Privacy Policy

Information we collect

• Accounts and teams. Clerk manages authentication, including email/password, email verification and Google sign-in. We receive account identifiers, name, email address, organization details and memberships. Google sign-in shares the identity information you authorize; it does not give Crierbase access to your Gmail inbox.
• Your business and preferences. We store your business name, website, description, trades, service area, job-size preferences, certifications, alert settings, recipients, and feedback about matches. If you submit a lead or alert request, we store the details you provide.
• Billing. Stripe processes payments. We store customer and subscription identifiers, plan, trial and payment status, and relevant payment-event records. Card details go to Stripe, not to a Crierbase card database.
• Support. The support form stores your topic, subject, message, optional page URL, and associated account and organization. We also retain correspondence you send by email. Please do not send passwords, API keys, payment-card details or confidential bid material.
• Usage and technical records. We process request data such as IP addresses for security and rate limiting, and keep operational logs, monthly API usage, API-key names, prefixes, hashes, and last-used times. We also store alert history, delivery events, clicks, match results and feedback.

Website reading and AI matching

During onboarding, we may suggest your business website from your work email domain. When you ask us to draft a profile, we fetch the website you provide and relevant linked pages, extract readable text, and cache the results and source URLs. We first use a plain web fetch. If that cannot read the site, we may use Notte, a third-party cloud browser, to load the pages and return their content.

We send selected website text, your business name, your description and relevant preferences to TypeSafe (Jev), our AI/LLM provider, to suggest a business profile. We also send business-profile information, relevant feedback notes and bid information to that provider to assess matches. Separately, we use AI providers for extracting and summarizing public bid notices and documents, including through OpenRouter. These services process the information sent to them under their own terms and policies; we do not promise that their retention or model-training practices are identical to ours.

Only submit a website you own or are authorized to have us read, and do not include confidential or sensitive personal information in your description or feedback. You can enter or edit your profile yourself. AI suggestions and matches can be wrong; review them before relying on them.

Email alerts, digests and trial reminders

We use Cloudflare to send bid alerts, daily digests and related service emails from alerts.crierbase.com. Cloudflare receives recipient addresses and message contents. We store sending records and may receive delivery, bounce and complaint events to troubleshoot delivery and suppress undeliverable or unwanted mail.

Bid and teaser links use signed redirects that record the first click associated with the recipient and alert before opening the destination. Emails also contain signed unsubscribe links. Opening the unsubscribe page asks for confirmation; supported mail clients can unsubscribe with a one-click request. Unsubscribing stops that recipient’s emails for the alerts covered by the link, not their teammates’ emails. You can also manage alerts in the app or contact support. Unsubscribing does not cancel billing or stop necessary account, security or billing messages.

If a free trial ends without a paid subscription, we may continue matching bids for up to 60 days and send limited previews encouraging you to subscribe: no more than eight teaser rounds, spaced at least three days apart. You can unsubscribe from these emails too. The end of a trial is not an account-deletion or data-erasure event.

Cookies and Google Ads

Clerk uses cookies and related technologies to keep you signed in and secure your account. Separately, when a URL includes a Google Ads click identifier, we set first-party attribution cookies: cb_gclid, cb_gbraid or cb_wbraid, plus cb_landing_page and cb_captured_at. These record the first ad click, landing path and capture time for up to 90 days. They are HttpOnly, so browser JavaScript cannot read them, but our server can.

At sign-up, attribution can be passed through Clerk and stored with your account and organization. When conversion reporting is enabled, we send Google Ads sign-up and first-paid-purchase events, which may include ad click IDs, event times, transaction identifiers and purchase value and currency. Sign-up reporting can include a normalized, SHA-256-hashed email address even without a click ID. Hashing is not anonymization: Google can match the hash to information it already has.

There is currently no cookie-consent banner or in-app advertising opt-out. Attribution cookies are captured when the identifiers are present, not after a consent choice. You can block or clear cookies in your browser; blocking sign-in cookies may prevent the app from working. Clearing cookies does not erase attribution already saved with an account or a conversion already sent. Contact support about that data. Agreement to our Terms is not a separate advertising-consent choice.

Who receives information

We use service providers for hosting, databases, file storage, security and operations, as well as Clerk, Stripe, Cloudflare, Notte, TypeSafe and our public-document AI providers described above. Google receives advertising-conversion data when enabled. Support messages are emailed to our support inbox, currently handled in Gmail; configured internal Discord or Telegram notifications may include sign-up or support-request details so our team can respond.

Organization members can access shared business profiles, alerts and other team information according to their access. If you connect an MCP client or give an integration an API key, it can receive data and take actions within the access you grant. That client’s own data practices apply to information it receives. We store API-key hashes rather than recoverable keys; keep the original key private and revoke it when no longer needed.

We may disclose information to meet legal obligations, protect users or the service, resolve disputes, or as part of a business transfer with appropriate protections. We do not sell customer contact lists. The Google Ads sharing described above is separate from the providers needed to operate your account.

Public bid records and documents

We collect notices and attachments published by public agencies and procurement portals, including contact names and business contact details in those records. We store copies, extracted text and summaries, and serve available documents from our storage using time-limited signed links. These are not private customer uploads. Public availability does not mean a document is error-free or free of third-party rights. Contact support about a privacy or rights concern; we may also direct you to the agency that controls the original record.

Retention, security and your choices

We retain account and business-profile data, cached website text, match and email history, support requests, attribution and billing records to run the service, maintain business records, prevent abuse and meet legal obligations. We have not set a single automatic deletion schedule for these records. The 90-day cookie expiry and 60-day teaser window do not limit how long the related database records remain.

Deleting a Clerk user or organization disables the corresponding account access; our database currently uses soft deletion rather than immediately erasing all related records. Copies may also remain in backups, logs, email inboxes and providers’ records. Public bid archives are retained separately from customer accounts. We use access controls and signed links, but no system can guarantee complete security.

You can edit your profile, manage alert recipients and revoke API keys in the app. For access, correction, a copy of your data, deletion or an objection to a use of your information, email support@crierbase.com. We may verify your identity and your authority over organization data. We will address requests under applicable law and explain any records we must retain. Closing your personal account is not a substitute for canceling your organization’s paid subscription.

Location, children and policy changes

Crierbase is intended for business users in the United States, not for children under 18. Information may be processed in the United States and other countries where our providers operate; their laws may differ from those where you live. Contact us if you believe a child has provided personal information.

We may update this policy as the service changes. We will post the new version here with a new last-updated date and give additional notice of material changes when required by law.