Legal

Privacy Policy

Effective Nov 12, 2026

We collect what we need to run RFP Detector and keep it secure. We don't sell personal information and we don't use advertising trackers.

At a glance

Document: Privacy Policy
Effective: Nov 12, 2026
Operator: Starling Global
Sections: 17
Questions: hello@starlingglobal.io

1. Who we are

Starling Global (starlingglobal.io), which owns and operates RFP Detector
8830 238th Street, Bellerose, NY 11426
Contact: hello@starlingglobal.io

2. What this covers

rfpdetector.com, app.rfpdetector.com, and the emails and texts we send.

3. Information you give us

Account details: name, email, mobile number and password (stored only as a one-way hash).
Organization details, and vendor listing content, which is public by design: description, branding and the contact details you choose to publish.
RFPs you post as a buyer (public once published) and their attachments.
Messages and connection requests, alerts and pipeline data, and support requests.

4. Information collected automatically

Sign-in and security data: IP address, approximate country, browser and device type, session and trusted-browser cookies, and sign-in times.
Usage events recorded on our own servers: pages and RFPs viewed, searches, saves, report downloads and outbound clicks. They are stored with a hashed visitor id that changes daily, not a raw IP address, and no analytics cookie is set.
Cloudflare Web Analytics, which is cookieless and injected by our content delivery network.
No advertising trackers or pixels.

5. Information from public sources

Publicly available procurement information: government and other public RFP notices (from which we extract facts and point to the official solicitation) and public contract award records. This may include government contact names and emails published in notices.

6. How we use information

To run the service: accounts, dashboards, the vendor directory, the buyer portal, messaging and alerts.
For security and fraud prevention: verification codes, rate limits and audit logs.
To compute scores and reports.
To show buyers and vendors analytics, as counts plus the organizations that chose “interested” or saved an RFP.
To send service emails, and to meet legal obligations.

7. What's public

Published vendor listings, published buyer RFPs, public RFP pages, scores and reports. Interested-party information is visible to the buyer who posted the RFP.

With service providers acting for us:

Hosting (Amazon Web Services) and CDN and security (Cloudflare).
Email delivery (Twilio SendGrid) and SMS verification (Twilio Verify).
AI processing of public web pages to extract RFP facts (Anthropic). No user account data is sent for this.

We also share information when required by law and in a business transfer. We don't sell personal information or share it for cross-context behavioral advertising.

9. Texts

Mobile numbers are used only for account security. Consent to receive texts isn't shared with third parties for marketing. See the SMS Terms.

10. Cookies

We use only the cookies needed to run and secure the service, plus your theme preference. There are no advertising or analytics cookies.

Cookies
Cookie	Purpose	Lifetime
`__Secure-rfpd_s`	Keeps you signed in (session)	Up to 30 days
`__Secure-rfpd_dt`	Remembers a trusted browser so we can ask for fewer SMS codes	Up to 400 days
`__Host-rfpd_flow`	Carries a sign-up, password reset or invitation step	Minutes
`__Host-rfpd_admin_s`	Admin console session, on the admin site only (staff only)	Up to 12 hours
`__Host-rfpd_imp`	Staff support view of your account ("Login as"), on the app site only (staff only)	Up to 1 hour
`theme`	Your light, dark or system theme choice	1 year

11. Retention

Unfinished sign-ups are deleted within a day; accounts whose phone was never verified within 7 days.
Expired sessions are removed 30 days after they end; trusted browsers 400 days after last use.
Usage events are kept for 13 months with hashed identifiers only; totals are kept longer.
Security audit logs are kept for 24 months.
SMS consent records are kept for the life of the account plus 4 years, as the law requires.
Email unsubscribes are kept so we keep honouring them.
Deleted accounts are scrubbed of personal details 30 days after deletion.

12. Security

Encryption in transit, hashed passwords, verification codes, access controls and audit logging. No system is perfectly secure, and we make no certification claims. Tell us about a security issue through hello@starlingglobal.io.

13. Your choices and rights

Access and correct your details in Settings.
Delete your account in Settings or by asking us (use the “Delete my account” topic on the contact form).
Ask for an export of your data.
Change email preferences or unsubscribe from alerts and notifications; reply STOP to texts.
Depending on where you live (for example, California), you may have additional rights to know, delete and correct; send requests through the same channels and we will respond within the time the law requires.

14. Children

The service is for businesses and is not directed to children under 16. We don't knowingly collect their data.

15. International users

Data is processed in the United States.

16. Changes

We post updates here with a new effective date, and email account holders about material changes.

17. Contact