Privacy Policy

Effective date: September 24, 2026

BidMarshall ("BidMarshall", "we", "us") helps small government contractors win the bids that matter. This policy explains what information we collect, how we use it, and the choices you have.

Information we collect

• Waitlist information. If you join our waitlist, we collect your email address and — only if you pick a pricing tier before signing up — the plan you're interested in. Your signup timestamp and the page that referred you are stored with the record.
• Contact information. If you email us (for example at privacy@bidmarshall.com), we receive whatever you choose to send, such as your name or company.
• Account information. When the service launches, we will collect the information needed to create and manage your account, such as your name, work email, company, and billing details.
• Proposal and bid content. Documents, opportunity data, and drafts you upload or create in the service, so we can provide discovery and AI-assisted proposal drafting features.
• Abuse-prevention data. Our signup API temporarily stores your IP address in a rate-limit counter so one network cannot flood the waitlist. The counter expires within one hour and is never combined with your email record. We do not keep server logs of the pages you visit, and we do not log your browser type or browsing activity.

How we use your waitlist email

If you join the waitlist, we use your email address only to:

• confirm your spot on the waitlist (shown on the page immediately; no confirmation email is sent until launch notices begin),
• notify you when BidMarshall launches or when your access is ready, and
• send occasional product updates directly related to BidMarshall.

Your waitlist record (email, signup time, plan interest) is stored in a Cloudflare key-value database keyed by a hash of your email address, so the raw address is not used as the lookup key. We do not sell your email address, and we do not share it with advertisers. You can request deletion at any time: email privacy@bidmarshall.com from the address you registered and we will remove it within 10 business days.

Cookies

We set no first-party or tracking cookies and no analytics scripts. Our host, Cloudflare, may set strictly-necessary security cookies (e.g., bot management) that we do not control. If this changes when the application launches, we will update this policy before any cookies are set.

Third parties

We use a small number of service providers to operate BidMarshall:

• Cloudflare provides hosting, content delivery, and security for our site and application, and stores the waitlist database (Cloudflare Workers KV). Cloudflare processes technical data (such as IP addresses) as needed to deliver and protect the service, under its own privacy policy.
• Cloudflare Turnstile, when bot protection is enabled on the signup form, verifies that a signup comes from a human rather than an automated script; the check sends your IP address and browser signals to Cloudflare for that purpose only.

We do not otherwise share your personal information with third parties except as required by law or to protect our rights. We will update this policy before adding any new service provider that processes personal information.

Data retention and security

We keep waitlist emails until you ask us to delete them or the waitlist concludes, whichever comes first. Beta-account data is kept while your account is active and deleted within 90 days of closure. Waitlist and application data are encrypted in transit (TLS 1.2+), and the waitlist database is encrypted at rest by our hosting provider. We apply industry-standard safeguards to protect your information.

Your rights

You may request to access, correct, export, or delete your personal information at any time. Depending on where you live, you may have additional rights under state privacy laws (e.g., the CCPA/CPRA). We honor Global Privacy Control signals as an opt-out of any future sale/sharing; we do not sell personal information. BidMarshall is a US-focused service; if you believe the GDPR applies to you, you may contact privacy@bidmarshall.com. To exercise any of these rights, email privacy@bidmarshall.com. We will respond within 30 days.

Changes to this policy

If we make material changes, we will update the effective date above and, for waitlist members and customers, notify you by email before the changes take effect.

Contact

Questions about this policy or your data? Email privacy@bidmarshall.com.

Postal address: [Mailing address] — CAN-SPAM requires a valid physical postal address before any marketing email is sent, so this must be filled in first.