Privacy Policy

1. Who we are

Winscope is operated by Quokka For Good LLC ("Winscope", "we", "us"), registered at 30 N Gould Street, Sheridan, WY 82801, USA.

For your account, billing, and website data, we are the data controller — we decide why and how it is used. For the content you and your team put into Winscope (documents, drafts, evidence), we process it on behalf of the person or organisation that owns the team it belongs to, and only to provide the service to them.

For anything in this policy, including requests to see or delete your data, write to support@winscope.co.

2. What we collect

Your account

Your name and email address, and your password if you sign up with one. Passwords are handled by our sign-in provider (Amazon Cognito); we never see or store them. If you sign in with Google, Google shares your name and email address with us.

Your teams

Team names, who belongs to each team and in what role, and the email addresses of people you invite. We use an invitee's address only to send the invitation and to let them join.

Your content

Everything you or your team put into Winscope, and everything it produces for you:

• Documents you upload to a proposal — RFPs, amendments, Q&A, attachments — in PDF, Word, Excel, or CSV
• Files you add to your Evidence library
• Analysis, plans, drafts, edits, images, and feedback you create in the app
• Exports you download as Word or PDF

Your content may contain personal information about other people — client contacts in an RFP, or staff CVs in your evidence. You are responsible for having the right to upload it. We handle it under this policy, the same way as the rest of your content.

Billing

Payments are handled by Stripe. Your card details go directly to Stripe; we never see or store your full card number. We keep your plan, subscription status, purchases, invoices, and the Stripe reference that links them to your account.

How you use Winscope

Records of what happens in your account — proposals created, documents processed, AI tasks run and how much processing they used — so we can apply your plan's limits, show you your usage, and fix problems. Our servers also keep logs that include your IP address, browser, and the requests you made, for security and diagnostics.

Analytics

Both the website and the app use Google Analytics to record the pages you view, your approximate location, your device and browser type, and the site that referred you. Analytics is not loaded on the pages that receive sign-in codes or invitation links, so it never sees either.

When you contact us

The content of your email, and anything you choose to send with it.

3. Why we use it, and on what basis

• To provide Winscope. Running your account and teams, storing and processing your documents, producing analysis and drafts, and generating exports. This is necessary to perform our contract with you.
• To bill you. Charging for your plan and purchases, applying plan limits, and keeping the records tax law requires. Contract and legal obligation.
• To send service emails. Verification codes, team invitations, and notices about your account, billing, or changes to these policies. These are part of the service and are not marketing.
• To support you. Answering your questions and fixing problems you report.
• To keep Winscope secure and working. Detecting abuse, preventing fraud (including the Free plan's proposal being claimed twice), and diagnosing faults. Our legitimate interest in running a secure service.
• To improve Winscope. Using analytics and usage records, in aggregate, to understand which features work. We do not read your content for this, and we do not use it to train AI models.

We will only send you marketing email if you have agreed to it, and every one will have an unsubscribe link. We do not use your information to make automated decisions that have a legal or similarly significant effect on you.

4. How AI is used on your content

Winscope uses AI to read your documents, plan your response, and draft it. To do that, the relevant parts of your content are sent to the AI providers below through their business APIs:

• Anthropic — analysis, planning, and drafting.
• OpenAI — creating search indexes (embeddings) so Winscope can find the relevant passages in your documents and evidence.
• Amazon Textract — reading text from scanned PDFs.

Under their business terms, these providers may not use your content to train their models. They keep requests only briefly — typically up to 30 days — to detect abuse, unless the law requires them to keep it longer, and then delete it.

We do not use your content to train AI models, and we do not share it with anyone to train theirs.

5. Cookies and browser storage

• Essential. The app sets cookies that keep you signed in and remember which team you are working in. Winscope does not work without them.
• Analytics. Google Analytics sets cookies to tell one visit from another and count returning visitors, on both the website and the app.
• Browser storage. The app remembers a few small things in your browser, such as which tips you have dismissed. If you turn on desktop notifications, that permission stays in your browser.

There are no advertising cookies, and nothing here follows you to other websites. You can block or delete cookies in your browser settings, or install Google's opt-out add-on. Turning off analytics does not affect how Winscope works; blocking essential cookies stops you signing in.

6. Who else sees your information

Your team

Content you add to a team is visible to that team's members, according to their role. Team owners and admins can see who is in the team and manage members.

Our service providers

We do not sell your personal information, and we do not share it for anyone else's marketing. We use the providers below to run Winscope. Each processes data only on our instructions, under contract:

• Amazon Web Services — hosting, file storage, sign-in, email delivery, and reading scanned documents.
• Supabase — our database, hosted on Amazon Web Services.
• Anthropic and OpenAI — AI processing, as described in section 4.
• Stripe — payments, subscriptions, and invoices.
• Google — Google sign-in, if you choose it, and Google Analytics.

We will update this list before we add a provider that processes your content.

Our staff

A small number of our people can access account and billing records to run the service. They look at your content only when you ask us to (for example, to help with a problem), to investigate abuse or a security issue, or when the law requires it.

When the law requires it

We may disclose information if the law requires it, to protect our rights or someone's safety, or to a buyer if our business is acquired — in which case this policy continues to apply until you are told otherwise.

7. Where your information is stored

Your account, your teams, and your content are stored in Amazon Web Services' Mumbai region, India. Your content is sent to our AI providers in the United States when it is processed. Stripe and Google process data in the United States and other countries where they operate.

This means your information may be transferred outside the country you live in. Where the law requires a safeguard for that transfer — such as the European Commission's Standard Contractual Clauses — we rely on the mechanism our provider has in place.

8. How long we keep it

• While your account is open, we keep your account and content so you can use them. This includes after a paid plan ends: your teams go read-only, and everything stays viewable and exportable.
• When you delete something — a document, an evidence file, a proposal, or a workspace — we delete it from our systems, and remaining copies (such as backups) within 30 days.
• When you delete your account, we delete your account and its data within 30 days. That includes every team you own and all the content in them. Content you added to a team someone else owns belongs to that team and stays there, without your name; proposals you created there pass to that team's owner.
• Billing records — invoices and payments — are kept for as long as tax and accounting law requires, even after your account is deleted.
• An email fingerprint. If you used a proposal before deleting your account, we keep a one-way fingerprint (a SHA-256 hash) of your email address, not the address itself. It lets us tell that a new account with the same email has already had the Free plan's proposal, so it can't be claimed twice. We keep it for as long as we offer a free proposal.
• Analytics data is kept according to Google Analytics' retention setting, currently 14 months. Server logs are kept for a limited period and then deleted.

9. How we protect it

Everything is encrypted in transit, and your files are encrypted at rest. Access inside Winscope is controlled by team membership and role, and every request is checked on our servers. Access to our systems is limited to people who need it.

No system is perfectly secure. If a breach affects your information, we will tell you without undue delay, and in any case as the law requires.

10. Your rights

Wherever you live, you can ask us to do any of the following, and we will do it free of charge:

• Tell you what information we hold about you, and give you a copy
• Correct anything that is wrong — you can also change your name and email in your account settings
• Delete your account and everything we hold about you, apart from the records section 8 says we keep — you can also do this in Settings → Account
• Give you your content in a portable format — you can also export any proposal as Word or PDF
• Stop sending you marketing email, and withdraw any consent you have given

Email support@winscope.co from the address on your account and we will act on it within 30 days.

Depending on where you live you may have further rights — including, in the EEA and UK, the right to object to processing, to restrict it, and to complain to your local data protection authority; and in India, to nominate someone to exercise your rights if you are unable to. In California, note that we do not sell or share personal information as those terms are defined there.

If your information is in a document a Winscope customer uploaded — for example, you are named in an RFP — please contact that customer first, as they control it. We will help them respond.

11. Children

Winscope is for businesses and is not directed at anyone under 18. We do not knowingly collect information from children. If you believe a child has given us information, email support@winscope.co and we will delete it.

12. Changes to this policy

When we update this page we will change the date at the top. If the change is significant, we will email account holders before it takes effect.

13. Contact us

Questions, requests, or complaints: support@winscope.co. See also our Terms of Service.