Privacy Policy

Effective Date: January 1, 2026

This Privacy Policy describes how Graphspan LLC ("we," "our," or "us") collects, uses, and shares information when you use the SBIRLY platform and services (the "Services"). By using our Services, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

1.1 Information You Provide

• Account information (name, email, password, company details)
• Phone number (for SMS-based multi-factor authentication and optional SMS communications)
• Payment information (processed securely through Stripe)
• Search queries and saved searches
• Communication preferences, including SMS opt-in selections
• Feedback and correspondence

1.2 Information We Collect Automatically

• Usage data (features accessed, search patterns, time spent)
• Device information (browser type, IP address, operating system)
• Cookies and similar tracking technologies
• Log data and analytics

2. How We Use Your Information

• To provide, maintain, and improve our Services
• To process transactions and send related information
• To send you technical notices and support messages
• To respond to your comments and questions
• To analyze usage patterns and optimize user experience
• To detect, prevent, and address technical issues
• To comply with legal obligations

3. Information Sharing and Disclosure

We do not sell, trade, or rent your personal information. We may share your information in the following circumstances:

• Service Providers: With trusted third parties who assist us in operating our Services (e.g., Stripe for payment processing, AWS for hosting)
• Legal Requirements: If required by law or in response to valid legal requests
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• Consent: With your explicit consent

4. Profile Visibility and Company-to-Company Contact

SBIRLY offers an optional "Profile Visibility" feature that allows you to make certain company and innovation profile information visible to other authenticated users of the platform, including venture capital firms, large government contractors, and other SBIR/STTR companies. By enabling Profile Visibility, you acknowledge and agree to the following:

4.1 Information Shared When Profile Visibility Is Enabled

When you enable Profile Visibility, the following information from your Innovation Profile may be visible to other authenticated platform users:

• Company name, location (city, state), and company stage
• Primary and secondary technology areas
• Innovation description and unique value proposition
• Key technical keywords and target markets
• Preferred agencies, phases, and DoW technology areas
• Technology readiness level (TRL)
• Small business certifications and status codes
• Company contact name (if provided)
• Sales materials URL (if provided)

Your account credentials (email, password), payment information, search history, saved reports, TPOC matching results, and other non-profile data are never shared through Profile Visibility.

4.2 Consent to Profile Visibility

Profile Visibility is entirely opt-in. You must explicitly accept the Terms of Agreement and Privacy Policy and enable at least one visibility toggle (VC Firms & Large Contractors, or Other SBIR/STTR Companies) before your profile becomes visible. You may disable Profile Visibility at any time through your Innovation Profile settings, and your profile will be immediately removed from Company Profiles search results.

4.3 No Vetting or Endorsement of Third Parties

4.4 Limitation of Liability for Profile Visibility

5. Data Security

We implement industry-standard security measures to protect your information, including:

• SSL encryption for data transmission
• Encrypted storage of sensitive information
• Regular security audits and updates
• Limited access to personal information by authorized personnel only

6. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to:

• Essential Cookies: Required for the Services to function properly
• Analytics Cookies: Help us understand how users interact with our Services
• Preference Cookies: Remember your settings and preferences

You can control cookies through your browser settings. Note that disabling certain cookies may impact the functionality of our Services.

6.1 Google Analytics

We use Google Analytics, a web analytics service provided by Google LLC ("Google"), to help us understand how users interact with the SBIRLY platform. Google Analytics collects the following types of information through cookies and similar technologies:

• Pages visited and navigation paths within the platform
• Time spent on each page and session duration
• Bounce rate and user flow between pages
• Anonymized IP address (IP anonymization is enabled)
• Browser type, operating system, and device information
• Referring website or source of traffic
• Geographic location (country/region level only)

Google Analytics uses first-party cookies to track user interactions. The information generated by these cookies is transmitted to and stored by Google on servers in the United States. Google may use this information to evaluate your use of the platform, compile reports on website activity for us, and provide other services relating to website activity and internet usage. Google may also transfer this information to third parties where required by law or where such third parties process information on Google's behalf.

We use Google Analytics data solely for the purpose of improving our Services, understanding user behavior, and optimizing the user experience. We do not combine Google Analytics data with personally identifiable information.

7. Your Rights and Choices

• Access and Update: You can access and update your account information at any time
• Rectification: You have the right to correct inaccurate or incomplete personal data
• Delete: You may request deletion of your account and associated data
• Opt-out: You can opt-out of marketing communications, including SMS, by replying STOP to any message, updating preferences in your Account Settings, or contacting support@sbirly.com
• Cookies: You can manage cookie preferences through your browser settings
• Object: You have the right to object to certain types of processing
• Restrict: You can request that we restrict processing of your data in certain circumstances
• Complaint: You have the right to lodge a complaint with a supervisory authority if you believe we have not complied with applicable data protection laws

8. Data Retention

We retain your information for as long as necessary to provide our Services and comply with legal obligations. Specifically:

• Account Information: Retained while your account is active plus 30 days
• Usage Data: Retained for up to 2 years for analytics purposes
• Payment Records: Retained for 7 years for tax and accounting purposes
• Communications: Retained for 2 years or as required by law

When you delete your account, we will delete or anonymize your personal information within 30 days, except where retention is required by law.

9. Data Minimization

We follow the principle of data minimization, only collecting and processing personal data that is necessary for the purposes outlined in this policy. We regularly review our data collection practices to ensure we are not collecting excessive information.

10. Children's Privacy

Our Services are not directed to individuals under 18. We do not knowingly collect personal information from children under 18.

11. International Data Transfers

Your information may be transferred to and processed in the United States. We ensure appropriate safeguards are in place for international data transfers, including:

• Standard contractual clauses approved by regulatory authorities
• Ensuring recipients maintain adequate security measures
• Only transferring data to countries with adequate data protection laws or with appropriate safeguards

By using our Services, you acknowledge and consent to such transfer and processing.

12. State Privacy Rights

California (CCPA/CPRA)

California residents have specific rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including:

• The right to know what personal information we collect, use, and share
• The right to delete personal information we hold about you
• The right to opt-out of the sale of personal information (we do not sell your data)
• The right to correct inaccurate personal information
• The right to limit use of sensitive personal information
• The right to non-discrimination for exercising your privacy rights

Other State Privacy Laws

Residents of Virginia, Colorado, Connecticut, and Utah have similar rights under their respective state privacy laws. These rights generally include access, deletion, correction, and portability of personal data, as well as the right to opt-out of certain data processing activities.

To exercise any state privacy rights, contact us at support@sbirly.com.

13. Do Not Track Signals

We do not currently respond to Do Not Track (DNT) signals. However, you can manage your privacy preferences through your browser settings and our cookie management options.

14. Third-Party Links

Our Services may contain links to third-party websites. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies before providing any personal information.

15. Data Breach Notification

In the event of a data breach that may compromise your personal information, we will make reasonable efforts to notify affected users as soon as reasonably practicable via email and/or by posting a notice on our website, subject to law enforcement or national security requirements and our ability to determine contact information. We disclaim any liability for delays in notification due to circumstances beyond our reasonable control, including but not limited to technical failures, force majeure events, or legal restrictions.

16. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), we process your personal data based on the following legal grounds:

• Contract: To perform our contract with you when providing Services
• Legitimate Interests: To improve our Services and communicate with you
• Consent: For marketing communications where required
• Legal Obligation: To comply with applicable laws

17. Data Protection Officer

For privacy-related inquiries, you may contact our Data Protection Officer at: privacy@sbirly.com

18. Automated Decision-Making

SBIRLY uses AI and automated systems to analyze SBIR data and provide matching recommendations. These systems do not make decisions with legal or similarly significant effects. You can request human review of any recommendations by contacting our support team.

19. Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format. You may also request that we transfer this data directly to another service provider where technically feasible. To request data portability, contact us at support@sbirly.com.

20. Marketing Communications

We may send you promotional emails or SMS messages about new features, special offers, or other information we think you may find interesting. You can opt-out of these communications at any time by:

• Clicking the "unsubscribe" link in any promotional email
• Replying STOP to any SMS message
• Updating your communication preferences in your Account Settings
• Contacting us at support@sbirly.com

21. SMS Communications

SBIRLY (a product of Graphspan LLC) may send you SMS text messages if you opt in. By providing your phone number, you agree to receive SMS messages from SBIRLY (a product of Graphspan LLC), including account notifications and authentication codes. Message frequency varies. Message and data rates may apply. Reply STOP to opt out, HELP for help. Reply HELP for assistance or contact support@sbirly.com for additional support. We offer the following types of SMS communications:

• Multi-Factor Authentication (MFA): One-time verification codes sent during login when you have enrolled in SMS-based MFA through your account security settings.
• Account Alerts: Important notifications about your account, including password changes, subscription issues, and security alerts.
• Marketing Announcements: New features, product updates, and special offers (requires separate opt-in consent).

SMS consent is collected separately for each message type. You may opt in or out of individual categories at any time through your Account Settings. Consent to receive SMS messages is not a condition of purchasing any product or service from SBIRLY.

Message frequency varies by category. Message and data rates may apply. You can opt out of SMS messages at any time by:

• Replying STOP to any SMS message
• Updating your SMS preferences in your Account Settings
• Contacting us at support@sbirly.com

Reply HELP to any SMS message for assistance.

22. Lawful Basis for Processing

We will only collect and process personal data about you where we have a lawful basis. Lawful bases include consent (where you have given consent), contract (where processing is necessary for the performance of a contract with you), and legitimate interests (where processing is necessary for our legitimate interests and not overridden by your rights).

23. Business Accounts

If you use our Services through a business account provided by your employer or organization:

• Your organization's administrator may have access to your account information and usage data
• Your organization may have additional policies regarding data use and retention
• Your use of the Services may be subject to your organization's terms and policies
• If your organization's subscription ends, your access to the Services and associated data may be terminated

24. Accessibility

We are committed to ensuring this Privacy Policy is accessible to individuals with disabilities. If you need this policy in an alternative format, please contact us at support@sbirly.com.

25. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the effective date.

26. Limitations and Force Majeure

27. Contact Us

If you have questions about this Privacy Policy, please contact us at: