Who is responsible
The controller of your personal data is Krystian Dorf, a private individual running PublicBeam, based in Iceland. Contact for anything about your data: contact@publicbeam.com or Help and support when signed in. The Icelandic Act No. 90/2018 on data protection, which applies the EU General Data Protection Regulation (GDPR), governs this processing.
What is kept, why and for how long
| Data | What exactly | Why (legal basis) | How long |
|---|---|---|---|
| Sign-in account | Your email address, when the account was created and last signed in, which version of the Terms you accepted at sign-up and when, and your sign-in sessions. | To create your account and sign you in (contract). | Until you delete your account. |
| Profile | The display name you choose (optional). | To show who did what in a shared workspace (contract). | Until you delete your account. |
| Company workspaces | Workspace names, members and their roles, and invitations. | To let a team share bid alerts (contract). | Until the workspace is deleted. Invitations expire after 14 days. |
| Bid alerts | The trade, NAICS codes and states you choose for your bid alerts, and which new bids were last checked for them. | To email you the new bids that match (contract). | Until you delete the alert or your account. |
| State launch requests | The launch states (Virginia, Georgia, Texas) you asked to hear about, when you asked and when we told you. | To email you once when that state’s bids are live (contract). | Until you delete your account. |
| Email alerts | Your alert frequency, the alerts queued for you and a record of each digest sent (time, number of alerts, delivery status). | To send the alerts you asked for (contract). | Queued alerts 90 days; digest records and unsubscribe links 180 days; settings until you delete your account. |
| Support messages | What you send through Help and support, with your email address and the page you came from. | To answer you (contract and legitimate interest). | Emailed to the support inbox, not kept in the PublicBeam database; deleted from the inbox 12 months after the request is closed. |
| Emails sent | Recipient, subject and delivery status of the emails PublicBeam sends (sign-in codes, alert digests). | To deliver email and detect delivery problems (legitimate interest). | Kept by the email provider under its log retention. |
| Security logs | Technical request data (IP address, time, page requested) handled by the hosting provider. | To keep the service secure and working (legitimate interest). | Under the hosting provider’s log retention; PublicBeam keeps no copy. |
| Visit statistics | Cloudflare Web Analytics counts page views without cookies. Google Analytics records the pages you view, the page you came from, browser, device, approximate location (from a shortened IP address) and a random visitor ID kept in a cookie. Neither is used for advertising; PublicBeam sees only reports. | To learn which pages help visitors and fix slow or confusing ones (legitimate interest). | Cloudflare keeps totals under its Web Analytics retention; Google Analytics keeps visit-level data 2 months. PublicBeam keeps no copy. |
| In your browser only | The old PublicBeam home page could keep a company profile, saved searches and notes in this browser (local storage). PublicBeam does not receive them unless you import them into a workspace. | Your own convenience. | Until you clear them or your browser data. |
“Contract” means the data is needed to provide the service you signed up for (GDPR Art. 6(1)(b)); “legitimate interest” means running the service securely and well (Art. 6(1)(f)).
People named in public procurement notices
PublicBeam shows notices published by official sources (in the United States: federal, state, county and city government buyers, for example on SAM.gov). A notice can name a buyer’s contact person, or a sole trader who won a contract, as the publisher made public. PublicBeam keeps this to make public procurement findable and traceable (legitimate interest), for as long as the notice is kept for search and history. If you are named in a notice and want your details removed from PublicBeam or object to their use, write to contact@publicbeam.com; you get an answer within one month. The official publication itself stays with its publisher.
Who processes it for PublicBeam
| Provider | What it does | Where and safeguards |
|---|---|---|
| Cloudflare, Inc. | Hosts the website, counts visits without cookies (Web Analytics) and, during the pilot, limits access to invited people (Cloudflare Access). | Global network; Cloudflare’s data processing addendum with standard contractual clauses and the EU–US Data Privacy Framework. |
| Google LLC | Counts visits with Google Analytics. | United States; Google’s data processing terms with standard contractual clauses and the EU–US Data Privacy Framework. |
| Supabase Pte. Ltd. | Database and sign-in accounts. | The database region chosen for the project; transfers under Supabase’s data processing addendum with standard contractual clauses. |
| Zoho Corporation B.V. (ZeptoMail) | Sends sign-in codes, alert digests and support messages. | Zoho’s EU data centre. Zoho staff in India may access it for support and debugging, and some of Zoho’s own service providers are outside the EEA; these transfers are covered by Zoho’s data processing addendum with the EU standard contractual clauses. |
Your data is not sold, not used for advertising and not shared with anyone else unless the law requires it.
Cookies
| Cookie | Purpose | Lifetime |
|---|---|---|
pb_at | Keeps you signed in (access token). | Up to 24 hours |
pb_rt | Renews your sign-in (refresh token). | 30 days |
_ga | Google Analytics: tells visits from the same browser apart (random ID). | 2 years |
_ga_5KQMYCT6Z7 | Google Analytics: keeps the current visit together. | 2 years |
During the pilot, Cloudflare Access sets its own sign-in cookie. Google Analytics sets the two _ga cookies above to count visits; there are no advertising cookies. You can block them in your browser or with Google’s opt-out add-on, and the site works the same. Product numbers (for example how many workspaces exist) are counted from the saved data itself.
Your rights
- See and take your data: download it as a JSON file from your account page.
- Delete your account there too. Workspaces where you are the only member are deleted with it; in shared workspaces you leave and your saved work stays with the other members, with your name removed.
- Stop emails under Email alerts on your account page, or with the unsubscribe link in any digest.
- Correct, restrict or object, or anything the controls above do not cover: write to contact@publicbeam.com. You get an answer within one month.
- Complain to Persónuvernd (the Icelandic Data Protection Authority), Rauðarárstígur 10, 105 Reykjavík, Iceland, postur@personuvernd.is, island.is/en/o/the-data-protection-authority, or to the data protection authority where you live or work.
If you are in the United States
- The controller, the law and your rights in this notice are the same wherever you live, including in the United States: you can see, take, correct and delete your data and object to its use as described below.
- PublicBeam does not sell personal information, does not share it for cross-context behavioral advertising and does not use it for targeted advertising, as US state privacy laws (for example the California Consumer Privacy Act) define those words. There is nothing to opt out of; if your browser sends a Global Privacy Control signal, nothing changes.
- PublicBeam is a service for businesses. It is not directed at children under 13 and does not knowingly collect their data; accounts are for people 18 and over.
Automated suggestions
Match bands, “Why this match” and rankings are suggestions computed from your company profile and the notice. They make no decision about you and have no legal effect.
Changes to this notice
The version date at the top changes with every update. Signed-in users are told by email before a change that affects them takes effect.