Privacy Policy

1. Data We Collect

We collect the following categories of information when you use MAS Pilot:

• Account information -- name, email address, organization name, and role.
• Contract data -- TDR records, contract numbers, pricing data, modification history, and compliance artifacts you upload or generate through the platform.
• Usage data -- pages visited, features used, validation runs, and error logs collected for service improvement and debugging.

2. How We Use Your Data

Your data is used exclusively to deliver and improve the MAS Pilot compliance platform. Specifically:

• Validating TDR submissions and contract modifications against FAR rules.
• Generating compliance documents and audit-ready bundles.
• Sending transactional notifications (submission confirmations, deadline reminders).
• Diagnosing errors and improving platform reliability.

We do not sell your data. We do not use your contract data for advertising, profiling, or any purpose unrelated to the services you have engaged.

3. Data Storage

All data is stored in Supabase-managed PostgreSQL databases hosted on Amazon Web Services (AWS) in the us-east-2 region. Data is encrypted at rest using AES-256 and in transit using TLS 1.2 or higher. Row-level security policies enforce organization-level isolation at the database layer, ensuring that users can only access data belonging to their own organization.

4. Data Retention

Contract-related records are retained for a minimum of seven (7) years from the date of final contract payment, in accordance with Federal Acquisition Regulation 4.703. This includes TDR submissions, validation results, audit trails, and compliance artifacts. Non-contract data (such as usage analytics) is retained for up to two (2) years. You may request deletion of non-contract data at any time through your account settings.

5. Third-Party Services

MAS Pilot integrates with the following third-party services to operate the platform:

• Resend -- transactional email delivery (submission confirmations, password resets, deadline reminders).
• Stripe -- subscription billing and payment processing. MAS Pilot does not store credit card numbers; all payment data is handled by Stripe.
• Sentry -- error tracking and performance monitoring. Error reports may include request metadata but never contain contract pricing or sensitive business data.

6. Your Rights

You have the right to:

• Access -- request a copy of all data associated with your account.
• Export -- download your data in a machine-readable format through the Settings page.
• Deletion -- request deletion of your account and associated data, subject to the FAR 4.703 retention requirements described in Section 4.

We respond to all data requests within 30 days. To exercise any of these rights, contact us at the address below or use the data management tools in your account Settings.

7. Contact

For questions about this privacy policy or to exercise your data rights, contact: