1. Information We Collect

We collect the following categories of information when you use Federal Funding Intelligence ("the Service"):

Account information: Email address and encrypted password when you create an account.
Payment information: Billing name, address, and card details processed directly by Stripe. We do not store credit card numbers on our servers.
Behavioral and usage data: Pages visited, searches performed, filters applied, projects viewed, exports downloaded, features used, and in-app events. Collected via PostHog analytics.
Saved preferences: Saved searches, pipeline tags, and alert configurations associated with your account.
Lead capture data: Email addresses voluntarily submitted when requesting CSV exports or newsletter sign-ups.
Feedback program data: Name, organization, job title, use case description, and email address submitted through our founding user access program.
Contact and inquiry data: Content of messages submitted through our contact form or partner inquiry form.
Technical data: IP address, browser type, operating system, device type, and approximate geographic location derived from IP.
Error and diagnostic data: Application errors, stack traces, and session context collected via Sentry for debugging purposes. This may include your user ID and the page or action that triggered the error.
AI search queries: If you use the AI-powered search feature, your search query text is transmitted to a third-party AI provider to generate results. See Section 6.

2. How We Use Your Information

To provide, operate, and maintain the Service
To process payments and manage your subscription
To send transactional emails including receipts, trial notifications, saved search alerts, and account security notices
To send product updates, new data announcements, and feature releases (you may opt out at any time via unsubscribe link)
To analyze usage patterns, measure feature adoption, and improve the product
To detect, investigate, and prevent fraudulent transactions, abuse, and violations of our Terms of Service
To diagnose and fix technical errors using error monitoring data
To respond to your support requests, contact form submissions, and account inquiries
To comply with applicable legal obligations

3. Third-Party Service Providers

We do not sell your personal information. We share data only with the following service providers who process data on our behalf, and only to the extent necessary to provide their services:

Stripe — Payment processing and subscription management. Stripe receives your billing information directly. Stripe Privacy Policy.
Supabase — Database hosting and user authentication. Your account data and saved preferences are stored on Supabase infrastructure.
Vercel — Application hosting and content delivery. Handles web traffic and may log request metadata including IP addresses.
Resend — Transactional email delivery. Your email address is shared with Resend to deliver account notifications, alerts, and product communications.
PostHog — Product analytics. Collects behavioral event data, session information, and technical identifiers to help us understand how the Service is used. PostHog may use cookies and browser storage. See Section 5.
Sentry — Error monitoring and application diagnostics. May receive your user ID, browser context, and the page or action associated with an application error.
Upstash — Redis-based rate limiting. Processes IP addresses to enforce usage limits on API endpoints.
OpenAI — AI-powered search feature. When you use the AI search feature, your query text is sent to OpenAI's API to generate semantic search results. See Section 6.
Law enforcement and legal process: We may disclose information when required by valid legal process, court order, or government request, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

We do not share your personal information with advertisers or data brokers.

4. Data Retention

Account data: Retained for the life of your account. Upon account deletion, personal information is removed within 30 days, except where retention is required by law or legitimate business need (e.g., financial records).
Lead capture and newsletter emails: Retained for up to 12 months from collection, or until you unsubscribe.
Feedback program applications: Retained for the duration of the program and up to 12 months thereafter.
Analytics data (PostHog): Retained per PostHog's default retention policy. Behavioral events are associated with your user ID while your account is active.
Error logs (Sentry): Retained for up to 90 days per Sentry's default retention settings.
Server and access logs: Retained for up to 30 days for security and debugging purposes.

5. Cookies and Browser Storage

We use the following types of cookies and browser storage:

Authentication cookies: Required for login sessions and maintaining your authenticated state. The Service cannot function without these.
Analytics cookies (PostHog): PostHog sets cookies and may use localStorage to identify your browser session and associate usage events with your account across visits. These are not advertising cookies and are not shared with ad networks.

We do not use third-party advertising cookies or sell your browsing data to any ad network. You can disable cookies in your browser settings, but this will prevent you from logging in. To opt out of PostHog analytics tracking, you may use a browser extension that blocks analytics scripts, or contact us to request exclusion.

6. AI-Powered Features

The Service includes an AI search feature that uses large language model technology to interpret and respond to natural-language queries. When you use this feature, your query text is transmitted to OpenAI's API. We do not send your account information, saved searches, or subscription details to OpenAI. Query data is subject to OpenAI's API data usage policies, which prohibit OpenAI from using API inputs to train their models by default. This feature is available to paid subscribers only.

7. Security

We use industry-standard security measures including encrypted connections (HTTPS/TLS), bcrypt password hashing, row-level security on our database, and role-based access controls. Payment data is handled entirely by Stripe under their PCI-DSS compliance program and is never stored on our servers. We conduct periodic security reviews and apply security patches promptly.

No method of transmission over the internet or electronic storage is 100% secure. In the event of a data breach that affects your personal information, we will notify you and applicable authorities as required by law, without undue delay.

8. Your Rights and Choices

You have the following rights regarding your personal information:

Access: Request a copy of the personal information we hold about you.
Correction: Request correction of inaccurate or incomplete personal information.
Deletion: Request deletion of your personal information. We will fulfill deletion requests within 30 days, subject to legal retention requirements.
Opt out of marketing: Unsubscribe from marketing emails at any time via the unsubscribe link in any email, or by contacting us. Transactional emails related to your account (receipts, security alerts) are not affected.
Data portability: Request an export of your account data in a machine-readable format by contacting us.
Object to processing: Object to certain processing of your personal information where we rely on legitimate interests as a legal basis.

To exercise any of these rights, email us at hello@federalfundingintelligence.com. We will respond within 30 days. We may need to verify your identity before fulfilling a request.

9. International Data Transfers

Federal Funding Intelligence is based in the United States. Our service providers — including Supabase, Vercel, Stripe, and PostHog — store and process data primarily in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the U.S., where data protection laws may differ from those in your country. By using the Service, you consent to this transfer.

10. Children

The Service is intended for use by business professionals and is not directed at individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If we become aware that we have inadvertently collected information from a minor, we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will provide at least 14 days' notice by email to your registered address before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision. Your continued use of the Service after the effective date of any changes constitutes acceptance of the updated policy.

12. Governing Law

This Privacy Policy is governed by the laws of the State of Texas, consistent with our Terms of Service.

13. Contact

For privacy questions, data requests, or concerns, contact us at hello@federalfundingintelligence.com. We aim to respond to all privacy inquiries within 30 days.