Privacy Policy
Effective Date: September 13, 2026. Supersedes the Privacy Policy dated July 17, 2025.
1. Who We Are and What This Covers
1.1 Contracting Intelligence Group, LLC (“CIG,” “we,” “us,” “our”) is a federal acquisition consulting firm based in Ashburn, Virginia.
1.2 This Privacy Policy describes what personal information we collect through www.contractingintelligencegroup.com (the “Site”), our client portal, and our services; how we use it; who we share it with; how long we keep it; and the choices you have.
1.3 Your purchase of any service is also governed by our Terms of Service at www.contractingintelligencegroup.com/terms-of-service.
1.4 Most of the people we deal with are acting for a business rather than in a personal capacity. We apply this Policy to everyone, whichever describes you.
2. Information You Give Us
2.1 Contact and inquiry forms. Your first and last name, email address, phone number, a preferred date, the services you are interested in, the budget range you select, how you heard about us, your message, and whether you opted in to our mailing list.
2.2 Booking and intake. When you schedule a GovCon Growth Diagnostic or another call, we collect your name, business name, email address, your phone number if you give it, and whatever you provide on the pre-call intake form.
2.3 Orders. When you buy a service we collect your name, email address, billing address, what you ordered, and the amount paid.
2.4 Client portal. If we open an engagement for you, we create an account in our client portal holding your contact details, engagement status, documents, invoices, and our correspondence with you.
2.5 Payment information. We do not receive or store your full payment card number, its expiry date, or its security code. Payment is processed by Stripe through Squarespace Commerce. We receive confirmation of payment, the last four digits of the card, and the billing details you enter.
2.6 Email subscriptions. If you opt in, we keep your name, your email address, and a record of your consent.
3. Engagement Materials
3.1 To perform a review you send us solicitation documents, amendments, your draft proposal, past performance information, and sometimes your pricing. We call these Engagement Materials.
3.2 Engagement Materials are business records, not marketing data. We use them only to perform your engagement. We do not mine them for leads and we do not use them for the benefit of another client.
3.3 Engagement Materials are Confidential Information under Section 13 of our Terms of Service.
3.4 Please do not send us classified information, source selection information you are not authorized to hold, another offeror’s proprietary information, or Controlled Unclassified Information without a prior written agreement on how it will be handled. See Sections 9.4 and 9.5 of the Terms of Service.
4. Information Collected Automatically
4.1 When you visit the Site, we and our providers collect your IP address, browser and device type, operating system, the page that referred you, the pages you view, and the dates and times of your visit.
4.2 The Site sets the following cookies.
crumb — set by Squarespace. Security. Protects our forms against cross-site request forgery. Lifetime: session.
ss_cvr, ss_cvt — set by Squarespace. Counts unique visitors and measures visit length. Lifetime: up to 2 years.
hasCart — set by Squarespace. Remembers that your cart has something in it. Lifetime: session.
ga, ga_[ID] — set by Google Analytics 4. Distinguishes visitors and sessions so we can see traffic patterns. Lifetime: up to 2 years.
__stripe_mid, __stripe_sid — set by Stripe. Fraud prevention on pages where payment is possible. Lifetime: up to 1 year.
4.3 We do not run advertising pixels, retargeting tags, or social media tracking on the Site.
4.4 These cookies are set when you arrive. We do not display a cookie consent banner, because we do not use cookies for advertising and we do not sell personal data. You can block or delete cookies in your browser settings, and you can opt out of Google Analytics using Google’s browser add-on at tools.google.com/dlpage/gaoptout.
4.5 Global Privacy Control. If your browser sends a Global Privacy Control or Do Not Track signal, we treat it as a request to opt out of any sale of personal data and of targeted advertising. We do neither in any event.
5. How We Use Information
5.1 To answer your inquiry, and to schedule and hold calls.
5.2 To accept and fulfill orders, perform engagements, deliver findings, and invoice you.
5.3 To screen orders for conflicts of interest, as described in Section 14 of the Terms of Service.
5.4 To send transactional messages: order confirmations, receipts, intake instructions, delivery notices, and invoices. You cannot opt out of these while an engagement is open.
5.5 To send marketing email, and only if you opted in. Every marketing email carries an unsubscribe link.
5.6 To measure how the Site is used and improve it.
5.7 To keep the records we are required to keep for tax, accounting, and dispute purposes.
5.8 To comply with law, and to establish, exercise, or defend legal claims.
6. What We Do Not Do
6.1 We do not sell personal information, and we have not sold personal information in the preceding twelve months.
6.2 We do not share personal information for targeted or cross-context behavioral advertising.
6.3 We do not profile you in a way that produces legal or similarly significant effects.
6.4 We do not publish your name, your company, or the fact that you are a client without your written consent. See Section 13.5 of the Terms of Service.
7. Artificial Intelligence
7.1 CIG uses AI-assisted tools in parts of its work, under an internal AI usage policy.
7.2 Where we use them, we use business accounts whose terms do not permit the provider to train its models on the content we submit.
7.3 A person is responsible for every deliverable. No finding is issued to you on the basis of an automated output alone.
7.4 You may ask us in writing not to use AI-assisted tools on your engagement. We will confirm in writing whether we can accommodate that before work begins.
8. Service Providers
8.1 We use the providers below to run the Site and deliver our services. Each processes information on our behalf and is bound by its own agreement and privacy policy.
Squarespace — Hosts the Site, runs our forms, stores contacts, and powers our store and marketing email. Handles: everything you submit on the Site, order records, mailing list.
Stripe — Processes card payments. Handles: your card details, which go to Stripe and not to us, plus billing information.
Google — Analytics for the Site; Workspace for our email and calendar; scheduling for calls. Handles: site usage data, your correspondence with us, calendar invitations.
SuiteDash — Our client portal, intake forms, and client records. Handles: contact details, engagement records, documents, invoices.
8.2 We do not permit these providers to use your information for their own marketing.
9. Other Sharing
9.1 With our professional advisors, including our accountant and our counsel, under obligations of confidentiality.
9.2 Where required by law, subpoena, or government order. We will give you notice where we are legally permitted to do so.
9.3 In connection with a merger, acquisition, or sale of the business, subject to this Policy.
9.4 At your direction, or with your consent.
10. How Long We Keep Information
10.1 We keep information for the periods below, unless a longer period is required by law or is necessary to establish, exercise, or defend a legal claim.
Contact and inquiry form submissions — Three years from your last contact with us.
Booking and pre-call intake records — Three years from the date of the call.
Mailing list — Until you unsubscribe. We then keep your address on a suppression list so we do not email you again.
Order, invoice, and payment records — Seven years, for tax and accounting.
Client portal accounts — For the life of the relationship, then three years.
Engagement Materials — Three years after the engagement ends, matching the confidentiality term in Section 13.6 of the Terms of Service. Sooner on written request, unless we need them to defend a claim.
Website analytics — Up to fourteen months.
10.2 When a retention period ends, we delete the information or remove the details that identify you.
11. Security
11.1 We limit access to the personnel and contractors who need it, use individual accounts rather than shared logins, and transmit information over encrypted connections.
11.2 Engagement Materials are kept in our client portal and business systems rather than on personal devices.
11.3 No system is perfectly secure, and we cannot guarantee absolute security over the Internet.
11.4 If a security breach affecting your personal information occurs, we will notify you as required by Virginia law.
12. Your Rights and How to Use Them
12.1 You may ask us to confirm whether we hold personal information about you and give you access to it; correct information that is inaccurate; delete it; give you a portable copy; stop sending you marketing email; and opt out of any sale of personal data, targeted advertising, or profiling with legal or similarly significant effects. We do not do the last three in any event.
12.2 To make a request, email contact@contracting-intel.com with “Privacy Request” in the subject line.
12.3 We will respond within forty-five (45) days. Where a request is complex we may take one further forty-five (45) days, and we will tell you before we do.
12.4 We may need to verify your identity before we act, and we may decline a request we cannot verify.
12.5 Appeals. If we refuse a request, you may appeal by replying to our decision within thirty (30) days. We will respond in writing within sixty (60) days and explain our reasoning. If we deny the appeal, you may submit a complaint to the Virginia Attorney General at oag.state.va.us.
12.6 There is information we cannot delete on request, including order and tax records and Engagement Materials we need to defend a claim. We will tell you when that is the reason.
13. Virginia Consumer Data Protection Act
13.1 The Virginia Consumer Data Protection Act applies to businesses that, in a calendar year, control or process the personal data of at least 100,000 Virginia consumers, or of at least 25,000 Virginia consumers while deriving more than half of gross revenue from the sale of personal data.
13.2 CIG does not meet either threshold. The Act also excludes individuals acting in a commercial or employment context from its definition of “consumer,” and most of the people whose information we hold are acting for a business.
13.3 We extend the rights in Section 12 to anyone who asks, whether or not the Act requires us to.
13.4 We take the same approach to the consumer privacy laws of other states. If your state gives you a right we have not listed, ask us and we will honor it where it applies.
14. Visitors Outside the United States
14.1 The Site is hosted in the United States and information you send us is processed there.
14.2 If you are in a jurisdiction whose privacy laws differ from those of the United States, please do not submit information to us unless you are comfortable with that processing.
15. Children
15.1 The Site is directed to businesses and is not intended for children. We do not knowingly collect personal information from anyone under eighteen. If we learn that we have, we will delete it.
16. Changes to This Policy
16.1 We may revise this Policy by posting an updated version with a new Effective Date. Where a change materially affects how we use information you have already given us, we will tell you before it takes effect.
17. Contact
Contracting Intelligence Group, LLC
Ashburn, Virginia