Privacy policy

What we collect

• Account data: name, email, company, state, password hash, plan and membership records, and, if you answer it, how you heard about us. A short record of account events: the sign-up, the first time the app is opened each day, plan changes, invitations and messages, and, if you give one when canceling, the reason.
• Product data: watches, saved views, alert preferences, usage counts (briefs, exports, searches, API calls), team seat assignments, API key hashes.
• Your work: what you enter into the working systems. That is bid worksheets, contract costs and invoices, your staff list and pay rates, timesheets and the log of every change to them, the pay figures you record from your payroll provider, the cost ledger and rate sets, pipeline notes, tasks and reviews, capture plans and readiness answers. And the documents you upload.
• Messages: what you send through the contact form on this site, with a hashed network address so one network cannot flood the form. And what you send from inside the app with Send us a message: what you typed, the kind of message, the name of the screen you sent it from and the version of the app.
• The newsletter: your email address, the codes, states and set-asides you chose, how often you want it, whether the address has been confirmed, the page you signed up on and a hashed network address.
• The course: when you open a course module without an account we ask for your first and last name and your email address, and keep them with the module you were reading.
• Sign-in history: each sign-in, failed sign-in, lock and unlock is a line in the account's history with the browser and the network address it came from. The address is kept whole for 90 days, and then its last part is removed. The owner of an account sees the address of anybody else on it with the last part removed.
• The security questionnaire: if you ask for it, your name, company, work email and why you need it, and each time the link is opened: when, the browser it was opened with and a hashed network address.
• Technical data: standard server logs (IP address, browser, pages requested) kept on our servers for security and debugging. A search on this site keeps a hashed network address for a few minutes, so one network cannot flood it, and so does the live demo. If analytics are enabled, anonymized page-view statistics.

Your own AI key

A paid account can add an AI key of its own, so that readings are written on that key instead of coming off the plan. If you add one, the AI key is encrypted before it is stored, with a key that is kept apart from the data. If it cannot be encrypted it is not stored at all.

It is used only to write your own account's readings, briefs and questions, and a part of a proposal draft where the account has turned AI writing on, and AI in Agreements where the account has turned it on. It is never shown again in full: the app shows the provider, the model and the last four characters. The owner of the account can replace it or remove it at any time, and removing it deletes it.

What we do not collect

We do not read your email or ask for your SAM.gov login. We do not buy contact lists. We do not store payment card numbers: they go to the payment processor. A document reaches us only when you upload it.

Our sales emails

LastAwarded emails people at companies on the federal record to tell them about the service. A company's details come from that record: SAM.gov and USASpending.gov. The work address we write to comes from the company's own profile in SBA's Small Business Search, its own website, or a business contact service we use under our own account (Apollo.io, or Instantly's lead database). We use the address only for those emails and to honor a request to stop. Reply "stop" to any of them, or press Unsubscribe where your email program offers it, and you will not hear from us again.

If you ask us to stop, we keep only your address on a do-not-email list. Ask and we delete the rest.

The service that sends these emails is given your name, job title and email address, and the facts about your company on our list. If you reply and we draft our answer with AI, your reply is sent to the AI provider to write that draft.

Why we use it

To run your account and plan, to send the alerts and reports you asked for, to answer your messages, to keep the service secure and within its limits, and to understand which parts of the product are used so we can improve it.

How many people are looking at something

One number in this product is not from a federal record. When you open, watch or put in your pipeline a notice, a contract that is ending, a code or a buying office, we record that an account did so. Once enough different accounts have looked at the same record, the product can say how many, which is how you find out whether you are about to bid against three companies or thirty. Nobody publishes that anywhere, which is the point of having it.

The rules it runs under, in full:

• Public records only. A notice, a recompete, a code, a product or service code, a buying office, a vehicle. Never a bid, a price, a note, a contact, a contract, a readiness answer or anything else you typed. What you type is yours and that does not change.
• The count, never the list. There is no screen, no export and no query in this product that returns who looked at something. Your account id is stored so that opening the same notice nine times counts once, and for nothing else.
• Nothing below twenty-five accounts. Under that the product says it cannot say, rather than showing a small number. A small number is an identification. The same holds for how many watch it and how many have it in a pipeline: each is shown only when it is twenty-five or more.
• One a day. Reading the same record all afternoon is one signal, so nobody can be picked out by being busy.
• Deleted after about thirteen months. How crowded something is now is a current fact, and a long history of it is a liability rather than a feature.

You can turn it off. The owner of the account or a manager can, under Settings, in "What this product counts": choose to be left out. Your account is then not recorded at all, and anything already recorded for it is deleted. You keep everything else in the product, and the counts other members see simply do not include you.

The count is kept per account rather than per person, so that a firm with ten seats counts once rather than ten times and cannot on its own clear the floor of twenty-five. That also means the choice is shared: the owner of the account or a manager makes it, and it covers everybody on that account.

When something breaks

If a screen fails in your browser, the product sends back what broke and the name of the screen it broke on, so it can be fixed. That is the whole of it: the error message, the line of our own code that raised it, and the screen name, which includes the record number when the screen is about one federal record.

It does not send what you were looking at. Not your filters, not your search terms, not a bid, a price, a note or anything else you typed. At most three reports come from any one page, and identical faults are counted rather than stored again, so this is a short list of things that are broken rather than a record of your visit.

If you use Send us a message in the app, we keep what you type, the kind of message, the name of the screen you sent it from, the version of the app and which account sent it, so that a reply reaches you. Nothing is taken off the screen itself, and a search or a filter in the address is cut off before the screen name is kept.

Who sees it

Our infrastructure provider (servers and database), the payment processor (payments), the email delivery service (alerts and account mail), and the AI provider (your question and the facts on the screen you asked about, which on your own pursuit, bid, contract or books includes what you entered there; never your account details, and for a reading never a document from your library). If you add an AI key of your own, those questions go to the provider that key belongs to. Where the account has turned on AI in Agreements, the AI provider is also sent the text of an agreement somebody asks about, or the passages of the agreements that match a question across them, with the question and your company name. Each is bound by its own privacy terms. We do not sell personal data and do not share it for advertising.

If you choose a language, the words on that screen are sent to Google Translate to be translated. What you and your team typed is kept out of it.

AI writing in a proposal draft is optional, and it is off until you turn it on. The draft of a proposal is built with no AI, and so is the matching of your documents to the requirements of a solicitation. AI writing is off for every account. Only the owner of the account or a manager can turn it on, on the draft screen, after reading what is sent and confirming it. They can turn it off again at any time.

When it is on, pressing "Write this part from my passages" on one part of a draft sends three things to the AI provider for that one press: the requirement sentences of that part, the passages of your own documents shown under them, and your company name. If the account has an AI key of its own, they can go to the provider that key belongs to instead. Nothing else in your library is sent, and nothing is sent until somebody presses that button. The file is never sent. What comes back is shown beside your text as a suggestion and is never saved over what you wrote.

If you connect an Apollo account of your own, the lookups you ask for go to Apollo: the company or the person you asked about. They are sent through the connection you made with Apollo's own sign-in. What comes back is kept in your account only, no other account sees it, and it is deleted with your account. The account owner can disconnect it at any time.

If your account connects its company in QuickBooks Online or Xero, the journal entries somebody on the account sends go to that company: a month's labor distribution and costs, by account, with the contract names in their descriptions. The company's chart of accounts is read so the accounts can be picked. Nothing is sent until somebody presses Send. The access it gives is kept sealed on our servers, and the account owner or a manager can disconnect it at any time.

How long we keep it

Account and product data for as long as the account exists, then deleted within 90 days of closure on request. Documents you uploaded are deleted when the account is closed. Messages for two years when they were sent from inside the app, then deleted, or with your account if that is deleted first. The record of account events is kept for about thirteen months, with the network address of a sign-in kept whole for its first 90 days. The interest counts for about thirteen months. The record of each use of a security questionnaire link, with the browser and a hashed network address, for about thirteen months. For our sales emails, the name, job title, email address and reply of a person who did not reply, said not now, or said they were the wrong person are deleted about thirteen months after the last change. Alert history for 180 days. If an email to you could not be delivered, the address it was for is kept with the fault for 90 days. A download of your data is deleted once it has been downloaded, or after seven days. Server logs on a rotation, typically weeks. Something deleted stays in our nightly backups until those copies are replaced: we keep the copies of the last 14 nights, on our servers and in a second place. Payment records are kept by the payment processor for as long as tax law requires.

Messages sent through the contact form, course sign-ups and newsletter addresses are kept until you ask us to remove them. A newsletter sign-up that is not confirmed within 30 days of the confirmation email is deleted. Unsubscribing from the newsletter stops the mail at once. The address stays on file marked as unsubscribed, so that nothing is sent to it again.

Your choices

You can change or delete watches and saved views at any time, change your own email address and password in the app, and delete any document you uploaded. The owner of an account can remove its AI key. The owner of an account or a manager can turn AI writing in a proposal draft off again at any time. The owner of an account or a manager can leave it out of the interest count under Settings, and what was recorded for it is deleted. Every alert email has a one-click stop link. Every newsletter issue has a link to change what you get and a link to unsubscribe. The owner of an account can download everything it holds from Users and billing in the app, and anybody on an account can download their own data there: one file, with a link we email that works once, for seven days. You can also ask us for it by emailing hello@lastawarded.com from the account's address, and we make the same file and email you the link. You can ask us to delete your account data the same way. You can decline analytics cookies with your browser settings; the product itself works without them.

Cookies

A session cookie keeps you signed in. If you trust a browser when you sign in, a cookie lets it skip the two-step code for 30 days. While you type a two-step code, a cookie holds your place for five minutes. When somebody on an account connects an outside service, a cookie ties the way back from that service to their browser for 15 minutes. When somebody you shared an agreement with opens it, the agreement portal sets a session cookie in their browser for up to two hours. After you give your name and email to read the course, a cookie opens the course in that browser for 180 days. If you open the live demo, a cookie lets that browser use it for 24 hours. It holds no personal data: only when it ends and a signature. If you choose a language, the language switcher keeps your choice in a cookie and in this browser's local storage. This browser remembers your display settings, filters and recent screens, in its own storage. If analytics are turned on, the analytics provider sets its own cookies with IP anonymization enabled.

Children

The service is for businesses and is not directed at anyone under 18.

Changes and contact

If this policy changes in a way that matters, we email account holders before it takes effect. Questions go to hello@lastawarded.com.