Privacy Policy

Aegis Work LLC ("Aegis Work," "we," "us," or "our") provides a government contracting (GovCon) intelligence platform that helps businesses discover, track, and pursue federal, state, local, and education (SLED) contracting opportunities (the "Service"). This Privacy Policy explains what information we collect, how we use and share it, how long we keep it, and the choices and rights available to you.

This Policy applies to visitors to aegiswork.io, users of the Service, and individuals whose information is submitted to us through the Service. It is incorporated by reference into our Terms of Service.

1. Information We Collect

1.1 Information You Provide to Us.

• Account information: name, work email address, company name, job title, password (stored in hashed form).
• Billing information: billing contact name, billing address, and payment details, which are collected and processed by our third-party payment processor. We do not store full payment card numbers on our own systems.
• Platform content: saved searches, tracked opportunities, notes, tags, exported reports, and other content you create or upload within the Service.
• Communications: messages you send to us, including support requests sent to hello@aegiswork.io.

1.2 Information Collected Automatically.

• Usage data: pages viewed, features used, search queries run within the platform, and timestamps of activity.
• Device and log data: IP address, browser type, operating system, and access times, collected via standard server and application logs.
• Cookies and similar technologies: used for authentication (keeping you logged in), remembering preferences, and understanding aggregate usage of the Service. See Section 7.

1.3 Information from Third Parties.

• Public government data: the Service aggregates and indexes publicly available government contracting and procurement data (e.g., solicitations, awards) from sources such as SAM.gov and other public procurement systems. This data is not personal data about you but may itself contain names or contact details of government or contractor personnel as published by the originating government source.
• Integration partners: if you connect a third-party account or integration to the Service, we may receive information from that provider as authorized by you.

1.4 Information We Do Not Collect. We do not intentionally collect sensitive categories of personal data (e.g., government identification numbers, financial account numbers beyond what's needed for billing, health information, or biometric data) through the Service.

2. How We Use Information

We use the information we collect to:

• Provide, operate, and maintain the Service, including delivering RFP/opportunity alerts and notifications.
• Create and manage your account and authenticate access.
• Process billing and payments.
• Respond to support requests and communicate with you about the Service.
• Monitor, troubleshoot, and improve platform performance and security.
• Detect, investigate, and prevent fraud, abuse, or security incidents.
• Comply with legal obligations.
• Send administrative or transactional communications (e.g., billing notices, service updates). Marketing communications are sent only with your consent or as permitted by law, and you may opt out at any time.

We do not sell personal information, and we do not use your platform content to train third-party AI models without your consent.

3. Legal Basis for Processing (EU/UK Users)

Where applicable data protection law requires a legal basis, we rely on:

• Contract — to provide the Service you've signed up for.
• Legitimate interests — to secure and improve the Service, prevent fraud, and communicate with customers.
• Consent — for optional marketing communications and non-essential cookies.
• Legal obligation — where processing is required to comply with applicable law.

4. How We Share Information

We do not sell your personal information. We share information only in the following circumstances:

• Service providers (subprocessors): vendors that help us operate the Service, including our database and hosting infrastructure provider (Supabase/Postgres), transactional email delivery provider (Resend), and payment processor. Each is bound by contractual terms limiting their use of your data to providing services to us.
• Integration partners: where you affirmatively connect a third-party integration, information necessary for that integration is shared with the applicable partner.
• Legal and safety reasons: where required by law, subpoena, or legal process, or to protect the rights, property, or safety of Aegis Work, our users, or others.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, in which case we will notify affected users as required by law.

5. Data Retention & Deletion

We retain personal information only for as long as necessary for the purposes described in this Policy, consistent with our internal Data Retention & Deletion Policy. Default retention periods are as follows:

We may retain information longer where required to comply with a legal obligation, resolve disputes, enforce our agreements, or address fraud or security concerns.

Requesting deletion. You may request deletion of your personal information at any time by contacting hello@aegiswork.io. We will verify your request, confirm whether any retention exception applies, and complete deletion or anonymization within 30 days of verification (or within the timeframe required by applicable law, such as the CCPA's 45-day response window). Where your data has been shared with a subprocessor or integration partner, we will instruct that party to delete it in accordance with our agreement with them.

This Policy and our underlying retention schedule are reviewed at least annually, and whenever we introduce a new data category, onboard a new subprocessor, or applicable law materially changes.

6. Your Privacy Rights

Depending on your location, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your personal information, subject to the exceptions described in Section 5.
• Port your data to another provider in a structured, commonly used format.
• Opt out of the sale or sharing of personal information (we do not sell personal information) and of targeted advertising (we do not engage in targeted advertising).
• Withdraw consent where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
• Object to or restrict certain processing, where applicable law provides this right.
• Lodge a complaint with your local data protection authority (for EU/UK users) or state attorney general/privacy regulator (for U.S. users).

To exercise any of these rights, contact us at hello@aegiswork.io. We will not discriminate against you for exercising your privacy rights.

California residents: you have rights under the California Consumer Privacy Act (CCPA/CPRA), including the rights described above. We do not sell or share personal information as defined by the CCPA.

EU/UK residents: you have rights under the GDPR/UK GDPR as described above, including the right to lodge a complaint with your supervisory authority.

7. Cookies and Similar Technologies

We use cookies and similar technologies to:

• Keep you logged in and maintain session security (essential — cannot be disabled without affecting core functionality).
• Remember preferences and settings.
• Understand aggregate usage patterns to improve the Service.

We do not use cookies for third-party behavioral advertising. You can control cookies through your browser settings; disabling essential cookies may prevent parts of the Service from functioning.

8. Data Security

We use technical and organizational measures designed to protect your information, including encryption in transit (TLS) and at rest, access controls limiting data access to authorized personnel on a least-privilege basis, and monitoring of production systems. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Our security practices are further described in our Information Security Policy, available upon request.

If we become aware of a security incident affecting your personal information, we will notify affected users and any applicable regulators as required by law.

9. International Data Transfers

Aegis Work is based in the United States, and information we collect is primarily processed and stored in the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States, which may have data protection laws different from those in your jurisdiction. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for such transfers.

10. Children's Privacy

The Service is intended for business use by adults and is not directed to individuals under 18. We do not knowingly collect personal information from children. If we learn we have collected personal information from a child, we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will post the updated Policy on this page with a new effective date, and for material changes we will provide additional notice (such as email or an in-app notification) where required by law.

12. Contact Us

If you have questions about this Privacy Policy, wish to exercise a privacy right, or want to request deletion of your data, contact us at:

Aegis Work LLC
Email: hello@aegiswork.io

This monitored inbox serves as our general and privacy point of contact and is actively reviewed.