Privacy Policy

Last updated 20 October 2026

​

This Privacy Policy explains how Copper Forge Software Solutions LLC, which provides AwardEn Response ("we", "us" or "our"), collects, uses and shares information in connection with the AwardEn Response service and our website (together, the "Service"). AwardEn Response is a business tool sold to organizations; it is not directed to consumers or to children.

Two roles. For information about the people who administer and use an account (names, emails, sign-in data), we act as a controller. For the documents and materials a business customer uploads into the Service ("Customer Content"), we act as a processor that handles that content on the customer's behalf and under our Terms of Service. If you are an individual whose information appears inside a customer's Customer Content, please contact that customer, who controls that information.
 

1. Information we collect

Information you provide: Account and identity data: name, business email address, organization name, role, and password when you register or are invited as an Authorized User. Billing data: subscription plan and billing contact details. Payments are processed by our payment processor, Stripe; we receive limited transaction and subscription information but do not collect or store full payment card numbers. Customer Content: the documents and materials you upload or create in the Service, including RFPs, RFIs, security questionnaires, DDQs, vendor assessments, Knowledge Records, competitor materials you provide, writing and brand-voice settings, and organization profile information. Communications: information you provide when you contact us for support or otherwise correspond with us.
 

Information we collect automatically: Usage and log data: actions taken in the Service, feature usage, AI usage records (for quota and cost tracking), timestamps and similar activity data. Device and technical data: IP address, browser type, device information and similar data collected through logs, error reports and browser storage.
 

1. How we use information To provide, operate, secure and maintain the Service, including authenticating users and enforcing plan quotas and seat limits. To process Customer Content through our AI features to extract requirements, match them to your approved knowledge and generate cited draft responses (see Section 4). To process payments and manage subscriptions. To provide support and respond to your requests. To monitor, troubleshoot and improve the Service and develop new features, using usage data and aggregated or de-identified information. To detect, prevent and address security incidents, fraud and abuse. To comply with legal obligations and enforce our Terms.
    

We do not sell your personal information, we do not use Customer Content for advertising, and we do not use Customer Content to train AI models for other customers.
 

1. Legal bases (for individuals in the EEA and UK) Where the GDPR or UK GDPR applies, we rely on the following legal bases: performance of a contract (to provide the Service to a customer); our legitimate interests (to secure, operate and improve the Service), balanced against your rights; compliance with legal obligations; and consent where required (for example, for certain cookies on our website). Where we act as a processor of Customer Content, the customer is responsible for the legal basis for that data.

2. AI processing To generate Output, the Service sends relevant Customer Content to third-party AI providers. We use Anthropic to extract requirements and draft cited responses, and OpenAI to create text embeddings that power knowledge matching. These providers process the content to return results to us and are engaged under terms that do not permit them to use your content to train their models. If you use competitive-intelligence features, the Service retrieves publicly available information from competitor sources you identify (respecting website access controls such as robots.txt) and processes competitor materials you upload, in order to generate cited competitive notes separately.

3. How we share information We share information only as described here: with the service providers (subprocessors) listed below, who process data on our behalf to run the Service; with our payment processor to handle billing; when required by law or valid legal process; to protect our rights, users or the public; and in connection with a merger, acquisition, financing or sale of assets (with notice as required by law). We do not sell personal information or share it for cross-context behavioral advertising.
    

Subprocessors: Supabase: database, file storage, and sign-in. United States. Vercel: application hosting. United States. Inngest: background job scheduling (job details, not document text). United States. Anthropic: AI drafting and requirement extraction. United States. OpenAI: text embeddings for knowledge matching. United States. Stripe: payment processing and billing. United States. Resend: delivery of account and notification emails. United States. Sentry: error monitoring (technical details, not document content). United States. Google Workspace: our support email inbox. United States. Wix: hosting of our marketing website. United States. We will update this list when it changes.
 

1. Cookies and browser storage. The AwardEn Response app uses browser storage that is needed to keep you signed in, remember your preferences, and secure the Service. The app does not use advertising cookies. Our marketing website is hosted by Wix, which sets cookies needed to run the site and may collect basic visitor statistics; you can control cookies through your browser settings.

2. Data retention. We keep account and usage information for as long as your account is active and as needed to provide the Service, and afterward as needed to comply with legal obligations, resolve disputes, and enforce our agreements. We keep Customer Content while your subscription is active. After termination, we make it available for export for 30 days, as our Terms of Service describe, and then delete it in the ordinary course, subject to legal requirements and routine backups that expire on their normal schedule.

3. Security We use technical and organizational measures designed to protect information, including tenant isolation with row-level security so each organization's data is kept separate, role-based access controls, optional multi-factor authentication, encryption in transit, encryption at rest provided by our infrastructure providers, and reputable infrastructure providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

4. International data transfers We are based in the United States and process information there. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. Where required for transfers of personal data from the EEA, UK or Switzerland, we rely on appropriate safeguards such as the Standard Contractual Clauses. A data processing addendum is available on request.

5. Your privacy rights. Depending on where you live, you may have rights to access, correct, delete or receive a copy of your personal information, to opt out of certain processing, and to withdraw consent. Because much of the information in the Service is Customer Content controlled by a business customer, if your data appears in a customer's account, please direct your request to that customer; we will assist them as their processor. United States. If you are a California resident, you have rights under the CCPA, as amended by the CPRA, to know, delete and correct personal information and to opt out of its "sale" or "sharing". We do not sell or share personal information for cross-context behavioral advertising, and we do not use sensitive personal information for purposes that require an opt-out. Residents of other states with privacy laws (for example, Colorado, Virginia, and Connecticut) may have similar rights. We will not discriminate against you for exercising these rights. EEA and UK. If the GDPR or UK GDPR applies, you have rights to access, rectify, erase, restrict and object to processing, and to data portability, as well as the right to lodge a complaint with a supervisory authority. To exercise any right, contact us using the details in Section 13. We will verify and respond as required by applicable law.

6. Children's privacy. The Service is intended for businesses and their authorized personnel and is not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with information, contact us, and we will take appropriate action.

7. Changes to this Policy. We may update this Privacy Policy from time to time. We will post the updated version with a new "Last updated" date and, for material changes, give additional notice as required by law. Your continued use of the Service after changes take effect means you accept the updated Policy.

8. Contact us If you have questions or requests about this Policy or your information, contact: AwardEn Response, a service of Copper Forge Software Solutions LLC PO Box 138, Billings, MT 59103 support@awardenresponse.com