TGOs Whitespace

Privacy policy

How we handle account information and saved work in Whitespace.

Last updated: November 5, 2026. Whitespace is operated by SailQuery LLC. This policy covers Whitespace, including Google sign-in, while it is in private testing.

What we collect and why

When you sign in with Google, our authentication provider receives your Google account identifier, name, email address and profile picture, as available through the basic profile and email permissions. We use your verified account identity to sign you in and associate your saved work with your account. We do not request access to Gmail messages, Google Drive files, Calendar events or contacts.

For email sign-up, our authentication provider processes your email address, password and confirmation status. We send account confirmation and password recovery messages when requested.

We store the company selections, projects, notes, shortlists and other workspace changes you save. Private uploads are available only to allow-listed testing accounts using mock company material. Customer uploads remain disabled. New public-source research is enabled only for designated testing accounts.

Your onboarding answers about your work and buyers, and your project settings, are stored in your account’s encrypted workspace. They are used only inside Whitespace and never leave Whitespace. When you start research, the selected public capabilities and buyers are used as described below; your role and company relationship are not sent to research models.

When you request research

An authorized research request submits the company name, public website and any supplied UEI, or the selected capability names and descriptions, buyers and filters. A capability revision submits your proposed description, public source URL and supporting quotation. We use these inputs to discover capabilities, search government demand and produce evidence-linked results. Company website lookup may send the public company name and UEI in a search query.

Research models receive the relevant company and capability information and public-source passages needed for the request. We retain research inputs, results, source evidence and operational receipts to show provenance and research status. Public-source company profiles and eligible public-source results may be reused in Whitespace's shared research library. Your saved projects, notes, shortlists, workspace selections and private capability revisions are not added to that library or the public TGOs site. Selecting a capability for research sends its description for that request; it does not share the rest of your workspace.

Who processes this information

Supabase provides authentication and stores account records. Google provides Google sign-in when you choose it. Cloudflare hosts and protects the app and stores saved workspace data. Resend delivers account emails and processes the recipient address, message and delivery records. Anthropic processes research model inputs through local research execution or its hosted API. Cloudflare also runs the hosted research service and stores its research artifacts. Serper processes public company search queries when website discovery needs search. Company and government websites receive source requests; Internet Archive receives requests for archived public pages when needed. If a verified company-domain account explicitly consents to rendering its own blocked site, Jina receives the public page URL and processes the returned page. These services may process data in the United States and other locations where they operate.

We share information with these providers as needed to deliver and protect the service. We do not sell account information or saved workspace work, use it for advertising, or add it to the public TGOs site or shared research library. Saved notes, projects and shortlists are not sent to research models. Research uses the specific inputs described above, not your entire saved workspace. We do not use saved workspace work to train models. Provider handling of research inputs is subject to the applicable provider terms; we do not promise a provider retention or training exemption here.

Private uploads

Allow-listed testing accounts can add PDF and Word (DOCX) files or pasted notes to a company project. Customer uploads remain disabled. Files are encrypted in Cloudflare R2 and document records are encrypted in the account workspace. Only your account can open them through the app. Our service processes them to read text, propose profile changes and support searches you request. Authorized operators may access data to maintain the service or respond to a verified request.

Documents are company-provided evidence. You review exact passages and accept or reject changes before they enter a private profile. No search starts automatically. Accepted passages may be sent to the private research processor for screening and card writing. Private document text is excluded from external search queries, shared research caches, the public TGOs site and newsroom. We do not use it outside your account or to train models.

Deleting a file immediately removes its stored original and extracted text and excludes its evidence from future searches. Replacing it retires the previous evidence until you review the new version. Earlier results, quoted passages, saved cards, pipeline entries and notes remain, with a deleted-document notice. Remove those saved results separately if you want them removed too. Deleted files leave Cloudflare recovery copies within 30 days. Live recovery-copy retention remains to be confirmed before customer launch.

Sessions, storage and security

Sign-in cookies keep your session active. A short-lived return cookie restores your workspace location after Google sign-in or account confirmation. Your browser may store display preferences. Hosting and authentication providers process technical information such as IP addresses, request times and authentication events to operate the service and detect abuse.

Saved work is separated by account and encrypted in storage. We can access saved work as needed to maintain the service and respond to requests. No system can guarantee absolute security; Whitespace is not yet ready for confidential customer material.

Retention and your choices

We retain account records and saved work while your account is active. Research evidence, job history and reusable public-source research are also retained; no automatic research deletion period is currently promised. You can request access, correction, export or deletion by emailing [email protected]. We verify your identity before acting. Provider security records and backups may remain for their applicable retention periods or legal requirements; contact us for the status of a deletion request.

You can remove Whitespace’s Google authorization in your Google account settings. Removing that authorization does not itself delete saved Whitespace work. Request account deletion separately if you want it removed.

Changes and contact

We will update this page when these data practices change. Contact [email protected] about privacy or [email protected] about access.

SailQuery LLC, 12530 Fairwood Pkwy, Ste 102 #801, Bowie, MD 20720.