This Privacy Policy explains what information the National Association of Building & Engineering Services ("NABES", "we", "us") collects through nabes.org (the "Site"), how we use and share it, and the choices you have. It applies to visitors, people who contact firms through the Site, and the businesses and people who manage listings.

1. Information we collect

Business information from public records. Listings are built from public sources such as SAM.gov, USAspending.gov and state and local procurement records: a business's name, Unique Entity ID, CAGE code, address, industry codes, business certifications and public contract awards. We may also collect business contact details (such as a main phone number or general email address) that a firm publishes on its own website. We use these only to contact the firm, and we never publish them.

Information you give us.

• Account and listing details: your name, title, work email, phone number and company website, and the listing information you add (capabilities, specialties, service area, description, photos and videos).
• Messages to firms: your name, company, email and message when you use "Contact this firm".
• Requests: listing requests, removal requests, intro video requests and requests from primes, with the details you include.
• Payments: memberships and the Federal Registration Service are paid through Stripe. Stripe collects your card details; we never see or store your full card number. We receive the billing email, a customer reference and the status of your subscription or payment.

Information collected automatically.

• Your IP address, used to limit abuse (rate limits) and, for messages and requests, to help us screen for spam.
• Cookies: a sign-in cookie if you sign in, a short-lived cookie (about six hours) showing you passed our bot check, and cookies set by the services below.
• Bot protection: Cloudflare Turnstile checks that visitors are people when you search or submit a form. Cloudflare processes information about your browser and device to do this.
• Analytics: we use Google Analytics to understand how the Site is used, such as pages viewed and actions like sending a message or signing up. Google sets its own cookies for this.
• Member badges: when a member's badge loads on a website, we record which website it appeared on, to confirm badges are shown only on members' own sites. We don't record who viewed it.

2. How we use information

• To build and display the directory and confirm that listings are managed by the right business.
• To pass your messages to the firm you contacted, after reviewing them for spam.
• To run accounts, memberships and the Federal Registration Service, including billing and service emails.
• To send the weekly solicitations email to firms that ask for it.
• To protect the Site from bots, scraping, fraud and abuse.
• To understand and improve the Site.
• To comply with the law and enforce our Terms of Use.

3. How we share information

We don't sell your personal information. We share it only:

• With the firm you contact: when we forward your message, the firm receives your name, company, email and message, and can reply to you directly.
• On public listings: listing information is public, as described above. Account holders' personal contact details aren't shown on listings.
• With service providers who run the Site for us: Google Cloud (hosting), Supabase (database), Stripe (payments), SendGrid (email), Cloudflare (bot protection), Redis (caching) and Google Analytics (analytics). They may use the information only to provide their services to us.
• For legal reasons: when required by law or to protect the rights, safety and security of NABES, our users or others.
• In a business transfer: if NABES is reorganized, merged or sold, information may transfer as part of that transaction.

4. Your choices

• Update your listing at any time by signing in.
• Ask us to remove a listing at nabes.org/remove.
• Stop the weekly solicitations email by unticking it on your listing, or by emailing us. Service emails, such as sign-in links and receipts, are part of using the Site.
• Ask us to access, correct or delete your personal information by emailing support@nabes.org. We'll respond within a reasonable time, and we may need to confirm your identity first.
• Limit cookies through your browser settings, and opt out of Google Analytics with Google's browser add-on.

5. How long we keep information

We keep account, listing and payment records for as long as the account or listing is active and as needed for legal, tax and accounting purposes. We keep messages and requests as long as needed to handle them and to review abuse. Business information from public records stays in the directory while the business remains listed.

6. Security

We protect information with encryption in transit, restricted access, secrets kept outside our code, and limits on automated access. No system is completely secure, so we can't guarantee absolute security.

7. Children

The Site is for businesses and isn't directed to children under 16. We don't knowingly collect information from children.

8. Where information is processed

The Site is operated in the United States, and information is stored and processed in the United States.

9. Changes to this policy

We may update this policy from time to time. We'll post the new version here with its effective date, and for material changes we'll give reasonable notice, such as by email to account holders.

10. Contact

Questions or requests about privacy: support@nabes.org.