Privacy Policy

eSourcing Data Ltd is the controller (and, where applicable, the “business” under the CCPA) responsible for personal information processed through GovCon. We operate GovCon at govcon.winacontract.com. eSourcing Data Ltd is registered in England and Wales and is registered as a data controller with the UK Information Commissioner’s Office (ICO).

For any privacy question or to exercise your rights, contact us at info@winacontract.com.

Account data: When you register, we collect your name, work email address, organization name, and password (stored only as a secure hash).

Profile and content data: Company profile information, proposal-library entries, solicitation details, questions, responses, and any other content you upload to the platform.

Usage data: How you interact with GovCon — pages visited, features used, AI credits consumed, and actions taken.

Payment data: Payments are processed by Stripe. We do not store your full card details. We retain transaction records, subscription status, and billing history.

Technical data: IP address, browser type, device information, and cookies — see our Cookie Policy.

Communications: If you contact us for support, we retain records of that correspondence.

We use your information to:

• Provide, maintain, and improve GovCon
• Process your subscription and manage billing
• Send transactional messages (account verification, password resets, billing notifications)
• Send product updates and announcements (you can opt out at any time)
• Provide customer support
• Monitor platform security and prevent fraud
• Comply with legal obligations
• Analyze anonymized, aggregated usage to improve the platform

We do not sell or “share” your personal information (as those terms are defined under the CCPA/CPRA), and we do not use your proposal content to train AI models without your explicit consent.

Where the UK GDPR applies, we rely on the following legal bases:

Contract performance: processing necessary to provide GovCon under our Terms of Service.

Legitimate interests: platform security, fraud prevention, and improving our services.

Legal obligation: where we must process data to comply with applicable law.

Consent: for marketing communications, which you can withdraw at any time.

Your information is stored and processed by reputable cloud infrastructure providers (see Section 7). Depending on the service, data may be hosted in the United States, the United Kingdom, and/or the European Union. Where personal information is transferred across borders, we rely on appropriate safeguards (such as Standard Contractual Clauses and provider data-processing agreements).

We implement appropriate technical and organizational security measures, including encryption in transit (TLS), encrypted password storage, access controls, and regular security reviews.

No method of transmission or storage is 100% secure. While we take all reasonable steps to protect your information, we cannot guarantee absolute security.

We retain your personal information for as long as your account is active and for a reasonable period afterward in case you wish to reactivate. We retain billing records for up to 7 years to comply with financial and tax requirements.

You may request deletion of your account and personal information at any time by contacting info@winacontract.com. Some information may be retained where required by law or for legitimate business purposes such as fraud prevention.

We use the following providers, which may process your information on our behalf under data-processing agreements:

• Stripe — payment processing
• Supabase / Neon — database and authentication
• Cloudflare R2 — file and document storage
• Render — application hosting and deployment
• Anthropic — AI model provider for proposal-writing features
• Resend — transactional and notification email delivery

Each provider operates under its own privacy policy. We select providers that offer appropriate data-protection standards.

If you are a U.S. resident, you may have the following rights, subject to your state’s law (e.g., California’s CCPA/CPRA, and similar laws in Virginia, Colorado, Connecticut, Utah, and others):

• Right to know / access — the categories and specific pieces of personal information we have collected about you
• Right to delete — request deletion of your personal information
• Right to correct — correct inaccurate personal information
• Right to opt out of sale or sharing — we do not sell or share personal information, so there is nothing to opt out of, but you may confirm this with us
• Right to limit use of sensitive personal information
• Right to non-discrimination — we will not discriminate against you for exercising your rights

To exercise these rights, email info@winacontract.com. We will verify your request and respond within the timeframe required by law (generally 45 days under the CCPA). You may use an authorized agent to submit a request. We honor the Global Privacy Control (GPC) browser signal where applicable.

Where the UK GDPR applies, you also have the rights of access, rectification, erasure, restriction, data portability, objection to processing based on legitimate interests, and withdrawal of consent. To exercise these rights, contact info@winacontract.com; we will respond within 30 days.

We use cookies and similar technologies to operate GovCon. For full details, see our Cookie Policy.

If you have a concern about how we handle your information, please contact us first at info@winacontract.com. U.S. residents may also contact their state Attorney General (for example, the California Attorney General). UK/EU residents may lodge a complaint with the UK Information Commissioner’s Office (ICO).

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by displaying a notice within GovCon. The date at the top of this page indicates when it was last updated.