Privacy Policy

CapitolBids is operated by Simon Carroll, an individual based in Spain ("we", "us"). This policy explains how we collect, use and disclose personal information when you use capitolbids.com.

For anything to do with your personal information, including exercising your rights, email [email protected].

This is version 3.0, effective September 29, 2026.

This policy covers personal information about you as a visitor to the site or a registered user.

The contract notices themselves are public records published by federal agencies on SAM.gov, and can include the names and work contact details of contracting officers, and the names of businesses (sometimes an individual trading under their own name) that won an award. How we handle people named in that data is set out in section 11.

In the last 12 months we have collected the categories of personal information below. We collect only what we need for the purposes shown.

If you sign in with Google, we receive your name, email address and Google account identifier. We do not receive your Google password and cannot access anything else in your Google account.

We do not collect sensitive personal information as defined in the California Consumer Privacy Act (such as Social Security numbers, financial account credentials, precise geolocation, health or biometric data), other than the account password you choose, which we use only to sign you in. Please do not put sensitive information into free-text fields such as bookmark notes.

We use personal information to:

• Create and run your account, and sign you in
• Send the alerts and digests you set up, and emails needed to run your account (verification, password resets, notices about these policies)
• Prevent bots, spam sign-ups, fraud and abuse, and keep the service secure
• Understand what people search for so we can improve the product
• Understand which pages and websites lead people to create an account
• Measure how the site is used, only if you accept analytics cookies
• Generate AI analysis of a notice when you request it (only the public notice text is sent to the AI provider, never your name, email or account data)
• Take payment, if we ever offer a paid plan and you choose it
• Answer your questions and handle privacy requests
• Comply with law, and establish, exercise or defend legal claims

We do not use personal information for any purpose materially different from these without telling you first.

Essential cookies keep you signed in, protect forms against cross-site request forgery, and remember display preferences such as list or grid view. They are needed for the site to work, so they are set without asking.

Analytics cookies are set by Google Analytics and tell us which pages are used and how people move through the site. They are not set unless you accept them in the cookie banner. If you decline, or ignore the banner, no analytics cookies are set and no analytics data is sent. When they are set, Google may collect information about your use of this site over time; we do not enable Google Analytics’ advertising features, and we do not allow other third parties to collect personal information about your activity on our site.

You can change your choice at any time using the Cookie settings link in the footer. Declining analytics does not reduce your access to any feature.

Global Privacy Control. If your browser sends a Global Privacy Control (GPC) signal, we treat it as declining analytics cookies: Google Analytics is not loaded unless you later turn it on yourself in Cookie settings. We do not sell or share personal information in any case (section 7).

Do Not Track. There is no agreed standard for how sites should respond to the older Do Not Track browser setting, so we do not respond to it differently. Analytics requires your consent either way.

We do not use advertising cookies, we do not run ad networks, and we do not share analytics data with advertisers.

We disclose personal information only to service providers who process it on our behalf and under contract, for the purposes in section 4:

We also disclose personal information where the law requires it, for example in response to a valid subpoena or court order, and where necessary to protect our rights, our users or the public, or to establish, exercise or defend legal claims.

If the business changes hands. If CapitolBids is merged, acquired, reorganized, or transferred to a different operating entity, or its assets are sold, user accounts and the personal information in them would transfer to the new operator. Any disclosure to a prospective buyer beforehand will be the minimum necessary and under a confidentiality agreement. The new operator must handle your information consistently with this policy, or tell you before changing it. We will notify you by email or by a prominent notice on the site, and you may delete your account at any time.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use it for targeted advertising or profiling that produces legal or similarly significant effects. We have not done so in the last 12 months. We do not knowingly sell or share the personal information of anyone under 16.

Because we do not sell or share personal information, there is nothing to opt out of, and we do not offer a "Do Not Sell or Share" link. We do not disclose personal information to third parties for their own direct marketing purposes (Cal. Civ. Code § 1798.83).

• Account data (name, email, password hash) — for as long as your account exists. When you delete your account, the record is deleted immediately.
• Alerts, saved searches and bookmarks — until you delete them, or until you delete your account, whichever comes first.
• Sign-up source — stored with your account, and deleted with it.
• Search history — 90 days, then automatically deleted. It is also deleted when you delete your account.
• Email sending records held by our email provider — in line with that provider’s own retention period, typically days to weeks.
• Analytics data — retained by Google Analytics for up to 14 months.
• Financial records, if you ever make a payment — as long as tax and accounting law requires, typically seven years.
• Support and privacy correspondence — up to two years after the matter is closed, and records of privacy requests for at least 24 months, as California law requires.
• Supplier removal records — the removed name or Unique Entity ID, a short note of the reason, who made the change and when, for as long as the removal applies. Without it a removed profile would come back when the government data refreshes.

Deleted data may persist briefly in encrypted backups, and is removed as those backups expire on their normal cycle. We do not restore deleted accounts from backup.

We use reasonable technical and organizational measures to protect personal information, including encryption in transit (HTTPS with HSTS), passwords stored only as salted one-way hashes, restricted database access, rate limiting and bot protection on public endpoints, and regular dependency and security review.

No system is perfectly secure. If a security breach affects your personal information, we will notify you and any regulator as required by the breach notification laws that apply.

Anyone with an account can, at any time and without asking us, review and edit their details in account settings, use Download your data for a complete export, and use Delete account to erase everything. Every alert and digest email has a link to change or stop it.

California residents have the right, under the California Consumer Privacy Act as amended by the California Privacy Rights Act, to:

• Know and access the categories and specific pieces of personal information we have collected about you, the categories of sources, our purposes, and the categories of recipients (set out in sections 3 to 6)
• Delete personal information we collected from you, subject to legal exceptions
• Correct inaccurate personal information
• Opt out of sale or sharing and limit the use of sensitive personal information — we do neither, as section 7 explains
• Not be discriminated against for exercising any of these rights

Residents of other states with comprehensive privacy laws (such as Colorado, Connecticut, Oregon, Texas, Utah and Virginia) have similar rights to confirm whether we process their personal information, access it, correct it, delete it, obtain a portable copy, and opt out of targeted advertising, sale and profiling. We extend the same rights to every user, wherever they live.

How to make a request. Email [email protected] and say what you are asking for. To protect your account, we verify requests by confirming control of the email address on the account; we may ask for more information where a request concerns data not tied to an account. You may use an authorized agent, who must show us your signed permission, and we may still ask you to verify your identity directly. We respond within 45 days, and tell you if we need up to 45 more. There is no charge unless a request is manifestly unfounded or excessive.

Appeals. If we decline your request, you can appeal by replying to our decision. We will respond to an appeal within the time your state’s law requires (generally 45 to 60 days), and if we deny it, you can contact your state attorney general.

European data protection law. Because CapitolBids is operated from Spain, the EU General Data Protection Regulation (GDPR) applies to how we handle your personal information, wherever you live. The controller is Simon Carroll, contactable as set out in section 1. We rely on these legal bases: our contract with you, to run your account and send the alerts and emails you set up; our legitimate interests in running, securing and improving the service, understanding where sign-ups come from, and publishing public procurement records (section 11), which we weigh against your rights; your consent, for analytics cookies, which you can withdraw at any time in Cookie settings; and our legal obligations. You have the right to access, correct, erase, restrict and port your data, and to object to processing based on our legitimate interests. Email us to use them; we answer within one month. You can also complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (aepd.es), or to the authority where you live.

Contract notices published on SAM.gov can include the names and work email addresses and phone numbers of contracting officers and other government staff. We show these contact details only to signed-in users, never to logged-out visitors, search engines or our public API, and only so that businesses can respond to the opportunity.

Award notices and USAspending.gov records name the business that won the contract. Some businesses trade under an individual’s own name, so a supplier profile can be named after a person.

If you are named in a notice or a supplier profile on CapitolBids and want your details removed, corrected or hidden from search engines, email [email protected] with the page address. You do not need an account. We will act on reasonable requests even where the law would not require us to, and tell you what we did. Because the underlying record is published by the government, it may still appear on SAM.gov or USAspending.gov; to change it there, contact the agency that published it.

When we remove a supplier profile, we keep a short record of the removed name or Unique Entity ID so that the profile stays removed when we refresh the government data (see section 8).

Alert and digest emails are sent only because you set them up or left them switched on. Each one includes a link to unsubscribe or change the alert, and we honor unsubscribe requests promptly and always within 10 business days. We may still send you emails you cannot opt out of while you have an account, such as password resets, security messages and notices about changes to these policies. We never give or sell your email address to anyone else.

CapitolBids is a business service for adults. It is not directed at children, and we do not knowingly collect personal information from anyone under 13 (or from anyone under 18 as a user). If you believe a child has given us personal information, contact us and we will delete it.

CapitolBids is intended for users in the United States. It is operated from Spain, our database is hosted in Germany, and our other service providers are mostly in the United States, as shown in section 6. By using the service you understand that your information will be processed in those countries.

Where personal information goes from the European Union to a provider in the United States, we rely on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission’s standard contractual clauses in that provider’s data processing terms.

We may update this policy. Each version has a version number and an effective date, and the version it replaces stays available from this page so you can see what changed.

For changes that materially affect how we use your personal information, we will give you at least 30 days’ notice by email to the address on your account, or by a prominent notice in the service, before they take effect. We will not use information collected under an earlier version in a materially different way without your consent.

Privacy questions and rights requests: [email protected].

Anything else: [email protected].