Privacy policy
Your product data stays inside your tenant and is never used to train shared models. On this site we keep what you send us and, only if you say yes, which pages you read. We don't sell any of it.
Who we are
Capveon, Inc. runs capveon.ai and the Capveon product at app.capveon.ai. This policy covers both. Where a customer's signed agreement with us says something different about their data, the agreement wins.
What we collect
When you fill in a form: your name, work email and company, plus whatever the form asks for, such as your company website, a bid link, the states you cover or what you sell.
When you browse, and only if you accept cookies: the pages you view, the buttons you click, your browser and device type, and an approximate location from your IP address. The cookies page lists each cookie.
When you use the product: your account details, your organization's settings, what your team uploads, writes and approves, and the records of systems your team connects. We also keep logs of sign-ins and actions, for security and for the audit trail your team sees.
How we use it
To do what you asked: send the list, read the bid, build the territory brief, answer your email, run your account.
To run and improve the site and product, keep them secure, bill for subscriptions and meet legal obligations.
To send you news about Capveon if you signed up for it. Every email has a link to stop.
Product data
Your operational records, pipeline, documents, notes and drafts are never used to train shared models. Data is tenant-isolated, resident in the United States, and governed by single sign-on, role-based access control and audit logging. Model inference runs against providers under agreements that prohibit training on submitted content.
Every connection to a system you run starts read-only. Nothing is written to a system of record without a person on your team approving it, and every write carries a per-field record of who approved it, when, and from which documents.
Google accounts
When someone on your team connects a Google account, Capveon asks for two permissions. It can send email from that account, and only email a person on your team has approved. It can open the Google Drive files that person picks in Google's file picker, and files that Capveon itself saved to their Drive. It cannot read their inbox or the rest of their Drive.
A file picked from Drive is copied into your tenant and handled like any other file you upload. Email Capveon sends is kept with the approval that sent it. Google data is not used to train or improve AI models, ours or anyone else's, is not sold, and is not used for advertising. People at Capveon do not read it, except with your permission to fix a problem you reported, for security, or where the law requires it.
Capveon's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Disconnect Google in Capveon and the stored access is deleted at once. You can also remove Capveon from your Google account's security settings at any time.
Who helps us run it
We use service providers who process data for us under contract and only on our instructions: Amazon Web Services for hosting and storage in the United States, Clerk for sign-in, HubSpot for forms and our customer records, PostHog for site analytics, Resend for email, and AI model providers for reading and drafting. When your team connects Slack, Microsoft Teams, Google, Microsoft 365, HubSpot or Salesforce, data moves between Capveon and that system as your team sets it up.
We share information when the law requires it, to protect our rights or someone's safety, or as part of a merger or sale of the company, in which case this policy keeps applying to it.
Cookies
We ask before setting any cookie that measures visits or joins them to a form, and a browser privacy signal counts as no. The cookies page lists each one, and Cookie settings at the bottom of every page changes your answer.
We don't sell it
We don't sell personal information, we don't share it for cross-context behavioral advertising, and we don't enrich it with data brokers. We honor Global Privacy Control as an opt-out wherever a law gives one.
Your choices
You can ask to see the information we hold about you, to correct it, to delete it, or to get a copy you can take elsewhere, and you can withdraw a consent you gave. Write to us at the address below. We answer within 30 days, or sooner where a law sets a shorter time, and we may ask you to confirm your email address first. If we turn a request down you can ask us to look again, and you can complain to your local privacy regulator.
These rights come from the laws that apply to you, including the California Consumer Privacy Act and other US state privacy laws, the GDPR in Europe and the UK, and PIPEDA in Canada. We don't treat you differently for using them.
If your information is inside a customer's Capveon account, that customer decides what happens to it, and we'll pass your request to them.
The public record
The public data behind the product comes from public sources: federal contracting and spending systems, state procurement portals and transportation programs, and municipal budgets, capital plans and meeting records. Where those documents name people acting in a public role, such as a contracting officer or an engineer of record, we keep the name as published, with a citation to the document. To ask about a record that names you, write to the address below.
Retention and deletion
Customer data is kept for the life of the subscription and deleted on request or at termination, subject to any legal hold. Disconnect a system and its data is removed from your model. Form submissions and site analytics are kept while we're in touch and deleted when you ask. Public-record data is kept indefinitely, because the value of the record is its history.
Security
Data is encrypted in transit and at rest, access is limited to the people who need it, and every action in the product is logged. No system is perfectly secure; if a breach affects your information we'll tell you as the law requires.
Where it's processed
We store and process data in the United States. If you write to us from elsewhere, your information comes to the United States, and we protect it as this policy describes.
Children
Capveon is for businesses. The site and product aren't meant for anyone under 16, and we don't knowingly collect their information.
Changes
When this policy changes we update the date at the top. If a change matters to how we use information you already gave us, we'll tell customers by email before it takes effect.
Contact
Questions, or a request regarding your own data: hello@capveon.ai.