Privacy policy
Privacy policy
Effective [[EFFECTIVE DATE]] · Operated by [[LEGAL ENTITY]] (“Prime Connect”, “we”)
Prime Connect is a tool for finding federal contract opportunities. It is used at work, by small teams, to do a specific job. This policy describes exactly what it stores, and it is short because Prime Connect stores very little.
The summary. We collect the account details you type in, the bids you star, and the settings you choose. We use one cookie, to keep you signed in. There is no analytics, no advertising, no tracking pixels, and no third party receives your data for their own purposes. Your SAM.gov API key is stored on the server and is never sent to a browser.
1. What we collect
Account information
When an administrator creates your account, we store your email address, the display name entered for you, your role (member or administrator), and a cryptographic hash of your password. We record when the account was created and when you last signed in.
We never store your password itself. It is hashed with scrypt using a salt unique to your account, and the hash cannot be reversed into your password.
Things you create in the product
| Data | Contains |
|---|---|
| Saved bids | Which opportunity or RFQ you starred, which account starred it, when, and a copy of that item’s public details at the time |
| Notes | Whatever free text you type — supplier names, lead times, anything else you record against a bid |
| Pricing figures | The estimated cost and bid price you enter for the margin calculator |
| Workspace settings | Your NAICS categories, DIBBS supply-class filters, and your SAM.gov API key |
Everything in this table is shared with everyone in your workspace. That is the point of the product — it is a team board, not a private one. Assume your colleagues can read your notes, because they can.
Technical records
Server logs record ordinary operational events: that a data refresh ran, how many records it returned, and any errors. Errors are scrubbed of credentials before they are written. The web server records requests in the manner ordinary web servers do, including IP addresses, for security and debugging.
We count sign-in attempts per IP address and per email address, in memory, in order to rate-limit them. Those counters are not written to disk and disappear when the service restarts.
What we deliberately do not collect
- No analytics or product-usage telemetry of any kind
- No advertising identifiers, tracking pixels, or third-party scripts
- No device fingerprinting
- No location data beyond whatever an IP address implies
- No payment card details — we never see them
- No contents of the government documents you open; those links go directly to SAM.gov and DLA
2. Why we hold it
To operate the service you asked for: to sign you in, to show your team the same board, to keep your saved bids and notes, to run the daily refresh against the sources you chose, and to keep the service secure and available. We do not use your data to train models, build profiles, or market to anyone.
Where the UK or EU GDPR applies, our lawful bases are performance of a contract for everything needed to run your account, and legitimate interests for security logging and abuse prevention.
3. Cookies
Prime Connect sets one cookie. It is called prime_session, it
contains a random session identifier and a signature, and it exists so you stay signed in.
It is HttpOnly (JavaScript cannot read it), Secure (it is only
sent over HTTPS), SameSite=Lax, and it expires after 30 days or when you
sign out.
There are no analytics cookies, no advertising cookies, and no third-party cookies, which is why you are not being asked to accept anything.
4. Your SAM.gov API key
Prime Connect needs a SAM.gov API key to pull opportunities on your behalf. It is stored on the server, in the workspace database, so the scheduled refresh can run while nobody is signed in.
Specifically:
- It is never sent to a browser. The settings screen is shown a masked
form of it, such as
SAM-abcd…7890, and nothing more. - It is never written to a log and never included in an error message. Messages are passed through a redaction filter before they are stored or displayed, so a failed request cannot expose it.
- An administrator can replace or remove it at any time from the settings screen.
The key belongs to your SAM.gov account and remains yours. Deleting your workspace deletes it. You should also rotate it at SAM.gov if you ever believe it has been exposed.
5. Who else sees it
We do not sell your data, and we do not share it for anyone else’s marketing.
Your data is visible to:
- Your workspace. Everyone signed in to your team sees the same saved bids, notes and settings.
- Our hosting provider, who stores the encrypted disk the database sits on. They are listed in the data policy.
- Us, where we need access to operate, support or secure the service.
- Law enforcement or a court, where we are legally compelled. We will tell you unless we are prohibited from doing so.
Requests Prime Connect makes to SAM.gov, DIBBS and USAspending are made by our server, on your workspace’s behalf. Those are United States government systems with their own terms and privacy notices; your searches on the Bid History tab are sent to USAspending.gov as search parameters.
6. How long we keep it
| Data | Retention |
|---|---|
| Account, saved bids, notes, settings | Until you delete them, or 30 days after the workspace closes |
| Session records | 30 days, then pruned automatically |
| Cached SAM.gov opportunities | Refreshed continuously; public data, kept while relevant |
| Cached DLA RFQ line items | Deleted 30 days after the return-by date passes, unless starred |
| Refresh history | Kept for operational diagnostics |
| Sign-in rate-limit counters | In memory only; gone on restart |
7. Your rights
Depending on where you live you may have rights to access, correct, delete, export or restrict the processing of your personal data, and to object to it. Residents of California, Colorado, Virginia and several other states have specific statutory rights, as do people in the UK and EU.
Much of this you can do yourself: your workspace administrator can edit or remove any account from the settings screen, and the saved list exports to CSV from the product at any time. For anything else, write to [[CONTACT EMAIL]] and we will respond within 30 days.
We will not discriminate against you for exercising any of these rights. We do not sell personal information or share it for cross-context behavioural advertising, so there is nothing for you to opt out of.
If you are in the UK or EU and are unhappy with how we have handled a request, you may complain to your national supervisory authority.
Signing in and lost passwords
Prime Connect does not send email, and there is no self-service password reset. If you are locked out, your workspace administrator sets you a new password from the settings screen. We mention this because it is a real limitation, not an oversight.
8. How we protect it
Passwords are hashed with scrypt. Sessions are stored server-side and referenced by a
signed, HttpOnly cookie. Sign-in is rate-limited per address and per account,
and takes the same amount of time whether or not the account exists, so it cannot be used
to discover who has one. The application sends a strict Content-Security-Policy, rejects
cross-site state-changing requests, and refuses to start in production without a strong
session secret. The database file is readable only by the application’s own account.
Full detail is in the security notes.
No system is perfectly secure. If we discover a breach affecting your personal data, we will notify affected workspace administrators without undue delay and, where required, the relevant regulator.
9. Children
Prime Connect is a business tool and is not directed at anyone under 16. We do not knowingly collect data from children. If you believe a child has an account, contact us and we will remove it.
10. Changes
If we change this policy we will update the effective date above. For changes that materially affect your rights we will notify workspace administrators by a notice in the product before the change takes effect.
11. Contact
[[LEGAL ENTITY]]
[[POSTAL ADDRESS]]
[[CONTACT EMAIL]]
Prime Connect is a private product. It is not affiliated with, endorsed by, or a product of SAM.gov, the Defense Logistics Agency, USAspending.gov or any other United States government agency.