Privacy Policy
This Policy explains GovBuyX’s information practices, users’ choices, and company administrators’ roles across the website, invitations, authenticated platform, support, and features that reference it.
Who we are and how this Policy applies
GovBuyX is a subsidiary company of Wakaga Economic Development Group. Wakaga is the wholly owned Indian Economic Enterprise and economic development organization of the Wakpamni Lake Community. The Wakpamni Lake Community government is a local subsidiary municipal tribal government of the Oglala Sioux Tribe (OST), a federally recognized tribal government. The GovBuyX operating company is identified in the Ownership Disclosure at https://www.govbuyx.com/legal/ownership .
This Policy covers FedBidX and other GovBuyX modules. Separate notices may govern employment, particular deployments, integrations, or transactions. A valid data-processing agreement controls the customer-content processing it specifically addresses, subject to applicable law.
GovBuyX controls processing for its own invitations, security, billing, and support. For workspace information, your organization determines its purposes and GovBuyX may act as its service provider or processor under the customer agreement. The applicable law and activity determine the legal roles.
This notice does not replace any separate consent required by applicable law.
Information we collect and its sources
We receive information from you, your organization and its administrators, authorized users, public government sources, any sign-in provider you choose, and the operation of the service.
Invitations, accounts, and authentication
An invitation request may include company name, your name, business email, optional phone number and UEI, and a description of your business. We also record the request’s IP address to help prevent abuse. A request is reviewed by a person and does not itself create an account.
Account information includes name, email or sign-in identifier, company membership, role, permissions, and optional job title, phone number, and profile image. Authentication records include a salted password hash, invitation or recovery records, and authentication information needed for two-factor authentication if enabled. We do not store your password in readable form. We also record sign-in times, IP addresses, browser information, and sign-in methods.
Company information and work content
Company profiles may contain legal name, addresses, contact information, website, UEI, CAGE code, legacy DUNS information where supplied, NAICS codes, business types, certifications, SAM.gov status, and designated contacts. We process price lists, product or service descriptions, SKUs, rates, locations, and price-confirmation history when those features are used.
Workspace content includes tracked opportunities, bids, grant applications, project stages, assignments, budgets, notes, messages where offered, uploaded documents, prompts, and generated work product. Such material may include information about employees, business contacts, vendors, or other individuals that your organization supplies.
Activity, usage, billing, and support
Audit records identify significant actions, the person and company involved, the item affected, and the time. These include authentication activity, role or permission changes, company edits, credit purchases or limits, project creation, and workflow changes.
We maintain credit and usage ledgers recording chargeable actions, their costs, and related compute consumption, including model-token usage. Billing records include orders, invoices, receipts, payment status, and billing contacts. The current platform does not collect or store payment-card numbers. Credit purchases are invoiced separately.
Support information includes inquiries, correspondence, attachments, problem descriptions, and the records needed to investigate an issue. Do not send passwords, authentication codes, or unnecessary sensitive information in a support message.
Technical information
Server and security records may include IP address, browser or device information, request time, errors, and access or security events. Separate service-performance measurements record the kind of page or action, success or failure, duration, company context, and access level. Those measurements do not include an individual user identifier, name, email address, or the address of a specific work record. Company context and other metadata may still relate to an organization or person when combined with other records; we do not describe all such measurements as anonymous.
How we use information
We use information as reasonably necessary to:
- Review invitations, establish accounts, authenticate users, and administer company access.
- Provide searches, briefs, drafting, project workflows, document storage, and other selected features.
- Meter usage, manage credits, issue invoices, and maintain business records.
- Respond to support requests, diagnose errors, and maintain service reliability.
- Protect accounts, investigate abuse, enforce agreements, and preserve audit records.
- Evaluate service performance and improve functionality without using private customer content beyond the permissions described in this Policy and the customer agreement.
- Deliver service notices and requested communications, and satisfy binding legal, contractual, security, and records obligations.
Where a law requires a legal basis for processing, the basis may be performance of a contract, a legal obligation, consent, or a legitimate interest such as operating and securing the service, subject to that law’s requirements. Processing on an organization’s behalf also follows its authorized instructions. Where consent is the basis, you may withdraw it without affecting earlier lawful processing.
Access within your company
GovBuyX is organizational workspace software. Information is visible according to company membership, assigned work, and permissions. It should not be treated as a private personal account independent of the organization that administers it.
Under the current role structure, Owners and Executives can review their company’s full activity history, including financial activity. Managers can review activity and compute usage for people within their management scope, but not payment details, credit purchases, or permission-change records reserved to higher roles. Staff and other ordinary users can review their own activity. Company members can see company membership and work assignments, while access to work content follows the relevant permissions.
Company administrators manage membership, roles, and access. Corporate ownership alone does not grant access to another company’s workspace; membership or another express permission is required.
GovBuyX support and administrative access
Authorized platform administrators may access information across customer companies when needed to operate, maintain, secure, or support the service. This is distinct from a customer administrator’s authority within its own company.
For troubleshooting, an authorized administrator may use a support function to view the application as a user. This does not reveal or use that user’s password. The function records the administrator, affected account and company, start and end, and actions taken, preserving attribution to the administrator. Administrative access is for authorized operational purposes and does not permit unrestricted use of customer information for unrelated purposes.
Wakaga personnel, developers, licensors, and other supporting parties receive access only where authorized and reasonably necessary to perform their assigned functions, under applicable confidentiality and data-protection obligations. Corporate ownership or software ownership alone does not authorize unrestricted access to customer workspaces.
Artificial intelligence and generated work
GovBuyX uses language models to summarize opportunities, prepare briefs, and draft proposal material. Inputs may include the solicitation, relevant company information, instructions, and workspace content selected for the action. We record associated usage for metering and operations.
The current model-processing arrangement uses hardware controlled by GovBuyX and a private encrypted connection. Customer solicitations, company information, prompts, and drafts are not sent to an external AI-model provider for this processing. We do not use private customer work product to train shared models for other customers or to train another provider’s models.
These AI commitments do not exclude the hosting, support, and provider access described elsewhere in this Policy. AI processing remains subject to customer-content permissions and confidentiality protections.
AI output requires human review. It does not itself submit an application, award a contract, or make an eligibility determination for a government agency. We will provide an updated notice and obtain any required authorization before introducing materially different AI data uses.
Service providers, public sources, and other disclosures
The platform is hosted on Amazon Web Services infrastructure in the United States. Providers supporting hosting, security, maintenance, communications, and other authorized operations may process information as necessary for their services, subject to appropriate contractual restrictions and safeguards.
If you choose Microsoft Entra or Google sign-in where available, that provider supplies authentication information to GovBuyX. GovBuyX does not receive the provider-account password. The provider also processes the sign-in under its own terms and privacy notice.
GovBuyX retrieves public opportunity information from sources including SAM.gov and Grants.gov. That retrieval is not a submission of your company’s application or bid. The current opportunity-retrieval process does not send your private company information or proposal content to those sources.
We may disclose information to a recipient you or your organization authorizes; professional advisers bound by appropriate duties; or a qualified successor involved in an actual or proposed reorganization or transfer of the service, subject to confidentiality and applicable privacy requirements. A successor must respect the commitments applicable to transferred information or provide notice and obtain any consent required for a changed use.
We may also disclose information to address fraud, security incidents, threats to safety, or abuse; protect legal rights; or comply with legal process and requirements that validly apply. We evaluate authority, jurisdiction, scope, confidentiality obligations, and applicable protections before responding to a demand. We limit disclosures to what is reasonably necessary or legally required.
We do not sell personal information or disclose it for another party’s advertising or cross-context behavioral advertising. Authorized operational disclosures are described above. External websites you choose to visit have their own information practices.
Cookies and measurement
The current application uses a sign-in session cookie with an eight-hour expiration. It is not readable by page scripts and is restricted to the service’s applicable domain. Blocking or deleting it may prevent sign-in or end a session.
GovBuyX does not currently use advertising cookies, third-party analytics cookies, or third-party tracking scripts in the application. Service measurements occur on our servers, and those measurements do not track you across unrelated websites. An external sign-in provider or website may use its own cookies when you visit it.
Browser privacy settings can help manage cookies. A browser’s legacy “Do Not Track” setting does not replace the controls described here. Where a legally recognized opt-out preference signal, including Global Privacy Control, applies to our processing, we will handle it as required by the applicable law. We will disclose material changes to tracking practices and obtain consent where required before deploying optional tracking.
Retention and account closure
We retain information only as reasonably necessary for the purpose collected, the customer relationship, and legitimate contractual, security, audit, dispute, and legal-records requirements. The category of information, sensitivity, risks, and applicable obligations determine the retention period.
Account and profile records are generally retained while the organization maintains the account. The recent sign-in history shown in the product retains the latest 50 sign-ins per person. Separate security or audit records may retain information about the same events for their own justified purposes. Service-performance measurement data is retained for 90 days and then deleted.
Workspace projects and documents are generally retained while the service is active and until the organization requests deletion or closes the account, subject to the export period in the Terms, valid instructions, and required retention. Removing one person’s account does not automatically delete the organization’s work or records of that person’s actions.
Audit, billing, and transaction records may remain after account closure where needed for integrity, security, financial records, disputes, or a binding retention obligation. Ordinary product controls do not allow users or administrators to alter or delete audit history. That product restriction does not mean all records must be retained forever or eliminate an applicable legal deletion obligation.
Declined or blocked invitation records may be kept while reasonably necessary to administer the decision and prevent repeated abuse. Backups may retain deleted information until their scheduled replacement or expiry; such copies remain protected and are not used for ordinary ongoing operations. A legal hold or binding records obligation may delay deletion. Information no longer needed is deleted or appropriately de-identified; retained information remains subject to this Policy.
Security and incident notices
GovBuyX uses administrative and technical safeguards intended to protect information, including access controls, salted password hashing, encrypted traffic, available two-factor authentication, activity logging, and permission checks. Changing or resetting a password ends the account’s other active sessions under the current implementation.
No connected service can guarantee absolute security. Protect your credentials, use available two-factor authentication, keep your devices secure, and report suspected unauthorized access promptly.
If a security incident involves information we hold, we will investigate and take appropriate containment and response measures. We will notify affected organizations, individuals, or authorities where required, within the periods required by the law or contract that applies to the incident. A reservation of sovereign immunity does not change a notification obligation that validly binds us.
The standard service is not authorization to upload classified information, Controlled Unclassified Information (CUI), regulated health information, or other data requiring special safeguards. Such processing requires a separate written arrangement expressly approving the data and the required environment. Tribal affiliation, United States hosting, or access to AI does not itself establish CMMC, FedRAMP, or another security authorization.
Your choices and privacy requests
Available profile controls allow you to update profile information and notification preferences, change your password, enable two-factor authentication, and review recent sign-ins. Changes to a sign-in email may require approval from an Owner or Executive. Your organization controls workspace membership and permissions.
You may contact privacy@wakagagroup.com with “GovBuyX Privacy Request” in the subject line to ask about information held about you, request correction or deletion, or raise a concern. For employer or customer-controlled workspace information, we may refer the request to that organization or assist it under the governing agreement. That referral does not relieve GovBuyX of an obligation that applies directly to its own processing.
Depending on the law that applies, rights may include access or knowledge, correction, deletion, portability, withdrawal of consent, objection or restriction, and opt-outs relating to sale, sharing, targeted advertising, sensitive information, or certain profiling. Where provided by applicable law, you may use an authorized agent, appeal a denial, or complain to a competent authority. We will not unlawfully discriminate for exercising an applicable privacy right.
We may request information reasonably necessary to verify identity, authority, or the scope of the request. We will respond within the time required by the applicable law, explain a denial or permitted extension as required, and identify an available appeal route. Requests remain subject to applicable exceptions, including protection of another person’s information and lawful retention. You may also request this Policy in an accessible format.
You may decline optional promotional messages through their unsubscribe mechanism or by contacting us. Necessary account, billing, security, and service notices may continue.
International users and children
GovBuyX operates, processes, and stores information in the United States under its current hosting arrangement. International access may involve a transfer. We will use any transfer safeguards or other mechanisms legally required for that processing; website use alone does not replace them.
GovBuyX is for business users aged 18 or older with the required capacity and authority. We do not knowingly solicit children’s personal information. Contact us about any suspected collection so we can investigate and act appropriately.
Governing law, disputes, and sovereign disclosure
Privacy matters involving GovBuyX are subject to applicable tribal law, applicable federal law, valid contractual requirements, and any other law that properly governs the particular activity. Whether a state or international privacy law applies depends on its scope, the entity and processing involved, and governing jurisdictional principles. This Policy does not claim a blanket exemption from such laws.
GovBuyX’s relationship to Wakaga, the Wakpamni Lake Community, and the Oglala Sioux Tribe is described above. Nothing in this Policy waives any sovereign right, immunity, jurisdictional protection, privilege, or defense applicable to GovBuyX, Wakaga, WLC, or OST.
No privacy request, response, correspondence, collection or disclosure of information, service-provider arrangement, security incident, or other interaction independently constitutes consent to the jurisdiction of a court, arbitrator, regulator, or other forum where consent or a waiver would otherwise be required.
Any waiver of sovereign immunity must be express, unequivocal, written, and duly authorized through the applicable tribal governmental process and the affected entity’s governing requirements. Any valid limited waiver operates only within its authorized scope. These reservations neither create immunity where none exists nor defeat authority or obligations that validly apply without consent. A privacy dispute is evaluated under these principles, the Terms of Service, and any controlling valid written agreement.
Changes and contact information
We will date revisions and notify users of material changes through an appropriate channel. We will obtain any required consent or authorization before materially changing uses of previously collected information. Earlier versions may be retained for records purposes.
- Privacy requests: privacy@wakagagroup.com
- Legal notices: legal@wakagagroup.com
Postal correspondence: GovBuyX, care of Wakaga Economic Development Group, 1 Powwow Development Park, Batesland, SD 57716, United States. Identify GovBuyX in your request.
Related policies: Ownership Disclosure — https://www.govbuyx.com/legal/ownership ; Terms of Service — https://www.govbuyx.com/legal/terms .