Privacy Policy
Draft scaffold · no effective date · replace before beta onboarding
This page is a structural placeholder, not WinLayer's binding privacy policy. It has not been reviewed by counsel and must be replaced before onboarding any customer.
Information we collect
Counsel to draftEnumerate categories: account/identity data, company profile, uploaded documents, usage telemetry, and payment data. Distinguish customer-provided from platform-generated.
- Identity is handled via Clerk (email, name, org membership).
- Company profile: NAICS/PSC codes, target agencies, certifications, past performance.
- Uploaded documents (RFPs, proposals) and accept/reject/dismiss telemetry on recommendations.
Government public data and third-party PII
Counsel to draftThis is the sensitive category and needs explicit treatment. WinLayer ingests public federal data that includes personal data of government points of contact. Address lawful basis, purpose limitation, and the retention/deletion policy for this contact PII.
- The platform stores government point-of-contact PII (contracting officer names, emails) — flagged as a specific compliance concern in the engineering plan (G9).
- Sources: SAM.gov, USAspending, Federal Register, GAO protests, Grants.gov, SBA DSBS, agency budget documents.
- A confirmed retention/deletion policy for contact PII is a Plan §11 prerequisite counsel must finalize.
How we use information
Counsel to draftPurposes: providing the service, scoring/relevance, generating briefs, billing, and product improvement. Be specific that AI processing occurs.
AI processing and no-training commitment
Counsel to draftState which AI providers process customer data and, critically, the no-training-on-tenant-data position.
- AI runs on commercial LLM providers (Anthropic primary, OpenAI secondary) via a model router.
- The architecture commits to no training on tenant data (Foundation 6). Counsel should confirm this is contractually reflected with the providers.
Subprocessors and data sharing
Counsel to draftList all subprocessors in the data path and the purpose of each. Cross-reference the DPA subprocessor list.
- Verify the active provider list and contracts: AWS (hosting, storage, database and GuardDuty scanning), Clerk (auth), configured AI providers, Stripe (billing), Neo4j (graph), SES (email) and Sentry (error monitoring). Optional or unavailable providers must not be represented as receiving customer data without verification.
Security
Counsel to draftDescribe safeguards at a level accurate to the implementation without overstating certifications not yet held.
- Encryption at rest (RDS, S3) and in transit (TLS); tenant isolation enforced by construction and tested.
- Uploaded documents are quarantined and malware-scanned before processing.
- SOC 2 is groundwork/track only — not yet an audited certification. Do not claim SOC 2 compliance.
Data retention and deletion
Counsel to draftState retention periods and the deletion process. WinLayer has genuinely implemented these controls, so the policy can be concrete.
- Implemented: tenant data export, deletion with grace period, legal holds, dual-control approval, and verified purge.
- Counsel to set concrete retention periods per data category (esp. government contact PII).
Your rights and choices
Counsel to draftAccess, correction, deletion, export, and how to exercise them. Tailor to applicable regimes (US state privacy laws; GDPR only if EU users are in scope — MVP is US-only).
Contact
Counsel to draftPrivacy contact address for requests and complaints.