Privacy Policy

This draft describes how GovConToolkit handles information in the AssureSpan website, Credentials, Passport and vendor portal. It covers portal participants and people who contact us. Your organization may control the records it submits and the recipients it authorizes; its policies and agreements may also apply.

This policy should be read with the Terms of Service. This draft must be validated against actual operational practices and provider agreements before adoption.

• Account and contact information: name, email address, account identifiers, organization and supplier associations, roles, contact details and authentication activity.
• Business and compliance records: company details, SPRS and CMMC entries, assessment answers, evidence, sharing permissions and submitted files.
• Release and approval information: classifications, revisions, file metadata and fingerprints, typed signatures, decisions, comments, acknowledgements and custody or audit events.
• Technical and security information: access times, request and error information, and network or device information generated through operating and protecting the Service.
• Communications and AI inputs: messages you send us and information you provide to optional AI review features.

Information is used to create and authenticate accounts; enforce permissions; manage compliance records, submissions and release workflows; deliver authorized files; record decisions and custody events; provide requested AI assistance; respond to support requests; diagnose errors; and protect the Service against misuse.

Where applicable privacy law requires a legal basis, processing may depend on contract performance, legitimate interests in secure service operation, legal obligations or consent where required. The applicable basis depends on the relationship and processing activity.

Records are shared with the organizations, suppliers, primes and individuals permitted by your organization’s access settings and release instructions. Account administrators may manage your access. Vendor access is restricted to information authorized for that vendor; internal signing details are not presented in the vendor dashboard.

Infrastructure and service providers process information needed for hosting, authentication, file storage, diagnostics and optional AI services. We may also disclose information when required by law, to address a security incident, or in connection with a business transfer subject to applicable safeguards.

This draft does not establish whether every provider’s practices constitute a “sale” or “sharing” under a particular privacy law. GovConToolkit must verify applicable provider agreements and tracking practices before making such representations.

The AssureSpan Guide help chat sends your questions, the current page category and the conversation from your current visit to AI processing. It does not automatically read your page contents or business records. Help conversations are held in page memory, not saved as chat history; refreshing the page clears them. AI service providers may still process request data under their applicable terms.

When you request an AI review, selected release context and your review notes may be sent through the AI Gateway to an AI provider. Context can include passport and supplier details, compliance gates, approval steps and file names. Treat these fields as potentially sensitive even when full files are not included.

Do not include classified information or information your organization has not authorized for external AI processing. No claim is made here that provider data is excluded from training, has zero retention, or remains in a specific jurisdiction; those conditions must be established through the relevant provider terms and your organization’s agreement.

The Service uses authentication-related browser storage and may use cookies to maintain sessions. It also stores interface preferences such as menu state. Providers may process additional technical information needed to operate their services.

You can clear or restrict cookies and browser storage through your browser, but doing so may sign you out or affect functionality. This draft does not assert that all analytics or tracking are absent; any non-essential tracking and associated consent requirements must be verified before adoption.

Retention depends on the purpose of the record, your organization’s agreement and applicable legal, security and contractual requirements. Approval, custody and audit records may need to remain after an account is closed, and deleting an account does not necessarily erase business records or backups.

No fixed deletion period or backup purge schedule is promised by this draft. Contact GovConToolkit for the retention arrangements applicable to your organization and to request export, correction or deletion where available.

The Service uses authentication, role-based access controls, private file storage and two-factor verification for approval signing. No system is completely secure; promptly report suspected unauthorized access.

Do not infer government authorization, certification, US-only hosting or export-control suitability from these controls. Processing and storage locations, encryption commitments and any required international-transfer safeguards must be confirmed under the applicable deployment and service agreements.

Depending on applicable law, you may request access, correction, deletion or a copy of personal information; object to or restrict processing; withdraw consent where processing relies on it; or exercise applicable opt-out rights. You may also have a right to complain to a privacy regulator. These rights may be limited by lawful recordkeeping obligations or the rights of others.

Send requests to the contact below. We may need to verify your identity and coordinate with the organization that controls your records. Do not send passwords, authenticator codes or confidential package contents in your request. Where law provides an appeal right, contact us to request review of a decision.

AssureSpan is a business portal intended for adult, authorized organizational users, not children. Contact us if you believe a child has provided personal information.

Policy changes will be identified by a revised date, with additional notice or consent where legally required. The date above is a draft update date, not an assertion that these provisions have been legally adopted.