Privacy Policy

Effective date: October 22, 2026 (first effective October 8, 2026). Changed October 22, 2026: Verified Veteran coin, Veterans Hall and Who helped you, one account per VA confirmation (section 1A); drafts and notes kept in this browser belong to the signed-in account, what sign-out and account deletion remove, and when a company name typed before sign-in is added to an account (section 1). Changed October 21, 2026: evidence file scanning and rebuilt images, alerts after a team closes, and pursuit records in your copy (sections 4 and 8). Changed October 20, 2026: how optional veteran confirmation with VA works when FedM8 turns it on, what is shared with VA, and how long it is kept (sections 1A, 4 and 6).

This Privacy Policy describes how FedM8 LLC, a Maryland limited liability company ("FedM8," "we," "us," or "our"), collects, uses, and shares information in connection with the FedM8 AI websites and applications, including fedm8.com (together, the "Service"). By using the Service, you agree to the collection and use of information as described in this Policy.

1. Information we collect

Information you provide.

• Account information: email address and a password, or credentials received from a third-party sign-in provider you choose (such as LinkedIn or Google). We receive your name and email from that provider; we never see your password for it.
• Business profile and Veteran Directory information: details you choose to enter, such as company name, NAICS codes, certifications, capability statements, and contact preferences. You control what is publicly visible in the Directory; identifiers such as CAGE, UEI, email, and phone remain hidden unless you choose to show them.
• Team Up: if you build a Team Up profile, we store what you enter (company or your name, headline, what you do, NAICS codes, work terms or skills, places you work, certifications you claim, and, for a company, its UEI so we can read its public SAM.gov record). If you upload a resume, we store the file in a private storage bucket and the text we read from it. We also store the notice lists you join, the notes you send and receive, team membership and messages, recommendations, reviews, reports you file, and when paid members open your profile or resume. Removing your resume deletes the file. Deleting your profile takes your name off every list and deletes its lists, matches and resume. Deleting your account deletes all of it.
• Contract Chat: the posts and replies you write in rooms and conversations, your Helpful marks, reports you file, the people you hide, private messages you send, whether you chose to show your name on public previews, and the certification step you chose to share ("I'm working this step"). We also keep the posts you marked "I'm interested" (and when you took that back), whether you allow FedM8 to suggest you in "People to say hi to", the reply you marked "This answered it", the first topic you picked when you said hello, and whether you opted in to greet newcomers. While you are signed in, the app sends a small "active now" signal about once a minute, so a room can say how many members are online; FedM8 never records who looks at a notice. On the support page, Community Q&A keeps the questions and answers you post and the reports you file. If FedM8 invited you to open an account before November 1, 2026, we keep your email on an invitation list until you confirm the email address of your new account. If you never open one, the invitation is deleted on December 1, 2026.
• Support communications: the contents of tickets you submit through our support form.
• Preferences: saved searches, alert settings, walkthrough progress, and email digest choices.

Information collected automatically. Log and usage data such as IP address, browser type, pages viewed, and timestamps; and locally stored data (localStorage) used to remember your session and in-app progress. Drafts and notes kept in this browser while you are signed in are stored under that account: most are removed when you sign out, a few (the proposal vault, certification and course progress, and your Start answer about what you sell) stay in this browser under your account until you delete the account, and deleting your account removes them from the browser you delete it in; notes typed while signed out stay on this device, tied to no account, until you import them into one; a company name typed before signing in is added to the next account that signs in on this device within an hour, if that account has no company name yet and has not confirmed a company from SAM.gov. We do not currently load third-party scripts that record your clicks or replay your session. We do not use third-party advertising cookies.

Activity and AI conversation history. So a real person can troubleshoot your account when you ask for help, we keep a support record of what you did in the app (pages opened, searches run, tools used, and errors) together with the full text of your FedM8 AI prompts and the replies you received. Only FedM8 administrators can read it, you can request your own copy at any time, and it is automatically deleted after 90 days. It is never sold, never used for advertising, and never used to train third-party AI models.

Payment information. Payments are processed by Stripe. Your full card number never reaches our systems; we store only a customer reference, subscription status, and billing history.

What we do not collect. We don't ask for medical, tax, or banking documents. We never ask for discharge papers, DD-214s, disability ratings, or other personal service records. We do not ask for and do not store SAM.gov or Login.gov credentials.

1A. Veteran confirmation

Veteran confirmation is an optional check of your veteran status with the U.S. Department of Veterans Affairs (VA). This section describes how it works when FedM8 turns it on. If you choose to confirm your veteran status, you enter your legal first and last name, your birth date, and your street address, city, state, ZIP or postal code and country, and, if you wish, your middle name and gender. Before anything is sent, you confirm that the details are your own and agree that FedM8 may send them to VA. FedM8 then sends them to VA's Veteran Confirmation API, and VA answers whether it could confirm your veteran status. You do not sign in to VA, and FedM8 does not ask for discharge papers, a DD-214 or a disability rating. If VA cannot confirm your status, or VA's service does not answer, FedM8 tells you it could not confirm your status with VA. It does not label you or show VA's reason on screen, and you can check your details and try again or contact Support. VA's reason code is kept with your result and is included in your data download.

FedM8 stores the details you entered and VA's answer in your private FedM8 profile for as long as your account exists. The details you entered are encrypted on FedM8's servers. This is not end-to-end encryption: FedM8's systems decrypt your details to show them to you or to put them in your data download. VA's answer, its reason code and the dates of your checks are stored without that encryption, behind access controls that keep them from other members. Your details, VA's reason code and the dates of your checks never appear on your community profile or in the Directory, other members never see them, and they are not sent to AI models. Other members learn your result only from the Verified Veteran coin, from the Veterans Hall and Who helped you rules, and from the one-account rule, all described below. When VA answers a new check, its answer and the details you entered replace the ones saved before; if VA's service does not answer, what was saved stays as it was. FedM8 also keeps a record of each check, without your details, for 90 days. Downloading a copy of your personal data from Account includes the details you entered and your result; if your details cannot be included, the download stops instead of giving you an incomplete copy. Deleting your account deletes your details, your result, the records of your checks and the record of any free Pro months.

Verified Veteran coin, Veterans Hall and Who helped you. When FedM8 turns veteran confirmation on and VA confirms your veteran status, other signed-in members see a Verified Veteran coin next to your name where FedM8 shows member coins, such as Contract Chat posts and member profiles. The coin shows only that VA confirmed your veteran status. It does not show your details, VA's reason code, the dates of your checks or anything else VA said. People who are not signed in do not see it, and nothing is shown if VA does not confirm your status. When FedM8 turns veteran confirmation on, posting in Veterans Hall (the Veterans room) and adding a helper to Who helped you (the VA claim helpers veterans name) also need veteran status confirmed by VA. Members who are not confirmed can still read both. After that, a post you make in Veterans Hall, or a helper you add to Who helped you, also tells other signed-in members that VA confirmed your veteran status: Who helped you shows them your public team name, if you have one, with the helper you named. People who are not signed in can see the helpers listed in Who helped you, but not who named them. Only one FedM8 account can hold a VA confirmation for the same name and birth date. If VA confirms the same name and birth date for more than one account, only the account VA confirmed first gets the coin and the posting described above; if another account confirmed them first, your account gets no Verified Veteran coin. If someone enters the same name and birth date on another FedM8 account and VA confirms them, FedM8 tells that account that another account already holds the confirmation, without saying which account. To know which account VA confirmed first, FedM8 keeps, while your account exists, the fingerprint described below of each name and birth date VA confirmed for your account, with the date VA first confirmed them, even after a later check replaces your details. Deleting your account deletes them.

A confirmation can come with free months of Pro (see the veteran offer in section 3 of our Terms of Service). Each time you check, FedM8 makes a keyed fingerprint of your first name, last name and birth date (a code made from them with a secret key). While your account exists, FedM8 keeps that fingerprint with your saved details and, if a confirmation gave you free Pro months, with that record, and deletes it with them. To keep the same person from getting free months twice, even after deleting an account, when VA confirms your status FedM8 also keeps a separate copy of the fingerprint, with the date it was made, for 24 months, and then deletes it. That copy holds no name, birth date, address or account ID, but it still relates to you, and FedM8 keeps it only to prevent repeat offers. Deleting your account does not delete it before its 24 months end. Fingerprints are not included in your data download.

2. How we use information

• To provide, maintain, and improve the Service, including personalizing opportunity matching to the profile you provide
• To process subscriptions and send transactional messages (receipts, alerts you request, account notices)
• To respond to support requests
• To protect the Service, including fraud prevention, abuse detection, and enforcing our Terms of Service
• To comply with legal obligations

We do not sell your personal information, and we do not share it with third parties for their own advertising.

3. AI features

Paid AI features (such as notice summaries and win briefs) send the relevant government notice text, your prompt, and the business profile fields you have provided to our AI infrastructure to generate a response. AI outputs are generated for you and are not used to train third-party foundation models. AI outputs can be inaccurate; verify them against the official solicitation.

4. How we share information

We share information only with service providers who process it on our behalf under contractual restrictions and, if you choose veteran confirmation, with the U.S. Department of Veterans Affairs (VA). Our service providers include: our development and operations contractor (JBNX LLC, a Maryland limited liability company), our database and sign-in host, our payment processor (Stripe), our application and static hosts, our email delivery provider, our SMS provider (Twilio), and AI model providers (for the AI features described above). VA is not our service provider; FedM8 sends it the details you enter only so VA can check your veteran status (section 1A). We may also disclose information if required by law or legal process, to protect the rights, safety, or property of FedM8 or others, or in connection with a merger, acquisition, or sale of assets (in which case this Policy will continue to apply to previously collected data unless you are notified otherwise).

Veteran Directory. Directory fields you mark visible are shared with other users of the Service by design. You can change visibility or remove your listing at any time.

Team Up. Anyone can see how many companies and people are on a notice's list, never who. Basic and Pro members can see the profile on each list you join: for a company, its name, place, badges, NAICS codes and work terms; for a person, first name and last initial, headline, skills, years of experience and any clearance you report. Your resume text is read by FedM8's matching (Jev, run through TypeSafe as a model provider) and is never shown to other members. A team's lead can open your resume file only if you give that team permission (see Resume permission below), and we log each opening. Your email address is not shown on lists. When a Pro member writes you, FedM8 emails you the note; your email goes to them only if you reply, and theirs is shown to you. Teammates who accept a spot on the same team see each other's email. Recommendations and reviews show on your profile with the reviewer's name.

Openings and responses. When you respond to an opening, FedM8 keeps your availability (earliest start, hours a week, travel and the preference you pick), your note and the card fields you chose to share, for the one team you chose. That team's lead sees them; other teams and other members do not. For a company card, the admins its owner adds, and the representatives the owner or an admin adds, also see the company's responses and selections, and can respond for it. They act for the company only after they accept, and stop the moment they leave or are removed. Withdrawing removes your availability and note from their view and ends any resume permission you gave with that response; your name and the date you withdrew stay in the response history. Your resume goes with a response only if you turn on resume permission for that team (see Resume permission below); your email, phone and UEI are never shared. A resume permission you gave that team another way, such as with another response, keeps running after you withdraw until it ends for one of the reasons below, such as when you stop it or it runs out.

Resume permission. Your resume is shared only with a team you choose, for a reason you choose (reviewing you, or naming you in their proposal), for 30, 90 or 180 days. You can stop it at any time, and the team loses access right away. Copies the team already downloaded cannot be recalled. Uploading a new resume ends the permissions you gave for the old one. A permission to name you in a team's proposal for an opening, given after the team selected you for it, also ends when that selection ends: when you step back, or when the team releases or replaces you. A permission to review you that you gave with your response does not end with the selection. FedM8 keeps a short record of each permission (which team, which version, when, and each time it was opened, never the file) with no time limit; if you delete your account, the record no longer names you. When a team's lead deletes their card or account, that team closes, and the record stops naming it: it reads "A team that has closed". Alerts about that team, including the one that tells you the permission ended, stop naming it too. Your saved availability stays private until you send a response.

Evidence. Evidence you add (past projects, references, certifications, insurance, equipment and samples of your work) stays private. For a company card, the admins its owner adds, and the representatives the owner or an admin adds, also see the company's evidence and can share it: admins for either reason below, representatives only for review and only with a team the company responded to or was selected by. Evidence goes only to a team you (or they) pick, for a reason you pick (reviewing you, or using it in their proposal), for 30, 90 or 180 days, and you can stop it at any time; the team loses access right away. Before anyone can open a file, FedM8 checks its type and damage and scans it for known viruses with a scanner FedM8 runs on its existing application host (see How we share information), so no separate scanning company receives the file. PNG and JPEG images are rebuilt, which removes hidden details such as location and camera data. Only the checked copy is ever opened: for a PDF or Word file it is the file you uploaded, unchanged, and for an image it is the rebuilt image. The separate upload is deleted after the check, usually within a few hours. A file the scan flags is removed; while the scanner is unavailable, new files wait and nobody can open them. Files open only as downloads through FedM8. Copies a team already downloaded cannot be recalled. A new file ends the sharing of the old one, and withdrawing the response a sharing relied on stops it. FedM8 keeps a short record of each sharing (which team, which item, when, and each download, never the file) with no time limit; if you delete your account, the record no longer names you. When a team's lead deletes their card or account, that team closes, and the record stops naming it: it reads "A team that has closed". Alerts about that team, including the one that tells you the sharing ended, stop naming it too. A reference holds a name, organization, role and how they know your work, never a phone number, email or link.

Contract Chat. Members read your posts in the rooms you post in, with your public name (first name and last initial, or your company name), your teaming role and your badges. Some accounts carry a label that FedM8 sets, such as Founding crew or Staff; nobody can give themselves one. Private messages are seen only by the two people in them, and by FedM8 staff if one of them reports a message. When you tap "I'm interested" on a post, its author sees your public name, your role and your badges so they can start a private chat with you; nobody else sees who tapped. If you allow it, members in a contract or code room may see you in "People to say hi to" with one plain reason (your role on the list, a shared code, the same state or shared skills). "Online now" shows a count, never names. Every post and message runs the same safety check, and members can report any post; staff read every report.

Public previews. People who are not signed in can read a few recent posts on fedm8.com, so they can see what the rooms are like. Only posts from open rooms show there: NAICS code rooms, General, Getting certified, First bid, Running the shop, Learning and Grants. A post shows only after it is an hour old, has no open report, and passes our safety check again when shown here. Visitors see the author as a role, like "A member · Sub · Veteran (self-reported)". Your name shows only if you turn on "Show my public name" in My Profile, and you can turn it off at any time. Previews never show profile ids, emails, phone numbers or UEIs. Veterans Hall, Supporters, New here, private messages, and contract and grant conversations never show to visitors. For Veterans Hall, visitors see only how many veterans posted in the last 7 days, and only when it is 3 or more. Any count under 3 is left out.

Certification rooms. Each certification program and step has its own room. If you are listed in the directory, you can turn on "I'm working this step"; members see how many people are on a step only when it is 5 or more, never who. When SAM.gov starts listing a certification (such as SDVOSB or WOSB) for your company and your UEI is verified, members see one line in that program's room with your company's public name and "SAM lists SDVOSB", only if you are listed in the directory. It comes from public SAM.gov data, never from your checklist.

5. Government data

The Service displays data from public government sources, including SAM.gov and USAspending.gov. That data is public information published by the U.S. Government and is not governed by this Policy. FedM8 is not affiliated with, endorsed by, or sponsored by the U.S. Government.

6. Data retention

We retain personal information for as long as your account is active or as needed to provide the Service, resolve disputes, and meet legal and tax obligations. Specific periods:

• Account and profile data (including your veteran directory listing): the life of your account, plus up to 30 days after deletion for backups to cycle out.
• Support tickets: 24 months from the last activity on the ticket.
• Activity and AI conversation history used for support troubleshooting: deleted automatically after 90 days.
• Contract Chat: your posts stay until you remove them or delete your account. A post you remove leaves the public previews the moment it comes down. Your choice about public previews, the people you hid and the certification step you shared are deleted with your account. You can clear your step at any time in its room. An invitation-list entry is deleted as soon as you confirm your account's email address, and every unused invitation is deleted on December 1, 2026.
• Team Up: your profile, lists, notes and reviews stay while your profile exists. A resume file is deleted when you remove it, replace it, or delete the profile; backups cycle out within 30 days.
• Error and abuse logs: 90 days, and they store a one-way hash rather than your IP address.
• Veteran confirmation: the details you entered, your result and any record of free Pro months stay for the life of your account. The record of each check is deleted after 90 days. The fingerprint kept to prevent repeat offers is deleted 24 months after VA first confirmed your status, even if you delete your account before then (section 1A).

You can delete your directory listing or your entire account yourself, immediately, from the Account screen. Deletion removes your personal records, except the veteran confirmation fingerprint that section 1A describes, and returns a receipt of what was removed. Payment records are held by Stripe under its own retention rules; we never store your card details.

7. Security

We use commercially reasonable technical and organizational measures to protect personal information, including encryption in transit, access controls, and row-level security on our database. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. FedM8 is not FedRAMP authorized and is not a CMMC C3PAO. A formal authorization program starts only if a paying buyer funds it.

8. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, and to object to or restrict certain processing. You can exercise these choices by:

• Downloading a copy of your personal data from Account in Workspace (signed-in)
• Editing your profile and Directory visibility directly in the app
• Turning "Show my public name" on public previews on or off in My Profile, and seeing or undoing the people you hid there
• Unsubscribing from digest emails via the link in each email or in Account settings
• Submitting a request through our support form: we will verify the request against your account email and respond within the time required by applicable law

Your copy includes your Team Up cards and your openings, responses, resume permissions, evidence and your company's quotes, drafts included. Where you acted for a company card you do not own, or another member shared with or quoted to a team you lead, it lists those records only by ids, type, status and dates. It lists your files but not their contents, which you download from My evidence and My Profile.

We honor verified requests regardless of your state or country of residence where reasonably practicable. We do not discriminate against you for exercising privacy rights.

9. Children

The Service is a business tool intended for adults. It is not directed to children under 18, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us through the support form and we will delete it.

10. International users

The Service is operated from the United States. If you access it from elsewhere, you understand your information will be processed in the United States, where data protection laws may differ from those in your jurisdiction.

11. Security incidents

If we confirm that personal information we hold was accessed or taken without authorization, we will notify affected account holders at the email on the account, and any regulator the law requires, without unreasonable delay. Where a law sets a clock, we will meet it, including 72 hours after confirmation where that is the rule. Use the support form if you believe your account was involved.

12. Changes to this Policy

We may update this Policy from time to time. Material changes will be posted on this page with a new effective date, and where required by law we will provide additional notice. Continued use of the Service after changes take effect constitutes acceptance of the revised Policy.

13. Contact

Questions or requests about this Policy: use our support form. A real person reads every submission. See also our Refund & Cancellation Policy.