Privacy Policy
Effective Date: October 21, 2026
J. Martin Consulting LLC, a Michigan limited liability company with its principal office in Novi, Michigan ("GovConDash.ai," "we," "us," or "our"), operates the govcondash.ai and incurredcostproposal.com websites and the GovConDash.ai platform for government contractors and the professionals who advise them (together, the "Services").
This Privacy Policy explains what information we collect, how we use it, who we share it with, how long we keep it, and the choices you have. It applies to visitors of our websites, people who create an account, people who buy a report from the Research Reports store, and people who contact us. It is part of our Terms of Service.
The short version: we collect what the product needs to work, we send your prompts and uploads to an AI model provider to generate results, we use Stripe for payment, Microsoft for email and the optional OneDrive sync, and PostHog to measure how the product is used, an AI agent you connect to our MCP server receives what you ask it to read, we do not sell your information or use advertising trackers, and you can delete your account yourself at any time.
Contents
1. Information We Collect
1.1 Information you give us
| Category | What it includes | When |
|---|---|---|
| Account | Name, email address, and a password we store only as a bcrypt hash. Account type (Government Contractor or GovCon Professional) and, for professionals, your role. | Signup and onboarding |
| Company profile | Company name, UEI, DUNS, address, city, state, zip code, phone, website, small business status, and a primary NAICS code. | Onboarding and the Setup tab |
| Client companies | The UEI and name of each contractor a GovCon Professional adds to its roster, and which one is active. | Account settings |
| Prompts and uploads | Questions you ask the AI agents, documents and spreadsheets you upload (a chart of accounts, a general ledger, a subcontract, a solicitation attachment, a written policy or procedure), and the review decisions you record against a result. | Using the AI features |
| Workspace documents | AI documents and generated reports saved to your Workspace, their revisions, and their sync state if you connect OneDrive. | Using the Workspace |
| Pre-Award Surveys | Your answers to the Pre-Award Accounting Survey, their revisions, and the reports you attach to it (your most recent DCAA audit report, CAS compliance or noncompliance documentation, an outside accounting system audit report), stored exactly as you uploaded them. | Using the Pre-Award Survey |
| Incurred cost proposals | The proposals you prepare in the ICP Dashboard and save to your account: company details and accounting practices, chart of accounts, general ledger and job cost ledger balances, contract cost data, payroll totals from IRS Form 941, indirect cost pools and rates, provisional billing rates, rate scenarios, the saved versions of each proposal, the files you attach to it (for example a general ledger export or a prior year's proposal), stored exactly as you uploaded them, and the column layouts you save for imports. | Using the ICP Dashboard |
| Report purchases | The email address you give at checkout, the report you bought, the amount, and for a custom report the company name or UEI you asked us to profile. Card details go to Stripe and never reach us. | Research Reports store |
| Preferences | Whether you opted in to the weekly regulatory change digest, and interface preferences such as the sidebar state. | Account settings and the dashboard |
| Messages | Your name, email, company and message when you use the contact form, and anything you send to support. | Contact form and support |
| Deletion feedback | The optional reason and feedback you give when you delete your account. | Account deletion |
1.2 Information collected automatically
| Record | What it includes | Why |
|---|---|---|
| AI task log | One row per AI run: the task type, the model, the prompt and system prompt, the input, the output, status, duration, token usage, your user id and company UEI, your IP address and browser user agent. Each row carries a tamper-evident signature. | Metering your quota, cost control, the AI Audit Trail you can view on paid plans, security and abuse prevention |
| Analytics events | A small set of product events (for example a pricing page view or a checkout redirect) with your user id or session id, UEI, IP address and user agent. The same events, together with page views, clicks on interface elements and an error report when a page fails, are also sent to PostHog as described in Section 2. | Understanding how the product is used, measuring the signup funnel, and fixing errors |
| MCP tool call log | One row per tool call a connected AI agent makes through our MCP server: your user id, whether the agent used a sign-in or an agent key and which one, the agent app's registered id, the tool called, whether it succeeded, the reason if it was refused, and how long it took. The call's inputs and results are not stored here. | Enforcing the per-minute limit and daily allowance, security and abuse prevention |
| MCP credentials | Agent keys and the sign-in tokens a connected agent holds, stored only as one-way hashes, with each key's label, its first twelve characters, and when it was created, last used and revoked. Agent apps also register their name and the addresses they return to after sign-in; that registration is not tied to your account. | Letting the agents you approve call the MCP server, and listing them so you can disconnect them |
| Search log | Searches typed into the platform's search boxes, searches a connected AI agent makes through our MCP server, and the questions you ask the Dashboard Agent, the result count, the filters in use, your account type, professional role and plan, and your browser user agent. Searches of the regulation corpus also record your IP address; every other search records only a one-way keyed hash of it. Not linked to your account. | Improving search quality and deciding what to build next |
| Account security | Failed login attempts, a temporary lockout after too many failures, last login time, and short-lived email verification and password reset tokens. | Protecting your account |
| Download activity | How many times each report download link has been used and when it expires. | Enforcing the download limit on purchases |
| Deletion record | Your email, the reason and feedback you gave, IP address and user agent, and the time of deletion. | Proof that a deletion request was honored |
| Server logs and rate limiting | Request metadata held in server memory to enforce per-IP rate limits; not written to the database. | Abuse prevention |
1.3 Information from other sources
- Government data sources. Using the UEI or company name you register, we retrieve your SAM.gov entity registration, your USAspending.gov awards and recipient profile, and your cognizant DCAA branch office. These records are public, and we cache them to keep the dashboard fast.
- Stripe. When you subscribe or buy a report, Stripe tells us your Stripe customer id, subscription id, payment status and the email you used. We never receive your card number.
- Microsoft. If you connect OneDrive, Microsoft tells us the name and email of the account you consented with, and issues the tokens that let us write files to your drive.
- Business contacts. When we speak with a prospective customer, partner or other business contact, we keep a record of that relationship in our own internal contact system: the contact details you share with us (name, email, phone, company, title and LinkedIn profile), the meetings we schedule and hold, our notes of those meetings (including summaries from Granola, the note-taking service we use, and attendee lists from Microsoft Teams attendance reports), follow-ups, and files exchanged in the course of the conversation. Only our own staff can see it.
2. Cookies and Local Storage
We set seven cookies, all on our own domain. Six are ours; the seventh belongs to PostHog, the product analytics service described below. We do not use advertising cookies, tracking pixels or social media plugins, and our fonts are served from our own servers rather than from a font network.
| Cookie | Purpose | Lifetime |
|---|---|---|
| user_token | Keeps you signed in. HttpOnly, SameSite=Strict, sent only over HTTPS in production. | 7 days |
| admin_token | Keeps a staff administrator signed in to the admin area. Set only for staff. | 24 hours |
| sidebar_state | Remembers whether you collapsed the dashboard sidebar. | Preference |
| view_zoom | Remembers the dashboard zoom level you chose. | 1 year |
| icp_agent_panel | Remembers whether you widened the research agent panel in the ICP Dashboard. | 1 year |
| gcd_onedrive_oauth | Protects the OneDrive connection handshake against forgery while you are on Microsoft's consent screen. | Minutes; removed when the handshake completes |
| ph_..._posthog | Set by PostHog's script to recognize the same browser across visits, so page views and product events are counted per visitor rather than per page. Holds a random visitor id and, after you sign in, your user id. Not set when your browser sends Do Not Track. | 1 year |
Product analytics. We use PostHog to understand how the product is used: which pages are viewed, which features are opened, and where the signup and checkout funnel loses people. PostHog's script runs on our pages and sends page views, clicks on interface elements and the product events listed in Section 1 to PostHog's servers in the United States, routed through our own domain. Each event carries your IP address, browser and device type, the page address and the referring page. It does not record what you type into forms, and session recording, which would replay your screen, is switched off. When something on a page fails, PostHog also receives an error report: the error type and message, the stack trace through our own code, the page address and the browser details, so that we can fix it. An error message can include a value the page was working with, such as a document name. When you sign in we tell PostHog your user id, email address, plan and account type, so that your activity before and after signing in is counted once. PostHog honors the Do Not Track setting in your browser: with it on, nothing is sent.
The dashboard also keeps a few values in your browser's local storage so pages load without a round trip: a signed-in flag, your user id, name, email and plan, your account type and role, whether onboarding is complete, the last company you viewed, your model preferences, and layout choices such as which agent view you opened and whether a panel is widened or folded. The research agents keep the conversation you are having in your browser's session storage, so it survives moving between tabs of the dashboard; it is cleared when you close the browser tab or sign out. If you prepare an incurred cost proposal as a local draft in the classic ICP Dashboard page rather than saving it to your account, the whole draft is kept in local storage too, and is never sent to us unless you choose to save it to your account. They stay on your device and are cleared when you sign out or clear site data; apart from the user id, email, plan and account type PostHog receives when you sign in, they are never sent to a third party. PostHog keeps its own visitor record in local storage under the same ph_ name as its cookie.
3. How We Use Information
- To provide the Services: authenticate you, personalize the dashboard to your company or your active client, retrieve your federal contract data, run the AI features you ask for, save and sync your Workspace, and deliver reports you buy.
- To meter and bill: count AI runs against your plan quota, process subscriptions and purchases through Stripe, and issue receipts.
- To communicate: send verification, password reset, receipt and delivery emails; send the weekly regulatory change digest if you opted in; respond to your messages.
- To keep the Services secure: detect and block abuse, enforce rate limits and quotas, lock accounts after repeated failed logins, and keep a tamper-evident audit trail of AI activity.
- To improve the Services: measure how features are used, evaluate model quality and cost, and fix problems. We use aggregated or de-identified statistics for this wherever we can.
- To comply with the law: keep the records tax and accounting rules require, respond to lawful requests, and enforce our Terms.
4. AI Processing
- What is sent to the model provider. When you use an AI feature, your prompt, the relevant parts of your company profile, the file you uploaded or the document you selected, and passages of public regulation and decision text are sent to our model provider, currently OpenAI, through its API. Before that text leaves our servers, your company's name, UEI, CAGE code and contract numbers, and contact details such as email addresses, phone numbers and tax identifiers, are replaced with placeholder tokens; the provider does not receive them, and we restore them in the result you see. The provider returns the generated text, which we organize, cite and show to you.
- How the provider handles it. We use OpenAI's API services, whose data usage terms state that API inputs and outputs are not used to train OpenAI's models. OpenAI may retain API data for a limited period for abuse monitoring under its own policy. See OpenAI's enterprise privacy commitments for the current terms.
- Your incurred cost proposal. The research agent does not read the proposals saved to your account. It uses a proposal's figures only when you choose to share them with a question. Sharing sends a summary of the proposal's indirect rates and cost totals to the model provider with that question, after the same placeholder replacement described above. Your ledgers, payroll records, chart of accounts and attached files are never sent.
- The Dashboard Agent. A question you ask the Dashboard Agent is first searched across our own collections of regulations, audit guidance and decisions, which involves no outside provider, and recorded in the search log described in Section 1.2. On a paid plan the agent then writes a research brief: your question, the facts of your company profile or active client, and the public text it retrieved are sent to the model provider as described above. Each brief is stored in the AI task log and listed in your agent history, where you can reopen it.
- The MCP server. On a paid plan you can connect an AI agent of your choosing (for example ChatGPT, Claude, Cursor or an automation such as Zapier or n8n) to our MCP server, which lets that agent read GovConDash data under your account. The MCP server invokes no model of ours. What a tool returns goes to your agent and to the company that provides it, at your direction: public records, and for the tools that read your own account, your company profile, your contracts, your matched opportunities, your Partner Pipeline, your Agency Watchlist and, only when the agent asks for them, the notes you typed there. The placeholder replacement described above applies only to the model calls we make ourselves; MCP results reach your agent as they are, including your company's name and UEI. Your agent provider's own terms and privacy policy govern what it does with them, not this Policy.
- Our own use. We store each run in the AI task log described in Section 1.2.
- Uploaded documents. We do not keep a file you upload, or its full text, after the run that reads it, with four exceptions: the Opportunity Requirements Package saves the solicitation documents it read, including any you uploaded, to your Workspace so that each document it drafts later rests on the same text; the subcontract tools keep the list of clause numbers they analyzed; the Pre-Award Survey keeps the reports you attach to it, exactly as uploaded, because they are part of the survey package you export; and the ICP Dashboard keeps the files you attach to a saved proposal, exactly as uploaded, for the same reason. The AI features do not read survey or proposal attachments, and those attachments are not sent to the model provider: the survey assistant and review work from your answers and note only which reports are attached. Separately, a result can quote what you uploaded. A Policy Gap Assessment, for example, quotes your policy's own wording beside each rating, and that result is kept in the AI task log and, if you save it, in your Workspace, for the periods in Section 6.
- Diagnostics. When we are diagnosing a problem with an AI feature, we may enable tracing that records the steps of an AI run, including prompts and outputs, with LangSmith, an AI observability service. Tracing is off by default.
- Local models. Some features can run against a model hosted on our own servers. Data processed that way does not leave our infrastructure.
- Embeddings. Semantic search works by converting public decision and regulation text, and your search query, into numeric vectors with the provider's embedding model. Your query is sent for that purpose; the stored vectors describe public documents, not you.
5. Who We Share Information With
We share personal information only with the service providers we need to run the Services, each for the purpose listed, and with authorities when the law requires it. We do not sell personal information, and we do not share it for cross-context behavioral advertising.
| Recipient | What they receive | Why |
|---|---|---|
| Stripe | Your email and the plan or report you are buying; Stripe collects your card details directly. | Payment processing and subscription billing |
| OpenAI | Prompts, uploaded content, company context, public text and, only when you choose to share it, a summary of an incurred cost proposal's rates, as described in Section 4. | Generating AI results and embeddings |
| AI agents you connect | The results of the MCP server tools your agent calls, as described in Section 4. We send them only to the agent you approved or gave an agent key, and only when it asks. | Delivering what you asked your agent to read, at your direction |
| Microsoft (email) | Your email address and the content of each transactional message. | Sending verification, password reset, receipt, delivery and digest emails through Microsoft Graph |
| Microsoft (OneDrive) | The Word and Excel versions of the Workspace documents you chose to sync, written into your own OneDrive. | The optional OneDrive sync you connect and can disconnect at any time |
| PostHog | Page views, clicks and product events with your IP address, browser and device details, an error report when a page fails, and after you sign in your user id, email, plan and account type. | Product analytics and error tracking, as described in Section 2 |
| n8n | Name, email, company and message from the contact form. | Routing contact form submissions to us |
| Granola | The conversation in meetings we hold with business contacts, when we use it to take notes; it returns the notes and summary we keep. | Taking meeting notes |
| SAM.gov | The UEI you register or add to your roster. | Retrieving the public entity registration |
| USAspending.gov | The UEI or company name you register or add to your roster. | Retrieving public award and recipient data |
| DCAA Branch Locator | The UEI and registered address of your company or active client. | Identifying the cognizant audit office |
| LangSmith | The steps of an AI run, only while diagnostic tracing is enabled. | Troubleshooting AI features |
| Hosting and backup | The database and application data on the infrastructure we operate and its backup storage. | Running the Services and recovering from failure |
| Authorities | What a valid subpoena, court order or legal process requires. | Legal compliance and protecting our rights and users |
| A successor | Account and business records, if we merge, are acquired or sell assets, under this Policy. | Business continuity |
SEC EDGAR, the eCFR, the Federal Register and the decision publishers we read from receive no information about you; the Services fetch public documents from them on their own schedule.
6. Retention
| Data | How long |
|---|---|
| Account, company profile, client roster, preferences | Until you delete your account or we terminate it. |
| Workspace documents and revisions | Until you delete the document or your account. Older revisions beyond the retained set are trimmed automatically. |
| Pre-Award Surveys, revisions and attachments | Until you delete the attachment, the survey or your account. |
| Incurred cost proposals, versions and attachments | Until you delete the attachment, the proposal or your account. Each proposal keeps its newest saved versions; older ones are trimmed automatically, and a version marked as submitted is never trimmed to make room for an ordinary one. |
| OneDrive connection tokens | Until you disconnect, delete your account, or Microsoft revokes them. Files already written to your OneDrive stay there; we never delete them. |
| AI task log | For the life of your account; deleted with your account. We do not currently purge these on a schedule, because they are your quota record and your audit trail. |
| MCP tool call log | For the life of your account; deleted with your account. We do not currently purge it on a schedule. |
| MCP sign-ins and agent keys | A sign-in code lasts 10 minutes, an access token 60 minutes and a refresh token 30 days, and each is deleted in routine cleanup once it has been expired for more than a day. An agent key has no expiry; it works until you revoke it, and the revoked key's hash and dates are kept until you delete your account. |
| Analytics events | Deleted with your account. Events with no account (a public page view before signup) are kept for product analysis. The copy PostHog holds is kept under PostHog's own retention and is not removed automatically when you delete your account; contact us and we will delete your PostHog person record. |
| Search log | Kept for search quality analysis. It carries no account identifier. |
| Report purchase records | For as long as tax and accounting rules require, even after an account is deleted. The download link itself expires on the schedule stated at purchase. |
| Deletion record | Kept indefinitely as evidence that the request was honored. It holds your email, your feedback, and the request metadata, and nothing else about you. |
| Contact form and lead records | In our own database and our mailbox until you ask us to remove them. |
| Business contact records | In our internal contact system until you ask us to delete them. |
| Backups | Full backups are taken weekly and the most recent eight sets are kept, so data you delete can persist in a backup for up to about eight weeks before it rotates out. Backups are used only for recovery. |
7. Security
We protect your information with measures that include:
- Encryption in transit (HTTPS) between your browser and the Services, and between the Services and every provider we call.
- Passwords stored only as bcrypt hashes; OneDrive tokens stored under AES-256-GCM encryption bound to your account; report download links issued as unguessable tokens.
- Incurred cost proposals saved to your account, their versions, attached files and saved import layouts encrypted field by field under AES-256-GCM, each value bound to its record and to your account, so the stored data cannot be read or moved to another account without the key.
- Sign-in cookies that JavaScript cannot read (HttpOnly) and that are not sent on cross-site requests (SameSite=Strict); short-lived verification and reset tokens; account lockout after repeated failed logins.
- Per-IP rate limiting and per-account quotas on every AI and paid route, and an entitlement check on every request rather than only in the interface.
- An AI audit trail whose rows carry a cryptographic signature, so alteration is detectable.
- An MCP server that can only read: agent keys and sign-in tokens stored only as one-way hashes, a sign-in bound to the agent that started it (PKCE) and approved on a signed consent page, short-lived access tokens, refresh tokens that rotate on every use and end the whole sign-in if one is reused, and your plan checked on every call.
- A staff analytics console that cannot read password hashes, session tokens, download tokens or OneDrive tokens, by design, and that records every query it runs.
- Automated dependency vulnerability audits and secret scanning on every code change, an internal penetration test program, and a container that runs as a non-root user.
Only the owner and staff who need it to operate the Services can access customer data, under confidentiality obligations. No system is perfectly secure. If we learn of a breach that affects your personal information, we will notify you and any authority the law requires, without unreasonable delay.
8. Your Rights and Choices
Most of these are self-service in the dashboard; the rest are one email away at support@govcondash.ai.
- Access and correction. Your account and company profile are editable in the Setup tab. Your AI Audit Trail is viewable and exportable on paid plans.
- Export. Workspace documents export to Word and Excel, and the OneDrive sync files every saved document into your own drive.
- Deletion. Delete your account from the account settings. This cancels any subscription and removes your profile, company details, client roster, Workspace documents and revisions, Pre-Award Surveys and their attachments, incurred cost proposals with their versions, attachments and saved import layouts, OneDrive connection and sync records, MCP sign-ins, agent keys and tool call log, AI task log and analytics events, immediately. Purchase records and the deletion record are kept as described in Section 6, and backup copies rotate out on the backup schedule.
- Email. The regulatory change digest is opt-in; turn it off in account settings or through the unsubscribe link in any digest. Transactional email (verification, password reset, receipts, delivery, notices about your account) cannot be turned off while you hold an account.
- OneDrive. Disconnect from the Workspace tab at any time, or revoke the app from your Microsoft account. Either removes the stored tokens.
- Connected agents. Your account settings list every AI agent signed in to our MCP server and every agent key. Disconnect an agent or revoke a key there at any time; it stops working on its next call. Data your agent already received stays with its provider, under that provider's policy.
- Marketing. If we send marketing email, every message will carry an unsubscribe link, and you can also ask us to remove you from our contact records.
- Requests. To exercise a right that is not self-service, email support@govcondash.ai from the address on your account, or the address we have for you. We will verify the request and respond within 45 days. We do not discriminate against anyone for exercising a privacy right.
If you are a resident of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana or another state with a consumer privacy law, the rights above are how we honor your rights to know, access, correct, delete, and opt out of sale or sharing. We do not sell personal information or use it for targeted advertising, so there is nothing to opt out of on that score. You may designate an authorized agent to make a request on your behalf, and if we decline a request you may appeal by replying to our response.
9. Public Records About Individuals
The Services organize public government records: tribunal decisions, bid protest decisions, court opinions, size appeals, SEC filings, contract awards and solicitations. Those records name people as their publishers name them, for example judges, attorneys, company officers, contracting officers and individual appellants. We display that information as it appears in the public record and do not add personal information to it. If you believe a record on our site misstates the public source, tell us at support@govcondash.ai and we will check it against the source. Requests to alter the public record itself must go to the publisher.
10. Children
The Services are for business use by adults. You must be at least 18 to use them, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has given us personal information, contact support@govcondash.ai and we will delete it.
11. Where Data Is Processed
The Services are operated from, and your information is stored in, the United States. The providers in Section 5 process data in the United States and, in some cases, in other countries where they operate. If you use the Services from outside the United States, you are sending your information to the United States, where privacy law may differ from your own.
12. Changes to This Policy
We may update this Policy as the Services change. The effective date at the top shows the current version. If a change materially affects how we use personal information we already hold, we will notify account holders by email or by a prominent notice in the dashboard before it takes effect. Continued use of the Services after a change takes effect is acceptance of the revised Policy.