Privacy Policy

CanAdd is an intelligence and workflow platform for government contractors, operated from the State of Florida, United States. This policy explains what we collect, why, who processes it and how to get it removed. Privacy requests go to support@canadd.io.

Account data: name, work email, job title, phone if you add it, and authentication records such as sign-in timestamps.

Company profile: company name and address, UEI, CAGE code, NAICS codes, set-aside and socioeconomic certifications, capabilities, past performance and contract preferences.

Uploaded documents: company paperwork you add for readiness checks, solicitations you submit for audit, and proposal material you build in the workspace, along with text extracted from those files.

Usage data: pages and features used, analyses and readiness checks run, credits granted and consumed, plus standard log data such as IP address, browser and timestamps used for security and troubleshooting.

Payment metadata: plan, amount, currency, status, invoice and subscription identifiers. Card numbers are entered directly with Stripe and are never stored by CanAdd.

To operate the service: run readiness checks, rank live opportunities against your profile, produce Contract Intelligence Reports and compliance matrices, and maintain your proposal workspace.

To bill you and send receipts, to send the notifications you enable, to provide support when you ask, to secure the platform and detect abuse, and to meet legal and accounting obligations.

We do not sell personal data, we do not share it with advertisers, and we do not use your uploaded documents to train third-party models.

Stripe: payment processing, card handling, invoices and subscription state.

Supabase: database, authentication and private document storage.

Lovable AI: automated analysis of solicitation and company document text you submit, used only to generate your results.

Lovable email: delivery of transactional mail such as receipts, invites and alerts.

SAM.gov: a public United States government source of federal opportunity data. We read from it; we do not send your documents to it.

Each subprocessor handles data only to deliver the function above. We review new subprocessors before adding them.

Traffic is encrypted in transit. Data is scoped to your company workspace with row-level security in the database, so another customer cannot read it. Uploaded documents live in private storage buckets that require an authorized, time-limited link, and are never publicly addressable.

Secrets and privileged database access stay in server code, payment webhooks are signature-verified, and administrative actions are written to an append-only audit log. No system is perfect: if a breach affects your data we will notify you promptly.

We keep your account, documents and analyses while your account is open. You can delete individual documents, analyses and proposals at any time from the app, and deletion removes the stored file and its extracted text.

When you close your account, or on a written deletion request to support@canadd.io, we delete workspace data within thirty days, except billing and audit records we are required to keep for accounting, tax and fraud purposes.

You can access, correct, export or delete your data. Write to support@canadd.io from your account email and we will respond within thirty days. We will not discriminate against you for exercising these rights. If you are in the EU or UK you also have the right to complain to your supervisory authority.

We use a session cookie and browser local storage to keep you signed in and to remember basic preferences. Stripe sets cookies during checkout for fraud prevention. We do not run advertising trackers.

Do not upload classified or export-controlled material. CanAdd is a commercial platform and is not accredited for classified or CUI-restricted handling.

We may update this policy. Material changes will be announced in the product or by email before they take effect. Privacy questions and data requests: support@canadd.io.