Privacy Policy

Last updated: March 18, 2026 · Effective: March 18, 2026

1. Who We Are

RFPFill ("we", "us", "our") operates the RFPFill platform at rfpfill.com. We provide an AI-powered platform for automating RFP and security questionnaire responses.

For privacy-related questions, contact us at [email protected].

2. Data We Collect

Category	What we collect	Why
Account data	Name, email address, hashed password	To create and manage your account
Organisation data	Company name, industry, size, website, security practices	To personalise AI-generated responses
Uploaded documents	Files you upload (PDF, Word, Excel, CSV)	To parse questions and generate responses
Knowledge base content	Documents and answers you store in the knowledge base	To improve the accuracy of AI responses
Usage data	Pages visited, features used, actions taken	To improve the product and fix bugs
Billing data	Payment method details (handled by Stripe — we never see raw card numbers)	To process subscription payments

3. How We Use Your Data

We use your data to:

• Provide, maintain, and improve the Service
• Generate AI responses using your knowledge base and company profile
• Send transactional emails (verification, password reset, team invitations)
• Process payments and manage your subscription
• Respond to your support requests
• Detect and prevent fraud or abuse

We do not use your data to train AI models. Your documents and responses remain private to your organisation.

4. AI Processing

RFPFill uses Google's Gemini API to generate responses. When you process a questionnaire, the relevant content from your knowledge base is sent to Google's API to generate answers. This processing is governed by Google's data processing terms. We recommend reviewing Google's Privacy Policy.

We do not share your data with AI providers for training purposes.

5. Data Sharing

We do not sell your personal data. We share data only with:

• Stripe — for payment processing
• Google (Gemini API) — for AI response generation
• Resend — for sending transactional emails
• Railway — for hosting and infrastructure

All third-party providers are contractually required to protect your data and may only use it to provide services to us.

6. Data Retention

We retain your data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law.

Uploaded documents and questionnaire data are retained until you delete them or close your account.

7. Security

We protect your data using:

• Encrypted connections (HTTPS/TLS) for all data in transit
• Bcrypt hashing for passwords (never stored in plain text)
• JWT-based authentication with expiring tokens
• Role-based access control within organisations

No system is 100% secure. If you discover a security vulnerability, please contact us at [email protected].

8. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data ("right to be forgotten")
• Export your data in a portable format
• Object to or restrict certain processing

To exercise any of these rights, email [email protected]. We will respond within 30 days.

9. Cookies

RFPFill uses minimal cookies. For details, see our Cookie Policy.

10. Children's Privacy

The Service is not directed at children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with data, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or in-app notice. Continued use of the Service after changes constitutes acceptance of the updated policy.

12. Contact

For privacy questions or requests: [email protected]