Privacy Policy
Last updated: July 4, 2026
RFPfit.com ("RFPfit," "we," "us," "our") helps Canadian consultants, agencies, and nonprofits discover and evaluate Canadian public-sector procurement opportunities. This policy explains what information we collect through the RFPfit.com product, how we use it, and the choices available to you. It does not describe the procurement notices themselves, which are official public records published by government sources — see Sources for how that data is collected and attributed.
Information we collect
Account information
When you create an account, we collect the email address you sign in with. Sign-in uses passwordless magic-link email or, optionally, Google sign-in — RFPfit never asks for or stores a password. If you sign in with Google, we receive the email address and basic profile information Google shares as part of that sign-in.
Creating an account also creates an organization workspace. We store the organization's name, your display name, and your role (owner, admin, or member) within that organization.
Saved opportunities
If you save a procurement opportunity, we store which notice you saved, who on your team saved it, and any note you add. This is visible to other members of your organization workspace.
Subscription and billing information
If you subscribe to a paid plan, we store a reference to your Stripe customer and subscription — IDs, plan, status, and renewal dates — so we can manage your subscription and give you access to what you've paid for. We never see or store your card number or other payment details; those are collected and processed directly by Stripe. See "Billing and payments" below.
Information we do not collect
Browsing the public catalog of opportunities requires no account and collects nothing about you. RFPfit does not run analytics, advertising, or tracking scripts on any page, public or signed in, and we do not track which opportunities you view unless you explicitly save one.
How we use your information
We use the information above to:
- Operate your account and organization workspace — sign-in, team membership, saved opportunities
- Provide the features you're subscribed to, and manage billing for paid plans
- Communicate with you about your account — for example, a magic-link sign-in email
- Maintain the security and integrity of the service
We do not sell your personal information, and we do not use it for advertising.
Fit Intelligence (deterministic, not AI-generated)
RFPfit's paid Fit Intelligence feature scores how well a procurement opportunity matches your organization's profile. This scoring is deterministic and rule-based — it runs entirely on our own infrastructure, using a fixed classifier and a static table that translates the result into plain language. No account or usage data is sent to any third-party AI model or external service to produce a Fit Intelligence score, and no such data leaves our infrastructure for this purpose.
Billing and payments
Paid subscriptions are processed by Stripe, a PCI-compliant payment processor. When you subscribe, Stripe collects and stores your payment details directly — RFPfit never receives or stores your full card number. We store only the billing references described above (customer/subscription IDs, plan, and status) needed to manage your subscription.
Cookies and analytics
RFPfit sets one cookie: a first-party session cookie used only to keep you signed in. It is not used for tracking or advertising, and is not shared with any third party. We do not run Google Analytics, a Meta/Facebook pixel, or any other analytics, advertising, or tracking technology on RFPfit.com, so we do not currently need a cookie-consent banner — every cookie we set is strictly necessary for the product to function. If that changes, this policy and the site will be updated accordingly.
How we share information
We do not sell or rent your personal information. We share it only with the service providers that help us run RFPfit.com, each of whom may use it only to provide their service to us:
- Supabase — our database and authentication system, self-hosted on our own infrastructure rather than a third-party cloud database.
- Stripe — payment processing and subscription billing for paid plans.
- Google — if you choose to sign in with Google, Google acts as your identity provider for that sign-in.
- Resend — delivers the transactional emails that make sign-in work, for example your magic-link email.
- Cloudflare — sits in front of RFPfit.com to route traffic securely and protect the site; it can see request metadata (like your IP address) as your connection passes through it, as is standard for any site behind a CDN.
We may also disclose information if required by law, or to protect the rights, property, or safety of RFPfit, our users, or others.
Public procurement data is not personal information about our users
The procurement notices in the RFPfit catalog are official public records published by government sources under open licences (see Sources). Some of those records include names of buyer-side contacts. We follow a documented internal policy to keep individual contact details — names, emails, phone numbers — out of anything RFPfit displays or stores in normal use: we surface the official notice and buyer organization, not a named individual. This section is about data in the public catalog, not about you as an RFPfit user.
Data retention
We keep your account and organization data for as long as your account is active. If you close your account, we delete your personal account information within a reasonable period afterward, except where we need to keep limited records — for example, billing records — to meet legal, tax, or accounting obligations.
Security
Access to your data is restricted using database-level row-level security, so your organization's data is reachable only by its own members and by RFPfit's own backend systems. All traffic to RFPfit.com is encrypted in transit (HTTPS). We never store your password, because RFPfit doesn't use passwords — sign-in is handled by our authentication provider using magic links or Google sign-in.
No system is perfectly secure, and we can't guarantee absolute security — but we design RFPfit around storing and exposing the least amount of information necessary.
Your choices, access, and deletion
You can:
- Update your display name and organization name at any time from your account page.
- Review the opportunities you've saved from your saved list.
- Ask us to access, correct, or delete the personal information we hold about you, or to close your account entirely — self-serve deletion isn't built yet, so these requests go through us directly.
Contact us using the details below to make a request. We'll respond within a reasonable time, and may need to verify your identity first.
Canadian users and cross-border service providers
RFPfit.com is built and operated in Canada, and our core application and database run on infrastructure we operate ourselves. Some of the service providers listed above — including Stripe, Google, Resend, and Cloudflare — are headquartered in, or operate infrastructure located in, the United States or other countries. Using RFPfit.com means some personal information may be processed or transmitted outside Canada as part of how those providers deliver their service to us — a normal consequence of using any modern web service, and something we take into account when choosing providers.
Changes to this policy
We may update this policy as RFPfit.com changes. If we make a material change, we'll update the "Last updated" date above and, where appropriate, let existing account holders know.
Contact us
Questions about this policy, or a request about your personal information? Email [email protected].