Privacy Policy

What we collect

To run PrimeWright, we collect: your account information (name, email, organization); the bid and pipeline data you create as you use the product (saved searches, board stages, analysis results, notes); and the documents you upload or generate (solicitation attachments, quotes, signed documents, onboarding materials for SAM.gov registration).

Public-record data

The federal solicitation and award data PrimeWright pulls from SAM.gov and related public federal sources is public-record government data. We ingest, store, and analyze it under those sources' public-API terms — see our security page for how it's isolated to your organization once inside the product.

Your API key (BYOK)

If you choose to bring your own Anthropic API key, that key is encrypted at rest and used solely to run your organization's AI jobs, under the usage caps you set. It is never logged, never displayed again once saved, and never shared with any other organization. Deleting your key or your account removes it permanently.

How we use it

We use your data to operate the pipeline you signed up for: pulling matching opportunities, running analysis, generating documents, and sending you the notifications you've configured. We do not sell your data, and we do not use one organization's bid data to inform another organization's results.

Google user data (Gmail draft creation)

If you connect your Google account, PrimeWright requests a single, narrow scope — gmail.compose — used only to create draft emails in your own Gmail at your explicit request (for example, a submission email with your quote attached, ready for you to review and send). We never send email on your behalf, never read your inbox or any existing mail, and never store the content of a message beyond the transient payload used to build that one draft.

Your Google OAuth refresh token is encrypted at rest, scoped to your organization only, and never logged or returned in any API response. You can revoke access at any time from your Google Account permissions or by disconnecting Gmail from within PrimeWright.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to train AI or machine-learning models, no human reviews it as a matter of course, and we do not transfer it to any third party except as strictly necessary to provide the draft-creation feature you requested (see Subprocessors).

Cookies and site analytics

This marketing site sets no cookies and uses no third-party trackers. A first-party pageview beacon records the page path, referrer, UTM parameters, and browser user-agent for each page view — nothing more. It does not store your IP address, does not assign a user or device identifier, and is never linked to your account or any other data we hold.

Who else touches your data

A small number of infrastructure and service providers process data on our behalf to make the product work — see the full list on our Subprocessors page.

Your rights and choices

You can export or delete your organization's data at any time from within the product. If you'd rather we handle it directly, email support@lunulasupply.com and we'll process the request. If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) to know what personal information we hold about you and to request its deletion; we honor CCPA requests on the same basis as any other deletion request, regardless of where you live.

Data retention

We retain your data for as long as your account is active, or as needed to provide the service. When you delete data or close your organization, it is removed from live systems immediately. Automated backups are retained for approximately 14 days on a rolling basis, so a deleted record ages out of backups on that same cycle rather than being purged from them instantly.

Questions

Contact support@lunulasupply.com with any privacy questions or requests.