DeployReady Privacy Policy

1. Who We Are

DeployReady is a software service operated by Capstone Horizon LLC, an Arizona limited liability company ("Capstone," "we," "us," "our"). Our legal address is 5110 W Jeffrey Rd, Tucson, AZ 85757.

This Privacy Policy covers our website (www.deploy-ready.com), the DeployReady web application (app.deployready.app), and the DeployReady mobile app for iPhone and Android (together, the "Service"). It describes what personal information we collect, how we use and share it, and the choices and rights you have.

2. What We Collect

2.1 Account Data

When you register or are invited to a company account, we collect your name, email address, company name, your role in your organization, and the password you choose. Passwords are stored only as a scrypt hash; we never store your password in readable form. If you turn on two-factor sign-in or passkeys, we store the information needed to verify them. When you sign up on our website, we also record an optional phone number, the referral or advertising link you arrived from (including campaign tags), and the IP address and browser used to sign up.

2.2 Content You Provide

You may upload or enter solicitation documents, company profile data, information about people at your organization, candidate and resume information, past performance write-ups, parts inventory, pricing information and other files. We store this content to provide the Service. You control what you upload.

2.3 Generated Outputs

We store the analyses, proposal drafts, pricing workbooks and other outputs the Service creates for your account.

2.4 Public Government Data

The Service retrieves public records from government sources such as the System for Award Management (SAM.gov), USAspending.gov, the Federal Procurement Data System and the Defense Logistics Agency. These records can include the names and business contact details of contracting officers and other businesses. We show them to you as part of the Service.

2.5 Usage Data

When you use the Service, our servers record log data such as pages and features used, actions taken, timestamps, IP addresses, and browser or device type. We use it to operate, secure and improve the Service.

2.6 Sign-in and Audit Records

We keep a record of each successful sign-in, with your email address, name, role, IP address, browser or device type, sign-in method and time. We also keep an audit log of security-relevant changes, such as company registration changes, compliance overrides, eligibility runs, application programming interface (API) key creation and revocation, evidence uploads and changes to AI model settings. Audit entries include the user, company account, action, affected record and time.

2.7 Billing Data

Payments are processed by Stripe. We do not store full payment card numbers. We keep your Stripe customer ID and your plan and subscription details.

2.8 Mobile App Data

The mobile app uses the same account as the web application. If you turn on notifications, we also collect a push notification token for your device, the device platform (iOS or Android), a device name, the app version, and which alert types you chose. We use these only to send you the alerts you chose, such as new opportunities, amendments, deadlines, finished analyses, DIBBS matches, account notices and, if you turned them on, candidate matches. The alert text and a short summary of the item travel through our push providers (Section 5.1).

The mobile app does not access your location, contacts, photos or other files on your device, and it contains no advertising or analytics software. Links in the app that open our website or web application, such as sign-up, open in a browser, where Section 2.9 applies. You can turn notifications off in the app or in your phone's settings. Signing out removes that device from your account.

The "Explore with a sample company" option shows a fictional company's data. It does not create an account, and it collects nothing beyond the usage data described in Section 2.5.

2.9 Cookies, Analytics and Advertising Measurement

The web application stores your sign-in token and basic profile in your browser so you stay signed in, along with in-progress work such as draft quote rows and small preferences such as whether the sidebar is open.

Fonts. Our website and web application load fonts from Google Fonts and Fontshare. Those services receive your IP address and browser details when a page loads.

Analytics. Our website and web application use Plausible Analytics to count visits and page views. Plausible does not use cookies and does not build profiles of individual visitors.

Advertising measurement. We advertise DeployReady through OpenAI's advertising platform. To measure which ads lead to sign-ups, our website and web application load OpenAI's measurement pixel. It records page views and sets first-party cookies that hold an ad click reference and a browser identifier, and it may read the email address you type into our sign-up and sign-in forms in hashed form. When you create an account, start a trial or start a paid subscription, we also send OpenAI that event with a hashed (one-way encoded) copy of your email address, your phone number if you gave one, and your DeployReady user ID, plus your IP address, browser type, country, the ad click reference and browser identifier, and the plan and price. This advertising measurement never includes your uploaded content or anything you create in the Service. (Separately, OpenAI is one of our AI model providers and processes document text for the analyses you request; see Section 5.1.) If your browser sends the Global Privacy Control signal, none of this happens. You can also opt out as described in Section 7.

Affiliate referrals. Our website and web application load the script of our affiliate program provider, Rewardful. If you arrive through a partner's referral link, Rewardful records the referral with a cookie, and through our payment processor it receives the referred customer's email address, name and subscription payments so the partner can be credited.

You can block or delete cookies in your browser. Blocking the sign-in storage will prevent you from staying signed in; blocking the advertising and referral cookies does not affect the Service.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate and maintain the Service;
• Create and secure your account and sign you in;
• Analyze solicitations, generate proposal drafts and produce other outputs you request;
• Process billing and manage subscriptions through Stripe;
• Send service email (sign-in notices, alerts, digests, receipts and account notices);
• Send push notifications to your mobile device, if you turned them on;
• Measure the performance of our advertising and credit referral partners, as described in Section 2.9;
• Keep security audit logs and investigate incidents;
• Detect and prevent fraud, abuse and security incidents;
• Improve the Service's features, reliability and performance;
• Respond to your support requests; and
• Comply with legal obligations.

We do not use your uploaded content or generated outputs to train machine learning models, and we do not sell your data.

4. Legal Bases for Processing

• Contract performance: processing account data, uploaded content and generated outputs is necessary to deliver the Service you signed up for.
• Legitimate interests: we process usage data, audit logs and advertising measurement data to secure the Service, prevent fraud, improve the Service and understand which of our marketing works. These interests do not override your privacy rights, and you can opt out of advertising measurement.
• Legal obligation: we keep certain records to comply with law, such as tax records for billing data.
• Consent: where we rely on consent, such as push notifications or optional marketing email, you may withdraw it at any time without affecting earlier processing.

5. How We Share Your Information

5.1 Service Providers

We share personal information with the service providers below, only as needed to run the Service. They process it on our behalf under contractual data protection obligations. Our Subprocessor List gives more detail.

We send content to AI providers only through their business programming interfaces (APIs), and we review each provider's terms on how it may use that content. Capstone does not use your content to train any model, and does not share one company's content with another.

5.2 Advertising and Referral Partners

As described in Section 2.9, we share limited sign-up and subscription information with OpenAI for advertising measurement and with Rewardful for affiliate referrals. Neither receives your uploaded content or generated outputs for these purposes, and we do not give them lists of our customers for targeting.

5.3 Integrations You Connect

If you connect a third-party service to your account, such as an applicant tracking or scheduling tool, we exchange data with that service as you direct. Its own privacy policy applies to the data it holds.

5.4 Legal Requirements

We may disclose information if required by law, court order or legal process, or to protect the rights, property or safety of Capstone, our customers or others.

5.5 Business Transfers

If Capstone is acquired, merges or transfers substantially all of its assets, customer data may transfer to the acquirer. We will notify you before such a transfer and give you the option to delete your data.

5.6 With Your Consent

We may share data in other ways if you give us explicit consent.

We do not sell, rent or trade your personal information for money.

6. Retention

We keep personal information while your account is active and as needed to provide the Service, comply with legal obligations and resolve disputes.

7. Your Rights and Choices

Depending on where you live, you may have the following rights. We offer them to all users.

Access. You may request a copy of the personal information we hold about you.

Correction. You may correct inaccurate or incomplete information. Most account data can be changed directly in Settings.

Deletion. You can delete your account yourself: on the web in Settings, Account; in the mobile app under More, Delete account; or at app.deployready.app/#/account/delete. A team member can delete their own login, and the company owner can close the whole company account. We email you a link to confirm the request. Once you confirm, the deletion is completed 30 days later, and you can cancel it any time before then. If you are closing the company account, your subscription also stops renewing as soon as you confirm. You can also email privacy@capstonehorizon.com. Some records are kept after deletion, as listed in Section 6.

Portability. You may request an export of your data in a machine-readable format by emailing privacy@capstonehorizon.com.

Opt out of advertising measurement. In the web application, go to Settings, Account and turn off "Allow advertising measurement." We then stop sending your sign-up and subscription events to our advertising partner, and the measurement pixel stops loading in that browser. Browsers that send the Global Privacy Control signal are opted out automatically. You can also email privacy@capstonehorizon.com with the subject "Advertising opt-out" and we will turn it off for you.

Notifications and email. You can turn push notifications off at any time. Our digest and alert emails include an unsubscribe link.

Withdraw consent. Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that happened before.

To exercise any right, email privacy@capstonehorizon.com. We will respond within 30 days and may need to verify your identity first.

8. California Residents

If you are a California resident, the California Consumer Privacy Act (CCPA) gives you these rights:

• Right to know: the categories and specific pieces of personal information we collected about you, its sources, why we collected it, and the categories of third parties we share it with. Sections 2 and 5 describe these.
• Right to delete personal information we collected from you, subject to legal exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing: we do not sell personal information for money. Sharing sign-up information with our advertising partner (Section 2.9) may count as "sharing" for cross-context behavioral advertising under California law. You can opt out in Settings, Account, or by using Global Privacy Control, as described in Section 7.
• Right to non-discrimination for exercising these rights.

To submit a request, email privacy@capstonehorizon.com with the subject "CCPA Request." We will respond within 45 days, which may be extended by another 45 days with notice. You may use an authorized agent; we will verify the agent's authority.

9. Children

DeployReady is for businesses and professionals. It is not directed to anyone under 13, and we do not knowingly collect personal information from children under 13. If we learn that we have, we will delete it promptly. Contact privacy@capstonehorizon.com if you believe we hold information from a child.

10. Security

We protect personal information with technical and organizational measures, including encryption in transit (HTTPS only) and at rest, separation of each company's data, scrypt password hashing, optional two-factor sign-in and audit logging. Our Trust Center describes these measures in more detail. No security measure is perfect, but we will notify you promptly if we confirm a breach affecting your data.

11. Where Your Data Is Stored

Our application and database are hosted by Railway in the United States (US West region). Uploaded files are stored with Cloudflare R2 in its Western North America region. Our AI, payment, email and push notification providers are United States companies. Plausible, our analytics provider, is based in the European Union, and Fontshare, one of our font providers, is based in India; both receive only the page-load information described in Section 2.9. If we change where customer data is stored, we will update this policy and give notice as required by law.

12. Changes to This Policy

We may update this Privacy Policy. For material changes, we will give at least 30 days' notice by email and on this page. The version and "Last updated" date at the top show the current version. Continuing to use the Service after the notice period means you accept the change.

13. Contact

For privacy requests, questions or concerns:

Capstone Horizon LLC
Attn: Privacy
5110 W Jeffrey Rd
Tucson, AZ 85757
privacy@capstonehorizon.com

Changes in Version 1.2.0 (October 2, 2026)

• Added the DeployReady mobile app (Section 2.8) and push notifications.
• Described self-service account deletion and the 30-day timeline (Section 7).
• Disclosed advertising measurement with OpenAI and affiliate referrals with Rewardful, with an opt-out (Sections 2.9, 5.2, 7, 8).
• Listed every service provider that handles your data, including Cloudflare, Perplexity, Expo and our font providers (Section 5.1).
• Described sign-in records and the security audit log as they are actually kept (Sections 2.6 and 6).
• Corrected where data is stored (Section 11) and updated our legal address and web addresses (Sections 1 and 13).
• Clarified retention: solicitation data is kept for the life of the account rather than 12 months, and added push tokens, E-Verify and screening records (Section 6).

Version 1.0.0 was effective April 22, 2026.