Privacy Policy

This Privacy Policy covers app.intelligent.win (the commercial product) and the public intelligent.win marketing site. It does not cover any separate internal Kinetic staff tooling, which operates under separate internal data-handling practices.

Throughout this document, "we," "us," and "Intelligent Win" refer to the operator of this Service. The formal legal entity name will be published here once finalized.

1.1 About you, if you are our customer or user (account data). When you sign in, our identity provider (Microsoft Entra) supplies your name and email address, which we store in your encrypted session and, for commercial accounts, use as your account identifier. We also maintain an account record: your company name, subscription tier, feature access, and (if applicable) trial expiration and invitation status.

If you use the platform’s capture features, we store what you choose to save: watchlist entries (which companies you’ve starred, plus any free-text label you add), and private notes (free-text notes you write about companies, tagged with a relationship label you choose). These notes are private to your account — we do not use their content to train any model, and they are never included in any AI-generation prompt.

If you submit product feedback, we store your name, email, account tier, the page you were on, your browser’s user-agent string, and the free-text feedback you typed, and we forward that same information internally by email for triage.

Billing and payment information: no payment processor is integrated as of this drafting date. Once billing is live, payment information will be collected and processed through a payment processor and will not be stored directly on our servers in raw form — this section will be updated to name that processor and what limited billing metadata we retain once that integration ships.

1.2 About you, automatically (usage and technical data). We automatically log standard web request data (timestamps, pages/API routes accessed, error conditions) for operating and securing the Service. Separately, we keep a daily count of reports you’ve generated, used only to enforce your plan’s usage limits; this count lives in server memory only and resets automatically.

1.3 What we do NOT collect. We do not run any client-side analytics, advertising, or tracking script (see our Cookie Policy). We do not collect precise geolocation. We do not collect biometric data. We do not knowingly collect data through any means other than what’s described above.

We use the data in Section 1 to: (a) authenticate you and maintain your session; (b) provision and enforce your subscription tier and usage limits; (c) operate the capture features (watchlist, notes) for your own private use; (d) respond to support and feedback submissions; (e) secure the platform and diagnose technical problems; and (f) send you operational and account-related email (welcome/invite messages, and — once billing ships — billing notices). We do not use your account or capture data for advertising, and we do not build advertising profiles.

We do not sell your personal data. We do not share your personal data with third parties for cross-context behavioral advertising or for any other party’s independent marketing purposes. We do not disclose personal data "for monetary or other valuable consideration" of any kind. This is an affirmative, unconditional commitment.

The only parties who receive personal data from us are the service providers ("sub-processors") listed in Section 4 below, each acting on our behalf and under contract to use the data only to provide their service to us — never for their own independent purposes — and, where legally compelled, law enforcement or regulators.

This section is unusual for a SaaS privacy policy and exists because our product is unusual: we display professional information about named individuals — company executives, and in narrower cases government contracting officers — drawn from public records and, in one case, a licensed commercial data provider.

5.1 Whose data, and from where. Company leadership and executive information (name, title, and in some cases professional contact details) comes from three distinct sources, each disclosed separately rather than blended: (1) public federal contracting records (for example, officer names and compensation figures that federal law requires certain contractors to disclose); (2) a company’s own public website, extracted by our AI-assisted process; and (3) a licensed commercial data-enrichment provider, which supplies professional profile data matched against a company. That provider’s complete, unedited responses are retained by us in full as our system of record, independent of what we choose to display on a profile — meaning we may hold more third-party personal data than what is currently rendered on the product surface. Government contracting-officer identity (name, and typically a .gov/.mil email address) is drawn from public federal procurement data, tied to specific contract records.

5.2 Why we hold this data. This data is processed for a business-intelligence and competitive-research purpose consistent with why it was made public or licensed in the first place — evaluating companies’ government-contracting posture and relationships.

5.3 Correction and opt-out path for third-party subjects. As of this drafting date, there is no automated, self-service correction or removal path for an individual who finds their information on the platform and disputes it or wants it removed. If you are such a person, you may write to support@intelligent.win and we will review your request manually. There is currently no committed response-time for this process.

5.4 Retained-but-superseded data. The platform previously used a different commercial leadership-data provider under an agreement that has since ended; a subset of the data collected under that prior agreement is retained in a separate, non-public internal table pending a decision about whether it may continue to be displayed or should be purged. Until decided, the honest disclosure is: held, not displayed on any customer-facing surface, retention period undetermined.

Our operational monitoring system automatically captures server console output for debugging and reliability purposes. As currently configured, that includes some lines that contain your account email address (for example, authorization-check and usage-tracking log lines). We are disclosing this plainly rather than asserting a "we never log personal data" promise that would not be true. This data is used only for internal operations, security, and debugging — it is not used for any other purpose, and it is covered by the same no-sale/no-share commitment in Section 3.

8.1 What you can do today. Access — you can see your own watchlist and notes directly in the product at any time. Correct — you can edit or remove your own watchlist entries and notes directly in the product. Un-star / remove — watchlist removal is immediate and permanent. Contact us — for anything not self-service, write to support@intelligent.win.

8.2 What is NOT yet available, stated plainly. Full account deletion: there is currently no single "delete all my data" action; removing your entitlement (for example, when a subscription ends) does not automatically erase your watchlist, notes, or feedback history. True note deletion: as noted in Section 6, a deleted note’s text is not immediately, permanently erased. Data export / portability: there is no self-service export of your account data today.

8.3 California residents (CCPA/CPRA). Categories of personal information we collect, mapped to the CCPA’s own categories: identifiers (name, email); commercial/account information (subscription tier, company name); internet/electronic activity (usage counts, log data); professional/account-related information you provide (notes, watchlist labels). We do not collect or infer sensitive personal information about California consumers as a matter of course. You have the right to know, access, correct, and delete your information (subject to the honest limitations in Section 8.2); to opt out of sale or sharing (moot in substance today, since we don’t sell or share — see Section 3); to limit use of sensitive personal information (not applicable — we don’t collect it); and to not be discriminated against for exercising any of these rights. To exercise these rights, contact support@intelligent.win.

8.4 Other U.S. state privacy laws. Residents of Virginia, Colorado, Connecticut, Utah, Texas, and other states with comprehensive privacy laws have similar rights to know, access, correct, delete, and opt out of the sale, sharing, or use of personal data for targeted advertising or profiling with legal effect — all of which, per Section 3, we already don’t do. To exercise any applicable right, use the same contact in Section 8.3.

8.5 European Economic Area / UK residents. Our customer base is oriented toward U.S. federal government contracting and is not known to routinely include EEA/UK-based data subjects as account holders, but individual users of a customer organization could theoretically be located there. If and when that applies: our lawful basis for processing account data is performance of a contract (providing the service you signed up for) and legitimate interest (securing and operating the platform); data is processed and stored primarily in the United States.

Intelligent Win is a business-to-business product intended for use by working professionals in the government-contracting industry. It is not directed to, and we do not knowingly collect personal information from, anyone under 18. If we learn that we have inadvertently collected such information, we will delete it.

Every item below is a specific, confirmed control, not a generic statement:

• Sign-in sessions are protected by encrypted, httpOnly cookies not readable by page JavaScript.
• Two independent layers of access control check your account class and entitlements on every request — one at the network edge, one at each individual feature.
• Your private capture data (watchlist, notes) is scoped at the database-query level to your account identity, computed only from your authenticated session — never accepted as an input from the request itself — so cross-account access is structurally, not just procedurally, prevented.
• Database queries use parameterized inputs, not string-built queries, as a matter of standing engineering practice.
• Internal systems connect to cloud resources using managed identities rather than embedded credentials wherever supported.
• The service fails closed on misconfiguration — required credentials and settings are validated at startup, and the service will not silently run in a partially-configured state.

No security control is perfect, and we do not claim data transmission or storage is guaranteed secure — but the specifics above are true today, not aspirational.

We commit to notifying affected users without unreasonable delay, and in any case within the time period required by applicable law, in the event of a data breach affecting your personal data.

The Service is hosted and operated in the United States. If you access it from outside the United States, you understand your information will be transferred to and processed in the United States. See Section 8.5 for EEA/UK-specific considerations.

We will post any material changes to this policy here and update the "last reviewed" date. For a change that narrows your rights (for example, a change to the no-sale commitment in Section 3), we will provide direct notice, not just a page update.

For any question about this policy or to exercise any right described above: support@intelligent.win.