customer identifier.
• We never receive or store your full card number.

Device and technical.

• Push notification token, if you turn notifications on.
• IP address and browser or device type, in server logs.
• Error and crash information.

Support. Anything you write to us, and our replies.

Almost all of it comes from you, directly. The rest comes from our payment processor, which tells us whether a subscription is active, and from Apple when you subscribe through the App Store.

The opportunity and award information in InstantSam comes from public government sources: principally SAM.gov and USAspending.gov, and also Grants.gov, DLA DIBBS, the Department of Defense SBIR and STTR topics, state and city purchasing portals, and published buying forecasts. That is information about government contracts and grants, about companies that have won them, and about the government contacts named on notices, with the contact details the notice gives. It is public, it is not collected from you, and it is not about you unless you or your company appear in it.

• To create your account and sign you in.
• To run your searches and match opportunities to what you are looking for.
• To send the alerts, digests and amendment notices you asked for.
• To read solicitation documents and answer questions about them.
• To warn you when a notice needs a status your profile does not list.
• To track your pipeline and tell you when something you were chasing is awarded.
• To take payment and manage your subscription.
• To answer your support messages.
• To keep the service secure and prevent fraud and abuse.
• To find and fix problems, and to understand which features are used.
• To meet our legal and tax obligations.

We do not build advertising profiles and we do not run advertising SDKs in the app.

We use service providers to run InstantSam. They process data on our instructions and under contract. Some, such as Stripe and Apple for payments, also use it for purposes of their own, such as preventing fraud, under their own privacy policies.

• Supabase: database, authentication and file storage.
• Railway: application hosting.
• Stripe: payment processing for purchases made on instantsam.com.
• RevenueCat: subscription status for App Store purchases.
• Apple: payment processing for App Store purchases.
• Resend: transactional, alert and product news email delivery.
• Expo: push notification delivery to your device.
• Anthropic: the AI model that reads solicitation documents and answers questions about them, reads a plain English search into filters, and answers the questions typed into the support assistant on this site. For a Sources Sought letter or an AI proposal draft it also receives your company's record, because what they write is about you: your company's name, UEI, NAICS codes, set-asides, states and certifications, and the past performance you entered, including each reference's name but never a reference's email address or phone number. A letter also includes your CAGE code and contract numbers, and a draft also includes when your SAM registration expires and the competencies and differentiators you wrote.

Documents and questions sent to our AI provider are processed to produce your answer and are not used to train models. We do not permit it and our provider agreement does not allow it.

The guide video.The guide at instantsam.com/guide plays a video from YouTube, which is Google’s. Nothing is loaded from YouTube until you press play. Once you do, YouTube receives your IP address and what your browser sends it, under Google’s own privacy policy.

Product news and offers.We may email the address on your account occasionally about InstantSam: a feature worth knowing about, a change to a plan, or an offer. Every one of those carries an unsubscribe link, one click stops them for good, and stopping them never affects your alerts, your daily digest, or the emails your account depends on, such as a password reset. We do not send you other companies’ advertising and we do not give your address to anybody for marketing.

Getting started. Two emails help a new account begin, each sent once and never repeated: your confirmation link again, if it has not been used a day after you sign up, and a reminder two days after you confirm, if your free document reviews are still unused.

Weekly notice emails. If you ask for a weekly email of new notices from one of our directory pages, we keep the address you typed, the page you chose, and the dates we sent you the confirmation link, you confirmed, you were last emailed and you stopped. We send one confirmation link first, and the weekly email only after you confirm, only in weeks when something new was posted under that page. The link in every one of those emails stops them. No account is created, and the address is not used for anything else. A request that is never confirmed is deleted after 30 days, and so is an address 30 days after it stops.

If your team sets up webhooks or API keys on the Premier plan, the data they carry goes to the addresses and systems your team chooses. That includes the people on your team: a webhook names who moved a pursuit by their name, or the first part of their email address, and an API key reads the pipeline with the email address of the person who saved each pursuit and of the person it is assigned to.

We may also disclose information if the law requires it, to protect the rights or safety of users or the public, or in connection with a merger, acquisition or sale of the business, in which case we will tell you.

Vague promises about keeping data as long as necessary are not useful, so here are the actual periods.

• Account record: for as long as the account exists, then deleted within 30 days of a deletion request.
• Saved searches, saved opportunities, pipeline and the other work saved to a team, such as notes, tasks, files and the company profile: for as long as the team exists. It stays with the team when one person leaves or deletes their account, and is deleted with the team when its owner deletes their account with nobody else on it.
• Questions you ask about a solicitation, and the answers returned: 6 months, then deleted automatically. You can delete them sooner, at any time, from the app or your account page.
• Solicitation text we extract from public notices and their attachments: kept as a shared cache rather than as your data. It is public material published by the government, the same notice is read by many people, and it is not linked to you or deleted with your account.
• Which features you used and when: 12 months, then deleted.
• A note about a review: until you delete the account. A quotation you allowed us to publish is not part of your account: we show you the exact words first, and it stays on this website until you ask us to take it down, which we do within 30 days.
• The team activity record, which names who did what by email address: for as long as the team exists, including after that person leaves the team or deletes their account.
• Two-factor authentication: held by our authentication provider until you turn it off or delete the account.
• Push notification tokens: until you sign out on that phone, the phone stops accepting notifications, or you delete the account.
• API keys, webhooks and the record of each webhook delivery: for as long as the team exists, or until the webhook is removed. A key is kept as a hash, with only its first characters readable.
• Payment and invoice records: 7 years, for tax and accounting purposes. These survive account deletion.
• Server and security logs: held by our hosting providers under their own retention periods. We keep no separate copies, and use them to diagnose faults, to prevent abuse and, from the questions typed into the support assistant on this site, to learn what people ask about InstantSam.
• Support messages: 24 months.
• Weekly notice email requests from a directory page: the address, the page and the dates of the link, the confirmation, the last email and the stop. A request never confirmed is deleted after 30 days, and a stopped address 30 days after it stops; a confirmed one is kept until it stops.
• Encrypted backups: up to 35 days, after which they age out automatically.

You can delete your account inside the app, under More, then your profile, or on the delete account page on this site. Both do the same thing.

Deleting your account cancels a subscription bought on this website, so you are not billed again. It does not stop an App Store subscription, because we cannot cancel it for you. Cancel it in the Settings app on your iPhone or iPad before you delete.

When you delete an account we remove your profile, settings, questions and answers, notes about reviews, device tokens, subscription record and usage records from the live service within 30 days. If nobody else is on your team, the team is deleted too, with everything saved to it. If other people are on the team, the work you saved to it stays with the team, and the team's activity record keeps your email address against what you did. If you own a team with other people on it, hand it to one of them or remove them first. Backups age out within 35 days. Payment and invoice records are kept for 7 years for tax and accounting purposes, and are not used for anything else.

We may ask you to confirm the request from the email address on the account, so that nobody can delete an account belonging to somebody else.

You can do all of these yourself, without asking us:

• See and change your profile, searches and pipeline in the app or on the site.
• Download the data held under your account as a file, from your account page. Or have it emailed to you, from More inside the app.
• Delete every question you have asked about a solicitation, and the answers, at any time.
• Turn the daily digest off on your account page, and email alerts off on each saved search.
• Stop product news and offers, with the unsubscribe link in any of them. Your alerts, digest and account emails are unaffected.
• Turn push notifications off in your device settings.
• Delete your account.

You do not have to ask us for any of that, and you do not have to wait. If you would rather we did it, or you want something the buttons do not cover, write to privacy@instantsam.com and we will respond within 45 days. We offer this to everybody regardless of where you live, rather than only where a statute requires it.

Data is encrypted in transit, and at rest by our database and storage providers. Passwords are hashed by our authentication provider and never stored by us. Access to production systems is limited, uses multi-factor authentication, and credentials are kept in our hosting providers' configuration rather than in code.

No service can promise perfect security and we are not going to pretend otherwise. If a breach affects your information we will notify you and any regulator we are required to notify, without unreasonable delay.

instantsam.com uses cookies to keep you signed in and to keep the site working. Those are not optional, because without them you cannot stay signed in.

There is no analytics or advertising tag on this site and no third-party cookie. The campaign parameters described in section 1 live in your browser's own storage, not in a cookie, and clearing your browsing data removes them. The InstantSam mobile apps contain no advertising or analytics SDKs at all.

InstantSam is for businesses pursuing government contracts and grants and is not intended for anybody under 18. We do not knowingly collect information from children. If we learn we have, we will delete it. If you believe a child has given us information, write to privacy@instantsam.com.

If we make a material change we will email the address on your account at least 14 days before it takes effect, and update the date at the top of this page. Smaller corrections are made with the date updated.