1. Scope and roles
This notice applies to PinPointe's website, accounts, customer support, alerts, contractor profiles, and related services. The operator identified below is responsible for this processing unless an enterprise agreement says otherwise. It does not govern agency sites, procurement portals, or Stripe-hosted pages that publish their own privacy notices.
2. Information collected
| Category | Examples | Where it comes from |
|---|---|---|
| Account identity | Name, business email, company name, email-verification status, plan, and account identifiers. | You, your company administrator, and the account system. |
| Security and device data | Password hash (never the readable password), session identifiers, IP address, browser/device description, CSRF data, login and security events. | Your browser, device, and service security systems. |
| Company and qualification profile | Trades, locations, project preferences, capacity, licenses, certifications, special eligibility, signatory status, experience, and exclusions. | You or another authorized company user. |
| Product activity | Searches, filters, match views, tracked matches, deciding-to-bid actions, notes, alerts, and preference changes. | Your use of PinPointe. |
| Billing records | Stripe customer and subscription identifiers, plan status, billing period, cancellation status, and invoice-related metadata. PinPointe does not receive complete card numbers. | Stripe and your subscription activity. |
| Support and corrections | Messages, project correction evidence, troubleshooting details, and communications with support. | You and the support team. |
| Public opportunity information | Issuer, project, location, deadline, source link, and published solicitation details. | Attributed government, institutional, and other public sources. |
Do not place sensitive personal information, payment-card details, trade secrets, or credentials into open text fields unless PinPointe specifically requests that information for the feature you are using.
3. How information is used
- Provide accounts, match browsing, matching, readiness checks, tracking, alerts, and reports.
- Personalize results using the company profile and stated preferences.
- Authenticate users, prevent abuse, investigate security issues, and maintain reliable records.
- Process and reconcile subscriptions, provide receipts and invoices, and respond to billing requests.
- Answer support requests and correct public project information.
- Maintain, debug, measure, and improve the service using operational data.
- Comply with law, enforce policies, and establish or defend legal claims.
PinPointe does not sell personal information. It does not use personal information for third-party behavioral advertising.
4. Cookies and analytics
If optional analytics or advertising technology is introduced later, this notice and the applicable consent controls will be updated before it is enabled.
5. Service providers and disclosure
Personal information is disclosed only as needed for the service or for a lawful purpose. Current provider categories include hosting and infrastructure, transactional email when configured, and security or operational tooling. When billing is used, Stripe acts as the hosted checkout, payment, invoice, and customer-portal provider and receives information needed to administer the subscription.
When the interactive project map loads, your browser requests tiles directly from the configured map-tile provider. Production deployments may use Stadia Maps, which receives your IP address and ordinary request metadata under its terms and privacy policies. Local and unconfigured deployments use OpenStreetMap's standard tile service, covered by the OpenStreetMap Foundation's privacy policy. The text-based opportunity list remains available without loading the map.
PinPointe also uses a restricted internal Slack channel for newly collected project-review notices. That workflow is designed for public project facts, not customer account or contractor-profile data.
Information may also be disclosed to professional advisers, authorities, or counterparties when reasonably necessary to comply with law, protect rights and safety, investigate misuse, or complete a merger, financing, acquisition, or transfer of the service. A successor must continue to handle the information under this notice or provide notice of material changes.
6. Retention
Account and company-profile data is generally kept while the account is active. Saved project and tracking data is kept until account closure or applicable retention cleanup. Sessions, verification links, and reset links expire or are revoked under their security settings.
After an account-closure request, information is deleted or de-identified within a reasonable operational period unless it must be kept for billing, tax, fraud, security, dispute, backup, or legal obligations. Backup copies age out on the ordinary backup cycle and are not returned to active use except for restoration. Public project records may remain because they are not customer account data; corrections can be requested through Support & Corrections.
7. Your choices and rights
Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a portable copy of personal information. You may also withdraw consent where consent is the basis for processing and appeal a denied privacy request where local law provides that right.
- Update company and account information in the relevant PinPointe page.
- Manage email-alert preferences or unsubscribe using the link in an alert.
- Manage or cancel a paid subscription through Account; cancellation does not itself delete the account.
- Use Account controls to export or close the account when those controls are available, or contact the privacy address below.
PinPointe may verify your identity and authority over the account before fulfilling a request. Authorized agents may be asked for signed permission. You will not be discriminated against for making a privacy request.
8. Security
PinPointe uses measures designed for a small B2B launch, including one-way password hashing, email verification, session expiration and revocation, CSRF and origin controls, rate limiting, restricted server-side credentials, and Stripe-hosted card entry. No system can guarantee absolute security. Report a suspected vulnerability to the security contact below and do not include exploit details in a public channel.
9. Children
PinPointe is a business service for adults and is not directed to children under 18. The operator does not knowingly collect a child's personal information through account registration. Contact the privacy address if you believe that occurred.
10. Location and transfers
Information may be processed in the United States and other locations where approved service providers operate. Where required, appropriate contractual or legal safeguards will be used for cross-border transfers.
11. Notice updates
The effective date and version above identify this notice. Material changes will be communicated through PinPointe or another reasonable channel before taking effect. Prior versions may be requested from the privacy contact below.