Privacy Policy

This Privacy Policy describes how Armada Cyber Defense LLC ("Armada", "we", "us") collects, uses, stores, processes, shares, and protects information in connection with Sam Submit (the "Service"). It applies when you visit samsubmit.com, create or use a Sam Submit account, work inside an organization or team workspace, search or import federal opportunities, import company information, upload solicitations and attachments, create Capability Statements, generate or edit solicitation responses, use AI assisted analysis or drafting, use the CRM, create response or submission packages, use submission related features, contact support, or use other Sam Submit functionality.

Capability Statement generation is one component of Sam Submit, alongside solicitation analysis, response generation, compliance checking, Win Strategy analysis, packaging, and pursuit tracking.

The Service is intended primarily for business use by government contractors and small businesses. It is not directed to children under 13 and we do not knowingly collect information from them. If we learn that we have collected information from a child under 13, we will delete it.

Account and organization information. Name, business email address, organization or company name, job title or role, authentication identifiers, organization membership, assigned role and permissions, and subscription information. We verify accounts by email and generally restrict sign up to business domains.

Business profile information. Legal company name, DBA, UEI, CAGE, NAICS and PSC codes, certifications and socioeconomic designations, capabilities, differentiators, points of contact, office locations, geographic coverage, past performance, contract vehicles, logos, images, and other company information you enter or import.

Solicitations and procurement information. SAM.gov notices, solicitations, amendments, attachments, statements of work, performance work statements, instructions, evaluation criteria, forms, pricing related information you enter, and other procurement documents you provide or import.

Response and proposal content. Draft responses, proposal sections, answers, requirement registers, compliance findings, pricing information you enter, uploaded supporting documents, generated documents, Capability Statements, submission packages, saved versions and revisions, your edits, submission instructions, and submission records.

CRM information. Business organizations and contacts, names, business email addresses, business phone numbers, titles, agencies, contracting contacts, opportunity and pursuit information, notes, tasks, activities, activity and communication metadata such as whether and when a contact replied, and recorded outcomes.

Communications. Messages you send through contact, support, and feature request forms, which may be routed through a third party form provider.

At your instruction the Service retrieves records from public and Government sources, keyed to identifiers you supply. These currently include SAM.gov, the SBA Dynamic Small Business Search (DSBS), and USASpending.gov. The Service also accepts CPARS evaluation exports that you download yourself and upload.

Sam Submit does not ask for and does not accept your CPARS or Login.gov credentials, passwords, session cookies, or multi factor codes. You sign in to CPARS directly, outside the Service, and upload the report you are authorized to access.

Publicly available information can still constitute personal or business information, and we process it as part of providing the Service. You are responsible for having the authority to upload or import any nonpublic information into Sam Submit.

When you use the Service we collect IP address, browser and device information, timestamps, login and session events, feature usage, AI operations and their token measurements, download events, error diagnostics, security events, and organization activity and audit records such as who performed a download, an AI run, an invitation, a role change, or a member removal.

We use this information to operate the Service, secure it, troubleshoot problems, enforce plan limits and per account usage caps, prevent fraud and abuse, monitor performance, and improve the product. We do not operate advertising networks on the Service.

Subscription payments are processed by Stripe. Stripe collects and processes payment card information directly. Armada does not receive or store full payment card numbers.

Sam Submit retains subscription plan, subscription status, transaction and invoice identifiers, billing history, and usage and entitlement information associated with your organization. Stripe processes payment data under its own privacy practices, which we do not control.

When you invoke AI assisted functionality, relevant information is transmitted to the configured AI provider so the requested operation can be performed. Depending on the feature this may include portions of your company profile, the solicitation and its attachments, amendments, the response or proposal text, extracted requirements, compliance information, pursuit information where the feature requires it, and the instructions you supply.

Sam Submit's AI features are performed through commercial model provider APIs. The platform default is OpenAI. An Anthropic pathway is also supported in the codebase and is used only when an Anthropic key is configured for the deployment or account. Organizations and individual users may configure their own provider API key in Account settings; when they do, requests run through that key, and the data sent is also subject to that provider account's terms and settings.

We do not use your proposal, response, or business content to train Armada's own general purpose AI models. Model providers process content under their own API terms, which you should review for the provider your organization uses. We do not make a blanket representation about every provider's training practices.

AI output is generated content and a drafting aid. Review every claim, figure, certification, and past performance statement before using or submitting it.

Sam Submit is a commercial service. It has not been authorized or accredited to receive, process, or store restricted Government information. You must not upload, enter, transmit, or process through the Service:

classified information; Controlled Unclassified Information (CUI); export controlled technical data; ITAR controlled information; information subject to Government handling restrictions the Service is not authorized to process; passwords or Government authentication credentials; or any other restricted information the Service is not expressly authorized to handle.

The fact that Sam Submit can analyze a public Government solicitation does not mean it is authorized to receive restricted Government information. Armada does not claim FedRAMP, CMMC, FISMA, NIST, DoD, or other Government authorization or certification for the Service.

We use information to provide and maintain Sam Submit; authenticate users; maintain organization and team workspaces; import and analyze opportunities; analyze solicitations and attachments; generate and tailor responses; generate Capability Statements; perform compliance and readiness analysis; operate Win Strategy functionality; maintain CRM and pursuit information; create response packages; support authorized submission related functions; provide external CRM synchronization when you configure it; process subscriptions; enforce plan limits and usage caps; provide customer support; deliver transactional communications; maintain security; prevent fraud and abuse; troubleshoot errors; monitor performance; improve features and reliability; maintain records; and comply with legal obligations.

A Sam Submit organization may include multiple authorized users. Information stored in an organization workspace, including company profile data, solicitations, responses, packages, CRM records, and usage records, may be accessible to other authorized members of that organization according to their assigned permissions.

Organization administrators may invite and remove members, assign and change roles, control what each role can view, download, edit, or manage, access organization workspace information, view usage and activity records, transfer the Primary Admin role, and manage applicable account and billing settings.

Information you enter into a company workspace is not necessarily private from your organization's administrators or from other appropriately authorized members.

If you or your organization connect an external service such as HubSpot, Salesforce, Zoho CRM, Microsoft 365, or an outbound webhook endpoint, Sam Submit transmits selected pursuit and response information to that service at your direction. This synchronization is outbound: Sam Submit sends pursuit and status events to the connected system and does not import records or replies back from it.

Credentials you supply for these integrations are encrypted before storage and are not returned to the browser. Once information reaches a third party account you selected, that provider's terms and privacy practices also govern its processing. You are responsible for having the authority to connect the account and to transmit the information.

Sam Submit performs submission actions only where the feature supports it, principally emailing a response or package to a recipient you specify through our managed email delivery provider, and sharing a package through an expiring download link.

Many federal submissions occur outside Sam Submit in Government systems such as SAM.gov, PIEE, DIBBS, GSA eBuy, or agency specific portals. In those cases the Service provides instructions and records what you confirm; you complete the submission in the external system. Those Government sites operate under their own privacy and security policies.

We retain submission related records such as the submission method and channel, the recipient or destination, the timestamp, the response or package identifier, submission status, confirmation or reference information you enter, and which user performed or confirmed the action. A record that a message was sent or that you confirmed an external submission is not verification that a Government office received or accepted it.

We do not sell personal information, and we do not share personal information for cross context behavioral advertising.

We share information with service providers who process it on our behalf, in the categories of cloud hosting and infrastructure, database and file storage, authentication, payment processing, AI model providers, PDF and document rendering, email delivery, form and support handling, error and performance monitoring, and integrations you configure yourself. Providers receive only the information reasonably necessary for their function, subject to applicable agreements and safeguards.

We may also disclose information to comply with legal obligations or valid legal process, to investigate fraud or security incidents, to protect the rights, property, or safety of Armada, our customers, or others, to enforce our agreements, and in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets.

The Service relies on third party service providers acting as subprocessors in the categories described above. We do not currently publish a standing subprocessor page. You may request current subprocessor information at contact@armadacyberdefense.us. We do not commit to advance notice of every subprocessor change.

We maintain administrative, technical, and organizational safeguards designed to protect information. These currently include encryption in transit, encrypted storage of API keys and integration credentials on the server, private file storage with signed, expiring URLs for shared files and package downloads, organization scoped tenant isolation enforced by row level security in the database, server side authorization in authenticated server functions, role based access control inside organizations, restricted use of privileged service credentials, and audit and activity logging of downloads, AI runs, and administrative actions.

No Internet based service can guarantee absolute security. If you believe your account has been compromised, contact us immediately at contact@armadacyberdefense.us.

Subject to the Terms of Use, you retain your rights in the business information, solicitation materials, proposal and response content, documents, and other content you provide to the Service. Armada receives the limited rights necessary to host, process, transmit, analyze, render, store, and otherwise use that content to provide, secure, support, and maintain the Service. Armada does not claim ownership of your proposal content because the Service processed or generated a draft of it.

We retain account, workspace, profile, solicitation, response, document, package, submission, and CRM content for as long as the account or organization workspace is active, and afterward only as long as needed for the purposes described here. We have not established fixed retention periods for every category of content, so we determine retention using these criteria: providing the Service, account recovery, contractual requirements, security and abuse prevention, dispute resolution, legal obligations, tax and accounting obligations, and the lifecycle of routine infrastructure backups.

Two periods are set in the product itself: package share links expire 30 days after creation, and usage and token measurements are recorded per monthly billing period. Billing and tax records are retained as required by law. Security, audit, and activity records are retained to support investigation and accountability.

Deletion requests may be subject to legal, security, fraud prevention, backup, and record retention exceptions. Content may persist in routine backups for a period after deletion from the live Service.

An organization administrator can remove an individual member from the team page, which revokes that person's access to the workspace immediately. Removing a member does not delete the organization's shared content, because that content belongs to the organization rather than to the individual.

To request deletion of your individual account and associated personal information, or deletion of an entire organization workspace and its content, email contact@armadacyberdefense.us. A request to delete an organization workspace must come from an authorized administrator of that organization. We verify the requester's identity and authority before acting. Some records, such as billing and tax records and security logs, may be retained where legally or operationally required.

Where applicable law provides these rights, you may request access to your personal information, correction of inaccurate information, deletion, portability, restriction of processing, objection to processing, withdrawal of consent where processing relies on consent, and appeal of a decision on your request. Rights vary by jurisdiction and not every law applies to every user or to Armada.

We do not sell personal information and we do not engage in targeted advertising, so opt out rights of that kind have nothing to apply to on this Service. You can edit most profile data directly in the Workspace, manage billing through the Stripe customer portal, and unsubscribe from non transactional email using the link in those messages. To exercise any other right, email contact@armadacyberdefense.us. We may need to verify your identity or authority before responding, and we will respond within the time required by applicable law.

The Service processes professional and business contact information that users enter or that is obtained from public Government and business sources, including agency and contracting contact records used in the CRM and in pursuit tracking.

If you use the CRM, you are responsible for ensuring that your collection, use, outreach, and communications comply with applicable laws, agency rules, and your contractual obligations. Armada does not authorize or endorse contact with any Government official or other individual on your behalf.

We use cookies and browser storage that are essential to the Service: authentication and session storage, preference storage such as your theme and interface mode, and temporary editor state so unsaved work is not lost. Stripe may set cookies or device identifiers when you interact with payment flows, for payment processing and fraud detection.

We do not run advertising networks and we do not use advertising cookies. The application also reports client side errors and performance diagnostics to our hosting and monitoring platform so we can detect and fix failures. See our Cookie Policy for more detail.

Transactional email. We send service email that is necessary to operate your account, including email verification and authentication, password and email change notices, team invitations, security and account notifications, submission and package delivery messages, calendar and due date reminders you enable, usage alerts, and service notices. You cannot opt out of essential service and security email while continuing to use the Service, although you can disable optional reminders in the features that offer them.

Non transactional email. Any product or marketing email includes an unsubscribe link, and unsubscribing does not affect your access to the Service.

The Service is operated from the United States, and information is processed in the United States and in other locations where our service providers operate. If you access the Service from outside the United States, your information will be transferred to and processed in the United States, where privacy laws may differ from those in your jurisdiction. Where applicable law requires a specific transfer mechanism, we rely on the mechanism appropriate to that transfer rather than on this Policy alone.

We do not sell personal information, we do not use your proposal or business content for targeted advertising, and we do not operate advertising technology on the Service. Because we do not track users across third party sites for advertising, the Service does not currently respond to browser Do Not Track signals.

We may preserve or disclose information when we reasonably believe it is necessary to comply with applicable law, to respond to a valid subpoena, court order, or other legal process, to investigate fraud or abuse, to protect Sam Submit, Armada, our customers, or others, or to enforce our agreements. Where we are permitted to notify a customer of a legal request, we will make reasonable efforts to do so, but law or legal process may prohibit notification.

If Armada is involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar corporate transaction, information may be transferred as part of that transaction. Personal information remains subject to the privacy commitments in this Policy unless you are notified otherwise as required by law.

We may update this Policy from time to time and will revise the effective date above. For material changes we will provide notice through the Service, by email, or by another reasonable method as appropriate. Where applicable law requires affirmative consent for a change in practices, we will obtain that consent rather than rely on your continued use.

Armada Cyber Defense LLC
Miami-Dade County, FL
Privacy and general contact: contact@armadacyberdefense.us
Support: support@armadacyberdefense.us
Phone: (305) 306-1800

Sam Submit is a private commercial service operated by Armada Cyber Defense LLC. It is not affiliated with, endorsed by, or acting on behalf of SAM.gov, the Small Business Administration (SBA), the Department of Defense (DoD), the General Services Administration (GSA), APEX Accelerators, Florida International University (FIU), the Small Business Development Center (SBDC), or any other Government entity or their stakeholders.