Privacy policy

Last updated: 2026-10-15

Who is responsible

The controller of your personal data is Lazar Lazarov, a private individual, Pazardzhik, Bulgaria (European Union), so the EU General Data Protection Regulation (GDPR) applies. Contact us about privacy at hello@fedcomps.com.

Browsing the site

We do not use advertising or tracking cookies, and we do not sell data.
If you arrive from a link with campaign tags (such as utm_source, ref or via), the page keeps them in your browser's session storage until you close the tab, only to add them to a form you send.
Our host, Cloudflare, processes technical data such as your IP address to deliver pages and protect the site. We may use Cloudflare Web Analytics, which counts visits without cookies and without identifying you.

Legal basis: our legitimate interest in running a secure, working website (GDPR Art. 6(1)(f)).

The waitlist

When you join the waitlist we store:

your email, trade, ZIP code and alert radius, and, if you give them, your company name and UEI;
the page you signed up on, campaign tags from your link, your referral code and who referred you;
the time and version of your consent, the country your request came from, and a salted one-way hash of your IP address (to limit abuse).

Purpose: to tell you when the paid version launches and to set up your alerts. Legal basis: your consent (GDPR Art. 6(1)(a)): "Email me when the paid version launches. FedComps stores my details as described in the Privacy Policy, and I can ask for deletion at any time." You can withdraw it at any time by emailing hello@fedcomps.com; we then delete your entry. We keep waitlist data until you ask us to delete it, and no longer than 24 months after the paid version launches.

Saved searches by email and the free digest

When you ask us to "Email me bids like this" on the open-bids pages, or sign up for the free weekly digest of new bids, we store your email, which kind of sign-up it is, the search (ZIP code, distance, trade and filters) or the ZIP code you gave for the digest, the page you signed up on, the short code (ref) from the link in our email if you came from one, the time and version of your consent, and a salted one-way hash of your IP address (to limit abuse).

"Email me bids like this": to tell you when FedComps Pro (coming soon) launches and to set up alerts for that search then. Your consent: "Email me when Pro launches and when alerts for this search start. FedComps stores my details as described in the Privacy Policy, and I can ask for deletion at any time."
The free weekly digest: to send you the digest once sending is set up, and to tell you when FedComps Pro launches. Your consent: "Email me the free weekly digest of new bids once sending starts, and when Pro launches. FedComps stores my details as described in the Privacy Policy, and I can ask for deletion at any time."

Legal basis: your consent (GDPR Art. 6(1)(a)). We send no email yet. Before the first one, we will ask you to confirm. Sign-ups nobody confirmed are deleted after 12 months. You can withdraw at any time by emailing hello@fedcomps.com; we then delete your entries.

Kept on your device only

"Save on this device" and "About your business" (the boxes such as small business or veteran-owned) are stored in your browser's local storage, so the open-bids pages can show what is new and which bids you can bid on. They never reach us. Clearing this site's data in your browser removes them.
"Use my location": your browser asks you first. Your position is used in your browser only, to find the nearest ZIP code, and never sent to us; the page then works with that ZIP code, which appears in the page address.

Maps

The interactive map on the open-bids pages loads map images from OpenFreeMap (openfreemap.org), a free map service. Your browser then sends your IP address and the area you look at to OpenFreeMap, as any website you visit receives your IP address. If we later serve the maps from our own storage at Cloudflare, Cloudflare receives these requests instead. The small state maps are part of our own pages. Legal basis: legitimate interest in showing where the work is (Art. 6(1)(f)).

Error reports

When you report an error we store your message, the page, the contract number you entered, and your email if you give it, so we can fix the data and reply. Legal basis: legitimate interest in accurate data (Art. 6(1)(f)). We keep reports for 12 months.

Spam protection

Our forms use Cloudflare Turnstile, which loads only when you start using a form. It checks browser signals to tell people from bots, without showing puzzles in most cases. Legal basis: legitimate interest in preventing abuse (Art. 6(1)(f)).

Company information on our pages

Contractor names, UEIs, locations and award amounts come from USAspending.gov, a public U.S. government record of contracts awarded to businesses. We publish them to make public spending easier to understand (legitimate interest, Art. 6(1)(f)). We do not publish pages for sole proprietors, phone numbers or names of company officers. You can object or ask for a review at hello@fedcomps.com; we keep a suppression list so removed entries stay removed.

Open bids come from SAM.gov. We do not store or show the names, emails or phone numbers of the contracting officers listed there, not even when they appear inside a notice's text: bidders find them on SAM.gov. We name a company as a bid's possible current contractor only when it is a business we may list, never a sole proprietor.

If we emailed you

We email small businesses that win federal construction and facilities contracts to tell them about FedComps. These emails come from Lazar Lazarov at addresses on getfedcomps.com, a domain we use only for them, and are sent with the email tool Saleshandy.

Where we got your details: from public federal award records (USAspending.gov), the public SAM.gov entity registry, the U.S. Small Business Administration's public Small Business Search and public company websites. We take only an email address your business published itself, on its website or in its SBA profile, and each email says where we found it. We never guess email addresses, and we skip websites that ask not to have their addresses collected.
What we keep: your business email address, company name, city, state, ZIP code, trade and UEI, a contact's first name only if your business published it with the address, where and when we found the address, and your replies. We do not email or keep details of sole proprietors or private individuals.
Why: to tell businesses about a service for their trade. Legal basis: our legitimate interest (GDPR Art. 6(1)(f); Recital 47 says direct marketing can be one). We have written down why it does not override your interests; ask us for a copy. This section is the information we owe you under Art. 14.
How we send: at most three emails, a first one and two follow-ups, with no tracking pixels and no click tracking. Before sending, we check that each address exists. The link in each email carries a short code (ref) so we can count visits and sign-ups from these emails; the list that connects codes to companies stays on our own computer.
How long: if you never reply, we delete your details within 60 days of our first email. An address we found but did not email within 30 days is deleted then. If you reply, we keep the conversation while we need it to answer you, and no longer than 24 months. If you join the waitlist or ask us to "Email me bids like this", the matching section above applies instead.
To stop: reply "no", use the unsubscribe link in any of our emails, or email hello@fedcomps.com. We stop at once and will not contact you again. So that this lasts, we keep your email address, your company's UEI, the date and the reason on a do-not-contact list, and nothing else. Your right to object to direct marketing is absolute (Art. 21).

Who processes data for us

Cloudflare, Inc. hosts the site and database and provides Turnstile and Web Analytics. Cloudflare may process data in the United States; the transfer is covered by the EU-U.S. Data Privacy Framework and the European Commission's Standard Contractual Clauses. OpenFreeMap receives the map requests described under Maps. Emails you send to hello@fedcomps.com are forwarded by Cloudflare to a Gmail inbox, so Google LLC also receives them (Google is covered by the same Data Privacy Framework).

For the emails described under If we emailed you: Google (Google Workspace) hosts our mailboxes on getfedcomps.com, so it holds the emails and your replies; Saleshandy keeps the contact list and do-not-contact list and sends the emails through those mailboxes; ZeroBounce checks that addresses exist and receives only the addresses. Each works for us under data-processing terms. Where they process data outside the EU, the transfer relies on the EU-U.S. Data Privacy Framework or on the European Commission's Standard Contractual Clauses. We do not share your data with anyone else unless the law requires it.

Your rights

You may ask to access, correct, delete, restrict or receive a copy of your data, and object to processing based on legitimate interest. Email hello@fedcomps.com; we answer within one month. You can also complain to the Bulgarian Commission for Personal Data Protection (CPDP, www.cpdp.bg) or to the data protection authority where you live.

Children

FedComps is for businesses and is not directed at children.

Changes

We will post any change here with a new date. If a change affects your consent, we will ask again.