GovCon Desk Privacy Policy

Effective October 12, 2026

This policy explains what information Gnosis Concepts Inc. ("GCI," "we," "us"), a service-disabled veteran-owned small business in San Antonio, Texas, collects through GovCon Desk at govcon-desk.com (the "Service"), how we use it, who we share it with and the choices you have. It also explains how we handle information about government employees whom our customers contact through the Service (section 5).

The short version: we use your information only to run GovCon Desk for your company. We don't sell it, we don't run ads or analytics trackers, and we don't use it to train AI models of our own. If you received an email sent through GovCon Desk and want it to stop, use the unsubscribe link in the email or write to info@agilegnosis.com.

Your agreement. By signing up for an account or signing in to GovCon Desk, you agree to this Privacy Policy and to our Terms of Service, and you acknowledge that we collect, use and share information as described here. If you don't agree, don't sign up, sign in or use the Service.

1. Information we collect

Account information. Your email address, your password (stored only as a secure hash by our authentication provider), your workspace memberships and roles, and invitations you send or receive (the invited email address, role, who sent it and when it was accepted). We don't ask for your name or phone number to create an account.

Company profile. What you enter or pull from SAM.gov: legal and short name, point of contact and title, business email, phone, website and address, UEI and CAGE code, SAM.gov expiration date, certifications and socioeconomic status, NAICS codes, GSA schedule SINs, contract vehicles, competencies, differentiators, capability statement, past performance and default pricing markup.

Pursuit and contract records. Saved searches, opportunities you track (including state and local bids), bid / no-bid and fit scores, solicitation text you paste or upload, compliance matrices, win themes, pricing, proposal sections, red-team reports and your responses, contracts, deliverables, modifications, invoicing figures, contracting officer and COR names, registration and compliance checklists, and SAM.gov notice updates we find for opportunities you track.

Contacts and outreach. Names, titles, roles, agencies, offices, states, business email addresses and phone numbers of government contacts in your workspace (see section 5 for where they come from), plus fit scores, notes, pipeline stage and touch history. Email templates, sequences and your outreach plan. A log of every outreach email sent from your workspace (recipient, subject, body, time, delivery, bounce and reply status). For replies sent to our tracking address, the sender, subject and a short snippet of the reply (up to 600 characters). Unsubscribe and spam-complaint flags.

Email settings. Your from name and address, reply-to address, postal mailing address, signature, daily sending limit, sending domain and send window.

SAM.gov API key. If an owner or admin adds your workspace's SAM.gov API key, we store it encrypted and use it only to send your workspace's requests to SAM.gov. No one in the app, including members of your workspace, can view it after it is saved; the app shows only its last four characters. Removing it in the app deletes it.

Bid inbox email. Each workspace has its own bid inbox address. When a portal, agency or person sends email to it (including email you forward), we receive the full message, send its text to our AI provider to find the bids in it, and store the sender, subject, portal name, any confirmation links, and the bids found (title, agency, jurisdiction, solicitation number, dates, links, codes, goals and a short summary). We don't store the full message body in our database; our email provider keeps received messages under its own retention settings.

Charis conversations. Your messages to the AI assistant and its answers. If you attach files, the file is read in your browser and sent to our AI provider with your question; we don't store the file itself, but we save up to 30,000 characters of text from each attachment with the conversation so later questions can use it. General conversations are private to you; conversations about a proposal are shared with your workspace.

Purchases. When you buy AI requests, Stripe collects your payment details. We receive and keep the Stripe session ID, the pack, number of requests, amount, currency, the workspace and the user who bought it. We never see or store your full card number.

Usage records. A log of each AI request (workspace, user, type of task and time) so we can apply the daily limit and show your usage.

Technical information. Our hosting and database providers record standard server logs (such as IP address, browser type and the time of each request) to run and secure the Service. Cloudflare Turnstile checks sign-in, sign-up and password-reset forms for bots and processes device and browser signals to do so.

Browser storage. The app stores your sign-in session, your current workspace, your preferred email app and your contact-list filters in your browser's local storage, and briefly stores the workspace during a checkout. We don't use advertising or analytics cookies.

2. How we use information

We use information to:

• provide the Service: search SAM.gov, read bid inbox email, score fit, track notices, build proposals, research past awards and labor rates, and track contracts;
• send outreach email that your workspace has approved, track delivery, bounces, replies, complaints and unsubscribes, and stop sending when a person opts out;
• answer your questions and draft content through the AI features;
• send service email: sign-up confirmation, password reset, team invitations and, unless you switch them off, digests of changes to SAM.gov notices you track;
• process purchases and apply AI usage limits;
• secure the Service, prevent abuse and fix problems;
• respond to support requests; and
• meet legal obligations and enforce our Terms.

We don't sell personal information, share it for targeted advertising, or use your workspace's content to train AI models of our own.

3. Who we share information with

We share information only with service providers that help us run GovCon Desk, under their terms that limit their use of it, and only as needed for their role:

Anthropic processes the content we send it under its commercial API terms, which govern how it may use and retain that content.

Public government data services. To answer your searches, the Service sends queries to SAM.gov (search terms, NAICS and product codes, set-asides, states, notice IDs and UEIs you look up), USAspending.gov (NAICS codes, keywords, agency, states and set-asides) and GSA's CALC+ labor-rate service (labor category names and filters). These queries describe what you are looking for, not who you are. SAM.gov queries are sent with your workspace's own SAM.gov API key, so SAM.gov can associate them with the SAM.gov account that key belongs to. USAspending.gov and GSA queries are sent by GCI and don't identify you.

Your own email app. If you choose "Open draft in Outlook" or your mail app, the draft is handed to that app by your browser. What happens there is governed by your email provider.

We may also disclose information:

• when the law, a court order or a valid government request requires it;
• to protect the rights, safety and security of our users, the public or Gnosis Concepts Inc.; or
• to a buyer or successor in a merger, acquisition or sale of the business, which would remain bound by this policy.

4. Who can see your workspace's information

Everything in a workspace (profile, opportunities, bids, proposals, contacts, outreach history, contracts and proposal conversations) is visible to every member of that workspace, not to other GovCon Desk customers. Each workspace keeps its own contact list, even when two customers contact the same person. Owners and admins manage the team. General Charis conversations are visible only to the person who had them; an owner or admin can delete any conversation in the workspace.

5. Government contacts our customers email

GovCon Desk helps small businesses introduce themselves to contracting officers, contract specialists and small business specialists. If you are one of these people, this section explains what we hold about you and how to stop it.

• Where your details come from. Mostly from the point-of-contact information published on SAM.gov contract notices: your name, title, business email and phone, and the agency and office on the notice. A customer may also add you by hand, import a list, or paste a public directory, such as an agency small business office listing, that the Service reads with AI.
• Who decides to email you. Each customer decides whom to contact and what to send, using templates its owner or admin has approved. Email is sent in that customer's name, from its own domain, with its postal address and an unsubscribe link. For this information, GCI acts as a service provider to that customer.
• Unsubscribing. The unsubscribe link (or the one-click unsubscribe button in your email app) stops further outreach from that customer through GovCon Desk right away. Replying with words like "unsubscribe" or "remove me," or marking the email as spam, does the same. We keep a record that you opted out so you are not emailed again by that customer.
• Removal across GovCon Desk. To stop email from every GovCon Desk customer, or to have your details removed, email info@agilegnosis.com from the address you want removed. We will mark that address as unsubscribed in every workspace that holds it, delete your other details if you ask, and confirm within 30 days. We may keep your email address on a do-not-contact record so you are not added back.
• Bounces. If email to your address bounces, the Service stops sending to it.

6. How long we keep information

• Workspace content, including contacts, outreach logs and bid inbox records, is kept while the workspace exists. You can delete individual records and conversations in the app at any time.
• Deleting a workspace or account. Email us from the account's email address. We delete your workspace data within 30 days of a written request, except records we must keep for legal, tax or billing reasons, such as purchase records.
• Opt-out records are kept so that a person who unsubscribed is not emailed again.
• Bid inbox messages are kept by our email provider under its retention settings; the bids extracted from them stay in your workspace.
• Backups and logs kept by our providers are kept for a limited period, then overwritten.

7. Your choices and rights

• Access, correct and delete. You can view and edit your workspace's information in the app, delete records and Charis conversations, export your contacts, and (as an owner or admin) remove members and cancel invitations.
• Close your account. Email info@agilegnosis.com from your account's email address to close your account or delete a workspace. We will confirm the request and complete it within 30 days.
• Email. A workspace owner or admin can switch off SAM.gov update digests in Outreach → Plan & sourcing. Sign-up, password-reset and invitation emails are sent only when someone asks for them.
• State privacy rights. Depending on where you live, you may have the right to know, access, correct, delete or get a copy of your personal information, and to opt out of its sale or use for targeted advertising (we do neither). Email us to exercise any of these rights. We will verify your request, respond within the time the law allows, and won't treat you differently for using them. If we decline a request, you can appeal by replying to our decision. If your information is in a customer's workspace (section 5), we may also pass your request to that customer.

8. Security

We use encryption in transit (HTTPS) and at rest, row-level security that limits each workspace's data to its members, role-based permissions inside each workspace, signed webhooks from our email and payment providers, server-only storage of API keys, and access to production systems limited to the people who run the Service. No system is perfectly secure. If a breach affects your personal information, we will notify you as the law requires.

9. Where information is processed

GovCon Desk is operated from the United States, and your information is stored and processed in the United States. The Service is intended for U.S. businesses.

10. Children

The Service is for businesses and isn't directed to children under 13. We don't knowingly collect information from children, and our Terms require users to be at least 18.

11. Changes to this policy

We will post any update here with a new effective date. If a change is material, we will tell you by email or in the app before it takes effect.

12. Contact

Gnosis Concepts Inc., San Antonio, Texas
Email: info@agilegnosis.com · Phone: (210) 993-6756