This policy explains what Shell Key Bid Board collects, why, and what happens to it. Plain language on purpose.
What we collect
- Account: your name, company name, email address, and a hashed password (we cannot see your password).
- Company profile: the business details you enter for bid forms and scoring: address, phone, license number, signer name and title, bonding limits, parishes, competitors, and your logo.
- Vault documents: files you upload (licenses, insurance certificates, bonding letters, and similar) and the expiration dates you set.
- Decisions: your go / watch / no-go choices and the reasons you type.
- Billing: your PayPal subscription ID, status, and next billing date. We never receive or store card numbers; PayPal handles payment.
- Technical: a session cookie so you stay signed in, and standard server logs (IP address, browser, pages requested) kept by Cloudflare for security.
We do not collect Social Security numbers, EINs, bank account numbers, or personal financial data, and you should not upload them. Financial statements should be uploaded only when a solicitation requires them.
How we use it
To run the Service: score postings against your profile, prefill documents, track expirations, remember your decisions, bill your subscription, send you account emails (welcome, billing date, cancellation confirmation), and respond to support requests. We may use anonymized, aggregated usage to improve the Service. We do not sell or rent your information, and we do not use your documents to train any model.
Who can see it
- You, through your login.
- Shell Key, only as needed for support or to operate the Service.
- Service providers that store or move data for us: Cloudflare (hosting and file storage, United States), PayPal (payments), and our email provider (account emails). Each is bound by its own privacy terms.
- Legal requests, if required by law or to protect the Service and its users.
Other subscribers cannot see your profile, documents, or decisions. Public bid data shown in the Service (bidders, amounts, awards) is already public record from the issuing agencies.
Where it lives and how it's protected
Data is stored on Cloudflare infrastructure in the United States. Uploaded documents are encrypted at rest. Passwords are stored as salted hashes. Connections use HTTPS. No system is perfectly secure; if we learn of a breach affecting your data, we will notify you at the email on your account.
How long we keep it
For as long as your account exists. When you complete cancellation (request plus email confirmation), your account, profile, vault documents, and decisions are permanently deleted. One thing is intentionally kept: a one-way hash of the account email and of the PayPal payer identifier, with the date. It cannot be reversed into your email address and is used only to apply the "$75 introductory month, once per company" rule and to prevent repeat-signup abuse. Billing records are retained by PayPal and in our accounting records as required by law. Server logs are kept by Cloudflare for a limited period for security.
Cookies
One cookie: a signed session cookie that keeps you signed in for up to 90 days. No advertising or tracking cookies. PayPal sets its own cookies during checkout.
We send account emails only: welcome, subscription confirmation with your billing date, cancellation confirmation, and replies to your support requests. We do not send marketing email to subscribers without a separate opt-in.
Your choices
- Edit or remove anything in your profile and vault at any time from Company profile.
- Request a copy of your data, or its deletion, by emailing support@shellkey.company from the address on your account. We respond within 30 days.
- Cancel your subscription from Company profile; that deletes your account.
Children
The Service is for businesses and is not directed to anyone under 18.
Changes
If we change this policy in a material way, we will email you before the change takes effect.
Contact
Shell Key LLC · Lafayette, Louisiana · support@shellkey.company