This page says what information GovRoute holds about you, why, who else handles it, how long we keep it, and how to get it removed. It covers all of govroute.co: the home page, Georgia (govroute.co/ga), Tennessee (govroute.co/tn), the Chattanooga border region (govroute.co/border/chattanooga), contracts, your account, and the Spanish versions of our pages.
GovRoute ("GovRoute", "we", "us") is a trade name; who runs it is set out at the top of our Terms of service.
The short version
- We never sell your information, and we never give your account details, company facts, documents or packages to anyone for their marketing. Our ad measurement tells Meta about visits, sign-ups and orders (see Cookies).
- Your files, company facts and packages leave GovRoute only in the cases listed below under "When your information leaves GovRoute".
- Every record carries its state. Our Tennessee team sees Tennessee records only.
- You can see, export or delete your information from your account.
What we collect
When you sign up: your name, your business name and city (and its website, if you give it), your email address, the state you pick (or the Chattanooga border region, or a distance from your shop), and the trades and counties you choose. In your account you can also filter by contract value and save bids; we keep the bids you save to show them, and their deadlines, in your account. If you pick a distance from your shop, we keep the county your shop is in to measure it.
Your company facts: the business facts you give us at sign-up or in your account: licenses, insurance, bonding, crew and equipment, your biggest job, references, past work, key staff, certifications, and a SAM number if you have one. We use them for the bids you order, to write out the answers to the fact blanks on the agency's forms.
What we look up for you (autofill): after you type your business name and city, we fill in what public sources show, and each filled field shows where it was found and the date we checked. For a business in either state we check Tennessee's contractor license records (license, monetary limit) and TDOT's prequalified list, and we look at your business's own website. Georgia's licenses, prequalification and company registration can't be checked automatically, so in Georgia you type them yourself and they show "you told us". Nothing we find counts until you confirm it. For each field we keep the value, the source, the date checked and when you confirmed it. Insurance limits, bonding, crew and equipment are never looked up: they show "you told us".
Documents you upload: licenses, insurance certificates, surety letters, references, your key people's resumes, and the other files a bid asks for. Upload someone's resume or license only with their permission. Please don't upload Social Security numbers, bank account numbers or anything a bid or application doesn't ask for.
When you pay: Stripe collects your payment details in its own secure payment form, which on some purchases appears inside our page. We receive confirmation that you paid, what you bought and which plan you are on. We never see or store your full card number.
When you approve a bid we email for you: we keep a record of your approval: your typed name and title, which order and files (their names and fingerprints), the letter naming us as your agent, when, and the internet (IP) address it was approved from, as proof. If you delete your account, the IP address and some details are removed, and the rest is kept as proof (see the table).
When you contact us: your name, email and message from the contact form, plus the internet (IP) address it was sent from, which we keep for 2 hours to stop abuse. To limit repeat sends, we also note the IP address of each contact or sign-up attempt for 2 hours, then delete it. If you email us, we keep your email.
When you type into the "Questions?" box: today the box searches our published answers inside your browser; what you type is never sent to us.
Public reviews of your business: when you sign up, and before we approve an order, we may look at public reviews and complaint records about your business. We keep the rating, whether the business is accredited, the number of complaints in the last 3 years and how many went unanswered, the date we looked, the link, and the reason a person gives when they approve a flagged order or decline one. Only our staff see it, on their page for your business and your order; our Tennessee team sees it only for Tennessee and border-region customers. It's never published, and it never decides an order by itself (a person reviews it).
We do not buy information about you from anyone.
Cookies and visit records
Your sign-in cookie. Signing in, or opening your confirmation, account, bid or map links from a GovRoute email, signs that browser in. The unsubscribe link never does. We set one cookie, __Host-gr_session, holding only a random sign-in code: not your account link and nothing personal. We keep a one-way coded copy of it with your account so we know it's you. It lasts up to 30 days after you last use it, is sent only to govroute.co, and is never shared with anyone. "Sign out" ends it on every browser you've used, and so does deleting your account. On a shared computer, sign out when you're done. Anyone you forward one of our emails to can open your account from its links, so please don't forward them. Signing in needs this cookie, so we set it even if your browser sends a Global Privacy Control or Do Not Track signal. It isn't used for tracking or ads.
The campaign cookie. If you arrive from one of our ads or tagged links, we set one cookie on govroute.co. It holds only the link's campaign tags and any click ID the ad network added to the link, plus the date and the page you landed on. It lasts 90 days, is never sent to anyone else, and is copied to your account only if you sign up, so we can tell which ads work. We don't set it if your browser sends a Global Privacy Control or Do Not Track signal.
Our own visit counter. For each view of a public page (never your account pages), our own servers note the page, the time, the name of the site that linked you here, any campaign tags in the link, whether an ad click ID was present (not the ID itself), whether the visit came from a phone, whether it came from a known automated visitor (such as a search engine or a link preview), and whether you already have the campaign cookie. When the visit came from one of our ads or tagged links, it also notes the country Cloudflare places your internet (IP) address in, as two letters (such as US), not the address itself. On our $199 landing page it also notes the trade and county named in the ad's link. It never records your IP address, what is in your cookies, or your browser details beyond the phone yes or no. If your browser sends a Global Privacy Control or Do Not Track signal, the campaign details are left out. No one else receives it.
Map searches. When you type in the map's search box, our own servers note the words you typed, how many bids matched and the time, not who typed them.
Our own heatmaps. On our public pages (not your account pages), our own site notes where on the page people click and how far down they scroll, and on the sign-up page which step they reach. It records only the position and the kind of item clicked, or the name of the step, never what you type. It sets no cookies and keeps no identifier. It is off if your browser sends a Global Privacy Control or Do Not Track signal. Each night our own servers turn the last 7 days into heatmap pictures. No one else receives it.
Meta Pixel (Facebook and Instagram ads). On our public marketing pages (never on account, checkout, order, sign-off, error or legal pages, and never once you're signed in, except our thank-you page after a payment, described below) we use the Meta Pixel to measure which Facebook and Instagram ads bring visitors, sign-ups and orders. It tells Meta the page you view (a "PageView"); that someone signed up (a "CompleteRegistration"); that someone pressed the button to get a $199 bid package prepared (a "Lead"); and, once, on our thank-you page after a paid $199 bid package or a Silver or Gold plan paid for at checkout, that a purchase happened (a "Purchase"). It never sends an amount, a plan name, an order or bid number, or your name, email or phone number. Meta sets its own cookies for this. It is off if your browser sends a Global Privacy Control or Do Not Track signal: it stops before it loads anything from Meta. To opt out otherwise, use Meta's ad preferences, your browser's privacy settings, or an ad or tracker blocker.
Two small cookies of our own. gr_state remembers the state you picked (Georgia, Tennessee or all states) for a year, so we show you the right pages. We set it only when you pick one, never from a guess. gr_thanks lasts 30 minutes and only makes sure our thank-you page after a payment is shown once. Neither holds anything about you and neither is sent to anyone else.
Which state opens first. If you haven't picked a state, our home page opens your account's state when you're signed in. Otherwise it opens our Georgia or Tennessee page when Cloudflare, which delivers our site, places your internet (IP) address in that state. We don't store or log that guess or set a cookie for it, and it never decides a price or who handles your account. Each state's page links to the other.
Same on every state's pages. These cookies and tools work the same on the Georgia, Tennessee, border and Spanish pages.
What we use it for
Only to run GovRoute for you: matching bids to your filters, keeping the bids you save and their calendar, sending your alerts and calendar feed, checking and preparing what you ask us to prepare, delivering it the way you choose, billing you, answering you when you write to us, calling you about your account or an order, at a number you gave us, and measuring which of our pages and ads work.
When your information leaves GovRoute
We never sell your information, and we never give your account details, company facts, documents or packages to anyone for their marketing. Our ad measurement (see Meta Pixel above) tells Meta about visits, sign-ups and orders from browsers without a Global Privacy Control or Do Not Track signal; Meta uses it under its own terms.
We never share your company profile, your uploaded documents or your packages outside GovRoute, except in these cases:
- Tools that read your information. Your drafts, packages and the check of your company facts are prepared on our own servers by our own software. No outside service writes them. Our staff tools also include a service from Anthropic, on its subscription plans. Staff use it in their own work, such as reviewing a package before it's ready for you, drafting a reply to an email you sent us, or looking into a question about your account or an order. It doesn't write your drafts or packages, and every reply it drafts is checked before it's sent. Anthropic's use of our conversations for training is switched off on every account our staff use, and we never give Anthropic feedback (such as a rating) on a conversation that includes your information. Under Anthropic's terms for these plans, Anthropic may still use a conversation its safety systems flag for review, including for training. We ask for deletion when needed; their legal-hold exceptions may keep data longer than our own schedule.
- Delivery you ask for. When you sign and authorize us to submit a bid, and the agency takes bids by email, we email your approved, signed files, unchanged, to the agency named on the bid, with your signed letter naming us as your agent. If the agency's instructions say the bidder must send it personally, you send it and we give you the files. For a paper bid you print, sign and deliver it yourself. For a portal bid you press Submit yourself, from your own account, and we give you the files and the steps. We never sign for you, and we never hold your password. We send it only to that agency or funder. They may have to release submissions under public-records laws or their own rules; what stays confidential varies, and we can't promise it stays private.
- Service providers. The companies listed under "Who else handles it" process information for us, only for the job listed there. Meta, our ad-measurement provider, also uses what it receives under its own terms.
We never contact anyone in your business's name on our own. We contact an agency or funder in your name only to deliver what you approved (case 2). The question builder never sends anything: you review and send any question or message yourself. We send no cold email.
We never sign, certify or attest anything for you. You sign your own bids and applications.
If the law requires it. We may disclose information when a valid subpoena, court order or other legal process requires it. Unless the law forbids it, we tell you first so you can object.
Two states, kept apart
Every account, file, alert, order, payment, visit record and log carries its state: Georgia or Tennessee. Our server checks the state on every request; it is never just hidden in a menu.
- Our Tennessee team. Tennessee customers and orders are handled by our Managing Director for Tennessee, an independent contractor working under a written agreement that keeps customer information private. He sees Tennessee records only, including Tennessee payments. He never sees a Georgia customer, order, activity or payment, totals included.
- Border customers. If you pick the Chattanooga border region or a radius that crosses the state line, your account has a home state, and each bid and order is handled under its own state's rules. Our Tennessee team sees your account and your Tennessee orders, never your Georgia ones.
- Every surface, not just the desk. The same split holds on the bid maps and the questions search, the sitemap, the visit counter and heatmaps, and any export to the Tennessee desk.
Agency documents we host
On a bid page we may host copies of the agency's own public documents and addenda. Each is an unchanged copy, with the date we copied it, a fingerprint of the file and a link to the official source; the official source governs. We check them daily. These copies hold no customer data: nothing about you is added to them, and downloading one does not tell the agency who you are. We keep them out of Google search (each points search engines to the agency's official link). Documents an agency only offers through BidNet, DemandStar or another sign-in portal or plan room stay as links, and we don't download them. Architects' and engineers' drawings and construction spec books, and any other document carrying someone else's copyright or a "do not reproduce" notice, also stay as links; we keep a private copy of those only to spot changes, send addendum alerts, write our own summary of the bid's requirements, and prepare a package you order for that bid; it is never published or handed out as a copy. Where an agency requires you to download from its own portal to be an official plan holder, the page says so.
Documents that list people. We don't host copies of agency documents that list people's names or contact details, such as plan-holder lists, sign-in sheets and attendee lists. We link to the agency's own copy instead.
Takedown: anyone, including the agency, can ask us to take a hosted document down at hello@govroute.co. We take it down within one business day and keep the link to the official source.
Our visit counter doesn't count document downloads, and we don't record who downloads one.
Bid packages ($199, Gold drafts and Platinum)
- What we receive: your email address (from checkout; your card goes to Stripe, never to us), your company profile, the documents you upload, and the bid's own documents.
- How we use it: only to check the bid against your profile, prepare your drafts and packages, and deliver them as you choose (case 2). Our own software, on our own servers, prepares them (see case 1).
- Who sees it: you, our software and our reviewers, who check every $199 and Platinum package before it is ready, including a staff review that may use Anthropic's service (see case 1). When you authorize us to email a bid, the agency gets the signed bid you approved and your signed letter naming us as your agent. If the bid is in Tennessee, our Tennessee team sees it too.
- One bid, one firm: we prepare each bid for one customer. If a bid is already taken, its page says "Someone is already having this bid prepared." and never names who took it.
Texts
We don't send text messages. Alerts come by email. If you gave us a mobile number before, we keep it on your account and never text it. If you ever turned on text alerts, we keep the record of that consent and any opt-out (see the table), so we never text a number that opted out.
Spanish pages
Some of our site's pages are also available in Spanish, translated ahead of time; no translation service sees your visit or your information. They collect nothing the English pages don't. This policy is in English only.
Who else handles it
These service providers process information for us, only so the service can work. Each receives only what it needs for its job, in both states (Meta also uses ad-measurement data under its own terms):
| Provider | Job | What it receives |
|---|---|---|
| Stripe | Payments | Your payment details, email address and what you bought |
| Resend | Sending our emails | Each email we send: the address and what it says. When we email a bid for you, that includes the signed files you approved and your signed letter naming us as your agent |
| Cloudflare | Delivering the website and our mail | Your visits to govroute.co as they pass through; mail you send to our govroute.co addresses, such as hello@govroute.co |
| Our email inboxes (Gmail) | The emails you send us and our replies | |
| Meta | Ad measurement (Meta Pixel) | Views of our public marketing pages, and the fact of a sign-up, a $199 checkout start and a payment (no amounts or order numbers), from browsers without a GPC or DNT signal |
| Anthropic | Staff work, on Anthropic's subscription plans (see case 1), such as reviewing packages and drafting replies to your emails, with training off and no feedback given | What that piece of work needs, such as your company facts and the package, or the emails you send us |
Others who receive information only when you direct it:
- The agency or funder you submit to: the bid or application you approved, unchanged (for a bid, with your signed letter naming us as your agent).
Tennessee's license search receives only your business name, city or license number as a search, never your profile. TDOT's prequalified list is a public file we keep a copy of, so TDOT receives nothing. To read your website we simply request its public pages.
How long we keep it
| What | How long |
|---|---|
| Your account, filters, saved bids and company profile (incl. confirmed autofill fields) | While your account is open; deleted within 30 days after you ask us to delete your account |
| Documents you upload | Until you delete them, or within 30 days after you ask us to delete your account |
| Your packages, drafts and orders, with your questions about a bid, our written answers and the note of a call | While your account is open; deleted within 30 days after you ask us to delete your account, except the payment records and the proof records below |
| Package acceptances, the letters naming us as your submitting agent and final-approval records | 6 years after signing, as proof of what you allowed us to do: who signed, for which business, the order, the terms version, the dates, and the names and fingerprints of the files you approved. If you delete your account before then, we delete the files themselves and remove the IP address and your title, company and price from the record; the signer's name, file names, fingerprints, dates and order reference stay until the 6 years end. If a dispute needs a file, its fingerprint shows whether your copy is the one you approved. We keep anything longer only when the law requires it or a dispute is open, and delete it when that ends. |
| Emails we sent you and emails you sent us | While your account is open; deleted within 30 days after you ask us to delete your account |
| Contact-form messages | 1 year if you have no account; with an account, deleted within 30 days after you ask us to delete it |
| IP addresses of contact and sign-up attempts | 2 hours |
| Visit counter and heatmap data | 13 months (none of it identifies you) |
| Text-alert consent and opt-out records | Up to 5 years, as proof of consent and so we never text a number that opted out |
| Payment and accounting records | As long as tax and accounting law requires. When you ask us to delete your account, we keep these but remove your name and email from them where we can |
Backup copies, kept on our own servers, are deleted after 30 days.
Backups
We keep backup copies of our databases on our own servers, so the service can recover from a failure.
If there's a breach. If a breach affects your information, we notify you and others as the breach-notice laws require.
Your choices
- See and change it: your filters, alerts, company profile and uploads are in your account at govroute.co/account.
- Export it: you can download a copy of your account information from your account.
- Delete it: you can ask us to delete your account from your account page or by writing to hello@govroute.co. We delete it within 30 days, as in the table above. If you have a paid plan, cancel it first; you can do that inside your account. If a package is still being prepared, you can delete your account once it's delivered; to stop the work sooner, write to us.
- Stop emails: use the "Manage or stop alerts" link in any alert, or cancel your plan.
- Correct it: change it in your account, or write to us.
Your state's privacy laws
You can use the choices above wherever you live.
Changes to this policy
If we change this policy in a way that affects how your information is used, we will email you before the change takes effect.
Contact
GovRoute · hello@govroute.co · or use the contact page.