Privacy Policy

Version 2. This version takes effect on the day FedM8 publishes it. The acceptance screen and your receipt show that date. This policy first took effect on October 8, 2026. Version 1, in effect from October 22, 2026, is kept unchanged at fedm8.com/legal/privacy/v1.

What changed in version 2: the records FedM8 keeps when you agree to the Terms or answer the digest question, and how long it keeps them (sections 1 and 6); the AI providers by name and what each AI feature sends (section 3); each company that receives your information, and who can see what (section 4); personal information in public records (section 5); the periods FedM8 enforces, backups and legal holds (section 6); staff access (section 7); emails, privacy requests, and what you can still do while an agreement is pending (section 8); age (section 9); incident notices (section 11); how changes work (section 12); and how to reach us (section 13).

This Privacy Policy explains how FedM8 LLC, a Maryland limited liability company ("FedM8," "we," "us," or "our"), collects, uses, shares and keeps information when you use the FedM8 AI websites and applications at fedm8.com (together, the "Service"). It is a notice. You acknowledge it when you create an account and when you agree to updated Terms of Service. When FedM8 needs your consent for something, such as the weekly market digest, it asks for that separately.

1. Information we collect

Information you provide.

• Account information: your email address and a password, or the sign-in you choose from Google or LinkedIn. We receive your name and email from that provider; we never see your password for it. When you sign up, you also tell us whether you are a veteran or here to support and, if you support, in what way. If you tell us that you work for the federal government, no account is created and nothing is saved. We keep your kind of account (veteran, supporter or government staff), which you can change in Account.
• Business profile and Veteran Directory information: details you choose to enter, such as company name, NAICS codes, certifications, capability statements, and contact preferences. You control what is publicly visible in the Directory; identifiers such as CAGE, UEI, email, and phone remain hidden unless you choose to show them.
• Team Up: if you build a Team Up profile, we store what you enter (company or your name, headline, what you do, NAICS codes, work terms or skills, places you work, certifications you claim, and, for a company, its UEI so we can read its public SAM.gov record). If you upload a resume, we store the file in a private storage bucket and the text we read from it. We also store the notice lists you join, the notes you send and receive, team membership and messages, recommendations, reviews, reports you file, and when paid members open your profile or resume. Removing your resume deletes the file. Deleting your profile takes your name off every list and deletes its lists, matches and resume. Deleting your account deletes all of it.
• Contract Chat: the posts and replies you write in rooms and conversations, your Helpful marks, reports you file, the people you hide, private messages you send, whether you chose to show your name on public previews, and the certification step you chose to share ("I'm working this step"). We also keep the posts you marked "I'm interested" (and when you took that back), whether you allow FedM8 to suggest you in "People to say hi to", the reply you marked "This answered it", the first topic you picked when you said hello, and whether you opted in to greet newcomers. While you are signed in, the app sends a small "active now" signal about once a minute, so a room can say how many members are online; FedM8 never records who looks at a notice. On the support page, Community Q&A keeps the questions and answers you post and the reports you file. If FedM8 invited you to open an account before November 1, 2026, we keep your email on an invitation list until you confirm the email address of your new account. If you never open one, the invitation is deleted on December 1, 2026.
• Your work in the Workspace: the notices and grants you track, your pipeline and its comments, saved searches, alert settings and award watches, certification checklist, lesson and walkthrough progress, past performance entries, proposal coverage and decision briefs, your thumbs up or down on notices, and requests you send us for Pro help or new features.
• AI credits and usage: your AI credit balance and, for each AI request, the feature, the notice, the credits and tokens it used and the model.
• Who helped: if you add a site or group that helped you with VA benefits to the "Who helped someone here" list, the name, web address and state you enter.
• Company workspaces: if you create or join one, the company's name, its members and their roles, invitations, and what members add for the company, such as CRM accounts, contacts and activities, a shared past-performance vault and capability details. CRM contacts can hold other people's names and emails that members enter.
• Support communications: the contents of tickets you submit through our support form, and what you send through the site feedback form.
• Preferences: saved searches, alert settings, walkthrough progress, and email choices, including your answer to the weekly market digest question.
• Launch list: if you ask to be told when sign-up opens, your email and the choices you make on that form, such as whether you are a veteran. Joining the list does not open an account or accept any terms.

Agreement and consent records. When you agree to the Terms of Service, FedM8 keeps a record of it. The record holds your account ID; a keyed fingerprint of your email address (a code made from it with a secret key, not the address itself); your kind of account and, if you belong to a company workspace, the company, its name and your role at that moment; each document you were shown, with its version, effective date, web address and a fingerprint (SHA-256) of its text; the exact words next to the box you ticked; your confirmation that you are 18 or older and, if you act for a company, that you have authority to accept for it; whether it was your first sign-in, an invitation or an update; how your account signed in (for example email, Google or LinkedIn), the sign-in method and the session; the website the request said it came from; the label the page sent; a receipt code; and the server's time. FedM8 also keeps a record each time you say yes or no to the weekly market digest, with the same keyed fingerprint of your email, the time, how it was made and, for a yes, the words you saw. It also keeps each statement that you have authority to act for a company, with the company, its name, your role, the words you saw and the time. These records do not include your IP address or details about your browser or device.

Information collected automatically. Like any website, our hosting providers receive your IP address with each request. FedM8 uses it for a short time to limit abuse, such as too many requests in a row. FedM8's error log, missing-page log, support form, feedback form and launch-list form keep a hash of it (a code made from the address) instead of the address, and most of them also keep your browser type, the page and the time and, if you are signed in, your account. We keep data in your browser (localStorage) to remember your session and your in-app progress. Some of it stays in that browser after you sign out, so on a shared computer, use a private window. Drafts and notes kept in this browser while you are signed in are stored under that account: most are removed when you sign out, a few (the proposal vault, certification and course progress, and your Start answer about what you sell) stay in this browser under your account until you delete the account, and deleting your account removes them from the browser you delete it in; notes typed while signed out stay on this device, tied to no account, until you import them into one; a company name typed before signing in is added to the next account that signs in on this device within an hour, if that account has no company name yet and has not confirmed a company from SAM.gov. We do not use advertising cookies.

Page statistics. Many of our pages, including the Workspace, load a small FedM8 script that sends page events to JBNX LLC's project portal at projects.jbnx.io: the site and page (in the Workspace, only the name of the screen), your browser type, the page you came from, campaign tags in the link, and, when you click a link to another site, its words, or when you start typing in or send a form, that you did. It never sends what you type into a form, your account or a cookie. Like any web request, it reaches JBNX with your IP address. We do not currently load third-party scripts that record your clicks or replay your session; the only script that records clicks is this FedM8 script. Our test site, test.fedm8.com, also sets a cookie named "sid" for 90 days to count visits and sends the same events to JBNX.

Google. Our pages load fonts from Google Fonts, so your browser connects to Google when you open a page. The home page and the Workspace sign-in page also load Google's sign-in script so you can sign in with Google.

Product events. When you are signed in, the Workspace records some steps with your account, such as finishing a roadmap step or adding NAICS codes, as short event names without the content you worked on.

Activity and AI conversation history. So a real person can troubleshoot your account when you ask for help, we keep a support record of what you did in the app (pages opened, searches run, tools used, and errors) together with the full text of your FedM8 AI prompts and the replies you received. You can see it in your data download, FedM8 staff with administrator access can read it, and it is automatically deleted after 90 days. It is never sold and never used for advertising. FedM8 does not use it to train AI models and does not give it to anyone for that purpose.

Payment information. Payments are processed by Stripe. Your full card number never reaches our systems; we store only a customer reference, subscription status, and billing history.

Text messages. FedM8 has no text-message program. We do not ask for your phone number to text you, and we do not send you marketing or account texts. FedM8 does have an inbound text-message line, run by our phone provider, Twilio. If you text it, Twilio passes your message to FedM8, which may answer once automatically and may keep the number you texted from and your message.

What we do not collect. We don't ask for medical, tax, or banking documents. We never ask for discharge papers, DD-214s, disability ratings, or other personal service records. We do not ask for and do not store SAM.gov or Login.gov credentials.

1A. Veteran confirmation

Veteran confirmation is an optional check of your veteran status with the U.S. Department of Veterans Affairs (VA). This section describes how it works when FedM8 turns it on. If you choose to confirm your veteran status, you enter your legal first and last name, your birth date, and your street address, city, state, ZIP or postal code and country, and, if you wish, your middle name and gender. Before anything is sent, you confirm that the details are your own and agree that FedM8 may send them to VA. FedM8 then sends them to VA's Veteran Confirmation API, and VA answers whether it could confirm your veteran status. You do not sign in to VA, and FedM8 does not ask for discharge papers, a DD-214 or a disability rating. If VA cannot confirm your status, or VA's service does not answer, FedM8 tells you it could not confirm your status with VA. It does not label you or show VA's reason on screen, and you can check your details and try again or contact Support. VA's reason code is kept with your result and is included in your data download.

FedM8 stores the details you entered and VA's answer in your private FedM8 profile for as long as your account exists. The details you entered are encrypted on FedM8's servers. This is not end-to-end encryption: FedM8's systems decrypt your details to show them to you or to put them in your data download. VA's answer, its reason code and the dates of your checks are stored without that encryption, behind access controls that keep them from other members. Your details, VA's reason code and the dates of your checks never appear on your community profile or in the Directory, other members never see them, and they are not sent to AI models. Other members learn your result only from the Verified Veteran coin, from the Veterans Hall and Who helped you rules, and from the one-account rule, all described below. When VA answers a new check, its answer and the details you entered replace the ones saved before; if VA's service does not answer, what was saved stays as it was. FedM8 also keeps a record of each check, without your details, for 90 days. Downloading a copy of your personal data from Account includes the details you entered and your result; if your details cannot be included, the download stops instead of giving you an incomplete copy. Deleting your account deletes your details, your result, the records of your checks and the record of any free Pro months.

Verified Veteran coin, Veterans Hall and Who helped you. When FedM8 turns veteran confirmation on and VA confirms your veteran status, other signed-in members see a Verified Veteran coin next to your name where FedM8 shows member coins, such as Contract Chat posts and member profiles. The coin shows only that VA confirmed your veteran status. It does not show your details, VA's reason code, the dates of your checks or anything else VA said. People who are not signed in do not see it, and nothing is shown if VA does not confirm your status. When FedM8 turns veteran confirmation on, posting in Veterans Hall (the Veterans room) and adding a helper to Who helped you (the VA claim helpers veterans name) also need veteran status confirmed by VA. Members who are not confirmed can still read both. After that, a post you make in Veterans Hall, or a helper you add to Who helped you, also tells other signed-in members that VA confirmed your veteran status: Who helped you shows them your public team name, if you have one, with the helper you named. People who are not signed in can see the helpers listed in Who helped you, but not who named them. Only one FedM8 account can hold a VA confirmation for the same name and birth date. If VA confirms the same name and birth date for more than one account, only the account VA confirmed first gets the coin and the posting described above; if another account confirmed them first, your account gets no Verified Veteran coin. If someone enters the same name and birth date on another FedM8 account and VA confirms them, FedM8 tells that account that another account already holds the confirmation, without saying which account. To know which account VA confirmed first, FedM8 keeps, while your account exists, the fingerprint described below of each name and birth date VA confirmed for your account, with the date VA first confirmed them, even after a later check replaces your details. Deleting your account deletes them.

A confirmation can come with free months of Pro (see the veteran offer in section 4 of our Terms of Service). Each time you check, FedM8 makes a keyed fingerprint of your first name, last name and birth date (a code made from them with a secret key). While your account exists, FedM8 keeps that fingerprint with your saved details and, if a confirmation gave you free Pro months, with that record, and deletes it with them. To keep the same person from getting free months twice, even after deleting an account, when VA confirms your status FedM8 also keeps a separate copy of the fingerprint, with the date it was made, for 24 months, and then deletes it. That copy holds no name, birth date, address or account ID, but it still relates to you, and FedM8 keeps it only to prevent repeat offers. Deleting your account does not delete it before its 24 months end. Fingerprints are not included in your data download.

2. How we use information

• To provide, maintain, and improve the Service, including personalizing opportunity matching to the profile you provide
• To process subscriptions and send transactional messages (receipts, alerts you request, account notices)
• To respond to support requests
• To protect the Service, including fraud prevention, abuse detection, and enforcing our Terms of Service
• To keep a record of what you agreed to and of your email choices, and to follow those choices
• To send the weekly market digest, an optional email about new opportunities
• To comply with legal obligations

To improve the Service means to fix problems and make features work better, for example by reading support records and error logs. It does not mean training AI models on your content.

We do not sell your personal information, and we do not share it with third parties for their own advertising.

3. AI features

Some FedM8 features use AI models. They include AI summaries of notices and grants, Win Kit, fit scores and rankings (such as Best fit and Match-M8), Team Up matching, the "FedM8 AI" note pinned in contract and grant conversations and, when FedM8 turns them on, the Assist chat, AI search, decision briefs and catch-up summaries of conversations.

What they send. The text of public notices and grants and their files; the business profile fields you entered, such as company name, UEI, NAICS codes, certifications, places and capability statement; your past performance entries and your company's, when Win Kit writes a draft; a draft you ask Win Kit to check; your Team Up profile and part of your resume text, for matching; your words, when you use the Assist chat or AI search, and the records the Assist chat looks up for you, such as notices, awards and your past performance entries; and a conversation's recent posts, for a catch-up summary. Win Kit leaves your contact details out. Veteran confirmation details are never sent to AI models.

Who processes it. Requests that write text go through FedM8's own AI gateway (LiteLLM), which runs on Railway. The gateway sends them to OpenRouter, which passes them to OpenAI's GPT-4o mini and GPT-4o models. Judgments go to TypeSafe, which runs the Jev model: scores, rankings and matching, Win Kit's bid decision, which past performance entries fit a notice and whether a draft answers each requirement, resume reading, what a chat or search message asks for, and some checks of AI answers. FedM8 sends data to these providers only to produce results for FedM8's features. This policy does not describe what each provider does with data on its own systems; each provider's own terms and privacy policy cover that.

Training. FedM8 does not use your content to train AI models, and does not sell it or give it to anyone for that purpose. Earlier versions of this policy said that AI outputs are not used to train third-party foundation models and that your activity and AI conversation history is never used to train third-party AI models. Those promises still apply to everything FedM8 received before this version took effect.

Accuracy. AI outputs can be wrong or out of date. Check them against the official notice or grant before you rely on them. FedM8's AI features do not send, sign or submit anything for you.

4. How we share information

We share personal information with the companies below so they can run parts of the Service, with the people you choose inside the Service, and, if you choose veteran confirmation, with the U.S. Department of Veterans Affairs (VA).

• JBNX LLC, a Maryland limited liability company: our development and operations service provider. It builds and runs the Service and receives the page statistics described in section 1. It also receives an email copy of each support ticket and site feedback message, with the contact details and the message you sent.
• Supabase: our database, sign-in, file storage and server functions.
• Cloudflare: hosts the fedm8.com website.
• Railway: runs our application server, our AI gateway and our test site.
• Stripe: our payment processor.
• Resend: delivers our email, including sign-in links.
• Twilio: our phone provider for FedM8's inbound text-message line.
• OpenRouter, OpenAI and TypeSafe: AI model providers, as section 3 explains.
• Google and LinkedIn: sign-in, if you choose them. Google also serves the fonts and the sign-in script our pages load.

VA is not our service provider; FedM8 sends it the details you enter only so VA can check your veteran status (section 1A). When you enter a UEI, FedM8 looks it up in SAM.gov's public data. If you add a webhook address to a saved search, FedM8 sends that search's alerts to the address you entered, such as one from Slack, Microsoft Teams or Zapier, and that service handles them under its own terms. We may also disclose information if required by law or legal process, to protect the rights, safety, or property of FedM8 or others, or in connection with a merger, acquisition, or sale of assets (in which case this Policy will continue to apply to previously collected data unless you are notified otherwise).

Veteran Directory. Directory fields you mark visible are shared with other users of the Service by design. You can change visibility or remove your listing at any time.

Team Up. Anyone can see how many companies and people are on a notice's list, never who. Basic and Pro members can see the profile on each list you join: for a company, its name, place, badges, NAICS codes and work terms; for a person, first name and last initial, headline, skills, years of experience and any clearance you report. Your resume text is read by FedM8's matching (Jev, run through TypeSafe as a model provider) and is never shown to other members. A team's lead can open your resume file only if you give that team permission (see Resume permission below), and we log each opening. Your email address is not shown on lists. When a Pro member writes you, FedM8 emails you the note; your email goes to them only if you reply, and theirs is shown to you. Teammates who accept a spot on the same team see each other's email. Recommendations and reviews show on your profile with the reviewer's name.

Openings and responses. When you respond to an opening, FedM8 keeps your availability (earliest start, hours a week, travel and the preference you pick), your note and the card fields you chose to share, for the one team you chose. That team's lead sees them; other teams and other members do not. For a company card, the admins its owner adds, and the representatives the owner or an admin adds, also see the company's responses and selections, and can respond for it. They act for the company only after they accept, and stop the moment they leave or are removed. Withdrawing removes your availability and note from their view and ends any resume permission you gave with that response; your name and the date you withdrew stay in the response history. Your resume goes with a response only if you turn on resume permission for that team (see Resume permission below); your email, phone and UEI are never shared. A resume permission you gave that team another way, such as with another response, keeps running after you withdraw until it ends for one of the reasons below, such as when you stop it or it runs out.

Resume permission. Your resume is shared only with a team you choose, for a reason you choose (reviewing you, or naming you in their proposal), for 30, 90 or 180 days. You can stop it at any time, and the team loses access right away. Copies the team already downloaded cannot be recalled. Uploading a new resume ends the permissions you gave for the old one. A permission to name you in a team's proposal for an opening, given after the team selected you for it, also ends when that selection ends: when you step back, or when the team releases or replaces you. A permission to review you that you gave with your response does not end with the selection. FedM8 keeps a short record of each permission (which team, which version, when, and each time it was opened, never the file) with no time limit; if you delete your account, the record no longer names you. When a team's lead deletes their card or account, that team closes, and the record stops naming it: it reads "A team that has closed". Alerts about that team, including the one that tells you the permission ended, stop naming it too. Your saved availability stays private until you send a response.

Evidence. Evidence you add (past projects, references, certifications, insurance, equipment and samples of your work) stays private. For a company card, the admins its owner adds, and the representatives the owner or an admin adds, also see the company's evidence and can share it: admins for either reason below, representatives only for review and only with a team the company responded to or was selected by. Evidence goes only to a team you (or they) pick, for a reason you pick (reviewing you, or using it in their proposal), for 30, 90 or 180 days, and you can stop it at any time; the team loses access right away. Before anyone can open a file, FedM8 checks its type and damage and scans it for known viruses with a scanner FedM8 runs on its existing application host (see How we share information), so no separate scanning company receives the file. PNG and JPEG images are rebuilt, which removes hidden details such as location and camera data. Only the checked copy is ever opened: for a PDF or Word file it is the file you uploaded, unchanged, and for an image it is the rebuilt image. The separate upload is deleted after the check, usually within a few hours. A file the scan flags is removed; while the scanner is unavailable, new files wait and nobody can open them. Files open only as downloads through FedM8. Copies a team already downloaded cannot be recalled. A new file ends the sharing of the old one, and withdrawing the response a sharing relied on stops it. FedM8 keeps a short record of each sharing (which team, which item, when, and each download, never the file) with no time limit; if you delete your account, the record no longer names you. When a team's lead deletes their card or account, that team closes, and the record stops naming it: it reads "A team that has closed". Alerts about that team, including the one that tells you the sharing ended, stop naming it too. A reference holds a name, organization, role and how they know your work, never a phone number, email or link.

Company workspaces. People in a company workspace see the company records its members add, such as CRM accounts, contacts and activities. A pipeline item is seen by its owner and by the people the owner shares it with.

Contract Chat. Members read your posts in the rooms you post in, with your public name (first name and last initial, or your company name), your teaming role and your badges. Some accounts carry a label that FedM8 sets, such as Founding crew or Staff; nobody can give themselves one. Private messages are seen only by the two people in them, and by FedM8 staff if one of them reports a message. When you tap "I'm interested" on a post, its author sees your public name, your role and your badges so they can start a private chat with you; nobody else sees who tapped. If you allow it, members in a contract or code room may see you in "People to say hi to" with one plain reason (your role on the list, a shared code, the same state or shared skills). "Online now" shows a count, never names. Every post and message runs the same safety check, and members can report any post. FedM8 staff read reports.

Public previews. People who are not signed in can read a few recent posts on fedm8.com, so they can see what the rooms are like. Only posts from open rooms show there: NAICS code rooms, General, Getting certified, First bid, Running the shop, Learning and Grants. A post shows only after it is an hour old, has no open report, and passes our safety check again when shown here. Visitors see the author as a role, like "A member · Sub · Veteran (self-reported)". Your name shows only if you turn on "Show my public name" in My Profile, and you can turn it off at any time. Previews never show profile ids, emails, phone numbers or UEIs. Veterans Hall, Supporters, New here, private messages, and contract and grant conversations never show to visitors. For Veterans Hall, visitors see only how many veterans posted in the last 7 days, and only when it is 3 or more. Any count under 3 is left out.

Certification rooms. Each certification program and step has its own room. If you are listed in the directory, you can turn on "I'm working this step"; members see how many people are on a step only when it is 5 or more, never who. When SAM.gov starts listing a certification (such as SDVOSB or WOSB) for your company and your UEI is verified, members see one line in that program's room with your company's public name and "SAM lists SDVOSB", only if you are listed in the directory. It comes from public SAM.gov data, never from your checklist.

Who helped. The "Who helped someone here" list shows each entry's name, web address and state. Anyone can read this list, including people who are not signed in. If you have a Team Up profile, signed-in members also see your public name (first name and last initial, or your company name), your badges and a link to that profile with your entry; people who are not signed in do not see who added an entry. Section 1A says what an entry also tells signed-in members when FedM8 turns veteran confirmation on. You can remove your entry at any time.

Who can see what, in short.

• Anyone, including people who are not signed in: a few recent posts from open rooms, with your role and not your name unless you turn on "Show my public name"; and your entry on the Who helped list (its name, web address and state), without showing who added it.
• Signed-in members: your posts in the rooms you post in, the Directory fields you mark visible, your entry on the Who helped list with your public name if you have a Team Up profile, and, when FedM8 turns veteran confirmation on and VA confirms your veteran status, your Verified Veteran coin (section 1A).
• Basic and Pro members: your profile on each Team Up list you join.
• Only the people you choose: your private messages (the two of you), your resume file and evidence (the teams you give permission to), and your response to an opening (that team).
• People in your company workspace: the records members add for the company.
• Only you, among members: your veteran confirmation details, VA's reason code and the dates of your checks (other members learn only what section 1A describes), your activity and AI conversation history, and your agreement and consent records.
• FedM8 staff: what section 7 describes.

5. Information from public sources

The Service shows records that public government sources publish, including SAM.gov, USAspending.gov and Grants.gov. Some of these records name people, such as a contracting officer or a company's point of contact. FedM8 uses them to show, search and match public contracting and grant information, and this policy covers how FedM8 handles the personal information in them. If a public record about you is wrong, the agency that published it can correct it, and you can ask us through the support form to look at how FedM8 shows it. FedM8 is not affiliated with, endorsed by, or sponsored by the U.S. Government.

6. Keeping and deleting information

We keep personal information while your account is open, or as long as we need it to provide the Service, resolve disputes, and meet legal and tax obligations. Specific periods:

• Account and profile data (including your veteran directory listing): the life of your account.
• Support tickets: until you delete your account, or until you ask us to delete a ticket. Email copies of a ticket or a site feedback message, sent to staff inboxes (JBNX's included) when you sent it, are not deleted with it.
• Activity and AI conversation history used for support troubleshooting: deleted automatically after 90 days.
• Error log: deleted automatically after 30 days. The missing-page log, site feedback and the launch-list form's abuse check have no set end date; when you delete your account, their entries tied to it are deleted or no longer name you.
• Contract Chat: your posts stay until you remove them or delete your account. A post you remove leaves the public previews the moment it comes down. Your choice about public previews, the people you hid and the certification step you shared are deleted with your account. You can clear your step at any time in its room. An invitation-list entry is deleted as soon as you confirm your account's email address, and every unused invitation is deleted on December 1, 2026.
• Team Up: your profile, lists, notes and reviews stay while your profile exists. A resume file is deleted when you remove it, replace it, or delete the profile.
• Veteran confirmation: the details you entered, your result and any record of free Pro months stay for the life of your account. The record of each check is deleted after 90 days. The fingerprint kept to prevent repeat offers is deleted 24 months after VA first confirmed your status, even if you delete your account before then (section 1A).
• Agreement and consent records (section 1): kept after you close your account, so FedM8 can show what you agreed to and that it followed your email choices. They are deleted 3 years after your account is closed, unless a legal hold applies.
• Legal holds: FedM8 may place a legal hold on an account's agreement and consent records when they are needed for a legal claim, a dispute or a legal request. Records under a hold are kept until the hold ends, even past 3 years. Only FedM8 administrators place holds, and holds are not shown in your data download. FedM8 keeps a record of each hold and its reason, even after the hold ends.
• Launch list: until you ask us to remove your email or you delete an account that uses it. If you leave the list through a link in one of its emails, FedM8 also keeps a hash of your address so it does not email you again.
• Text messages you send to FedM8's inbound text-message line: no set end date.
• Backups: deleted data may remain in our providers' backups until those backups are overwritten.

Deleting your account. You can delete your directory listing or your entire account yourself, right away, from the Account screen. Deleting your account cancels any paid plan first. If you own a company workspace, ask Support to close or transfer the company, and then delete your account. When you delete your account, FedM8 deletes your personal records from its live systems, except: the agreement and consent records above; the veteran confirmation fingerprint that section 1A describes; the short records of resume and evidence sharing, reports other members filed about you, checkout records and site feedback, which stay without your account or email; company records you added, which stay with the company without your name; and copies other people already downloaded or received by email. Payment records are held by Stripe under its own retention rules; we never store your card details.

7. Security and staff access

We use commercially reasonable technical and organizational measures to protect personal information, including encryption in transit, access controls, and row-level security on our database. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. FedM8 is not FedRAMP authorized and is not a CMMC C3PAO. A formal authorization program starts only if a paying buyer funds it.

Staff access. FedM8 staff with administrator access can open account records, support tickets, the activity and AI conversation history, and reports, including a private message that one of its two people reports. They use this access to help you, to keep the Service safe and to meet legal duties. People at JBNX LLC, which builds and runs the Service, can also reach the systems that store your data. Some staff actions in FedM8's admin tools, such as changing an account's role or turning a feature on or off, are recorded in a log.

8. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, and to object to or restrict certain processing. You can exercise these choices by:

• Downloading a copy of your personal data from Account in Workspace (signed-in). The download does not yet include everything, such as your chat posts and private messages; ask through the support form for a full copy
• Editing your profile and Directory visibility directly in the app
• Turning "Show my public name" on public previews on or off in My Profile, and seeing or undoing the people you hid there
• Stopping the weekly market digest in Account
• Deleting your account from Account (section 6)
• Making a privacy request (below)

Your copy includes your Team Up cards and your openings, responses, resume permissions, evidence and your company's quotes, drafts included. Where you acted for a company card you do not own, or another member shared with or quoted to a team you lead, it lists those records only by ids, type, status and dates. It lists your files but not their contents, which you download from My evidence and My Profile.

While an agreement is pending. If FedM8 asks you to agree to updated Terms, you can still read the legal documents, download your data, delete your account, stop the weekly digest, and cancel a paid plan before you agree. A company owner still needs Support to close or transfer the company before deleting the account.

Emails. FedM8 emails you sign-in links, the alerts and reply emails you set up, notes other members send you through Team Up, the Friday Team Up email for Basic and Pro members on Team Up, and notices about your account. You can change alerts, reply emails and the Friday Team Up email in the app, and reply emails and the weekly rooms email have a one-click unsubscribe link. The weekly market digest is optional marketing email. Answering yes is never required to open or use an account, FedM8 records each yes or no (section 1), and you can stop the digest at any time in Account. If your account had the digest turned on before FedM8 began keeping these records, FedM8 does not count that setting as your consent, and Account asks you to confirm it or stop it. To leave the launch list, use the support form or the link in a launch-list email that has one. FedM8 does not text you (section 1).

Privacy requests. Send a request through our support form and say it is a privacy request, email info@fedm8.com, or write to FedM8 LLC, 4075 Wilson Blvd, Suite 856, Arlington, VA 22203. You can also call 937-442-8167. We will verify the request against your account email and respond within the time required by applicable law. Someone you authorize can make a request for you; we will ask for proof that you authorized them and may ask you to confirm your identity. If we turn down a request, we tell you why, and you can ask us to look at it again by replying through the support form.

FedM8 does not sell personal information or use it for targeted advertising. FedM8 does not currently act on browser privacy signals such as Global Privacy Control. We honor verified requests regardless of your state or country of residence where reasonably practicable. We do not discriminate against you for exercising privacy rights.

9. Age

The Service is a business tool for adults. You must be 18 or older to open an account, and you confirm this when you agree to the Terms. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has given us personal information, tell us through the support form. If we confirm it, we close the account and delete its information, except the agreement records that section 6 describes.

10. International users

FedM8 is built for people and businesses working on U.S. government contracts and grants. The Service is operated from the United States. If you access it from elsewhere, you understand your information will be processed in the United States, where data protection laws may differ from those in your jurisdiction.

11. Security incidents

If personal information we hold is accessed or taken without authorization, we will notify affected account holders at the email on the account, and any regulator the law requires, without unreasonable delay. Laws set different triggers and deadlines, and some require notice within 72 hours. We follow the ones that apply to us. Use the support form if you believe your account was involved.

12. Changes to this Policy

When we change this Policy, we post the new version on this page, and we keep each earlier version unchanged, as we do version 1. The acceptance screen and your receipt show the date each version takes effect. If a change is material, we tell you in the app and ask you to acknowledge the new version, together with the Terms, when you next sign in. Where a change needs your consent, we ask for it separately. A change applies from the date the new version takes effect.

13. Contact

Questions or requests about this Policy: use our support form. A real person reads every submission. Email: info@fedm8.com. Phone: 937-442-8167. Postal mail and legal notices: FedM8 LLC, 4075 Wilson Blvd, Suite 856, Arlington, VA 22203. See also our Terms of Service and Refund & Cancellation Policy.