Privacy Policy

When you create an account we collect your name, email address, organization name, and authentication credentials (handled through our authentication provider; we do not store your password). If you join an existing workspace by invitation we collect the same information at acceptance.

Slick RFP processes content you or your teammates send to it, including:

• Inbound emails forwarded to your workspace inbox, including the body, headers, and attachments;
• Manually entered opportunity briefs, comments, and notes;
• Workspace configuration such as your destination profile, inventory listings, scoring criteria, and glossary;
• Outputs generated by the Service in response to your content (extractions, scores, summaries, recommended actions).

Workspace content is stored on our behalf and used to provide the Service to your workspace. It is not shared with other customers and is not used to train any AI model.

We collect technical information automatically when you use the Service, including IP address, browser and device type, pages visited, timestamps, and product events (e.g. an opportunity was created, a score was run). This data is used for operating, securing, debugging, and improving the Service.

If you subscribe to a paid plan, billing details (card number, billing address, tax identifiers) are collected and stored by our payment processor, Stripe. We receive limited information from Stripe such as the last four digits of your card, billing country, and subscription status.

We use a small number of strictly necessary cookies to keep you signed in and to remember your workspace selection. We do not currently use third-party advertising cookies on the Service.

Workspace content is visible to other members of your workspace according to their role. Workspace owners and admins can see all opportunities and configuration in the workspace.

We rely on third-party service providers (“subprocessors”) to operate the Service. We engage providers in the following categories, each bound by contract to handle your data only to provide their service to us and to protect it appropriately:

• Cloud hosting and content delivery — running the Service and serving the website.
• Database and authentication— managed PostgreSQL and identity infrastructure.
• File storage— storage of email attachments and other workspace files.
• Email delivery— inbound email receipt and transactional email delivery.
• Payment processing— subscription billing and tax handling.
• AI processing— large-language-model inference for extraction, scoring, and summarization. Our AI providers are contractually prohibited from using content we transmit to train their models.
• Operational tooling— logging, error reporting, analytics, and customer support tools limited to the data needed to operate the Service.

A current list of named subprocessors is available to customers on request. We may add or change subprocessors as the Service evolves and will, where required, notify workspaces.

We may disclose information when we believe in good faith that disclosure is required by law, to comply with valid legal process, to protect the rights, property, or safety of Search Party, our users, or the public, or to enforce our Terms of Service.

If Heave LLC is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you (e.g. by email and a prominent notice on the Service) before your information becomes subject to a different privacy policy.

California residents have the right to request that we disclose what personal information we collect, use, and share, the right to request deletion of personal information, the right to correct inaccurate personal information, and the right not to be discriminated against for exercising these rights. We do not sell personal information and do not share it for cross-context behavioral advertising.

To exercise a right, email privacy@slickrfp.com. We will verify your request and respond within the timeframe required by law. You may designate an authorized agent to make a request on your behalf.

If you have privacy rights under another applicable law (for example, GDPR), you may contact us at the address above to exercise them. We will treat such requests consistently with the applicable law.

For most workspace content, our customer (the workspace owner) is the controller of the data and we are the processor. Requests from individual end users about workspace content should generally be directed to the workspace owner; we will assist as required by our agreement with the customer.