Privacy
Last updated August 27, 2026
This site collects two things: what you type into the contact form, and your email address if you choose to give it. Nothing else. It sets no cookies of its own, runs no ad trackers, and there is no third party here building a profile of you. This page says exactly where the two things go and how to get them deleted.
Contracting Authority is a federal contract consulting practice. It is one person, and that person is the only one who reads any of this.
The contact form
Submitting the form at the contact form sends me these fields:
| Field | What it is for |
|---|---|
| Your name | So a reply can be addressed to a person. |
| Company | To look up the entity that would hold the contract before replying. |
| The reply address. It is the only required way to reach you. | |
| Phone | Optional. Only used if a call is faster than a reply. |
| UEI | Optional. Used to check a registration in SAM.gov, which is a public record. |
| Your message | The question being asked. |
| How you found the site | One of six fixed options. Tells me whether search is working. Not tied back to you for any other purpose. |
The form has one hidden field that real people never see. If it comes back filled in, the submission was made by a bot and nothing is sent or stored. That is the only thing on the page that behaves differently than it looks.
The submission becomes one email in one inbox, mine. It is not added to a list, does not start an automated sequence, and is not shared with anyone. There is no CRM behind it.
The email list
The signup field asks for one thing and stores one thing: your email address. No name, no company, nothing inferred from the page you signed up on.
Signing up takes two steps, and the first one stores nothing at all. When you submit the form, the address is put into a signed link and mailed straight back to you — it is not written to any list, any file, or any vendor at that point. Only when you click that link does the address get saved. So an unconfirmed signup is not a pending record somewhere waiting to be cleaned up; there is nothing to clean up, because nothing was written.
The link stops working after two days. If someone types your address into the form, the confirmation mail is the only thing that happens, and ignoring it is enough — you will not be added and you will not hear from the list again.
The list receives one kind of message: a notice when a new briefing or guide is published, with the title, the description, and a link. There is no newsletter, no drip sequence, and no email-only content. Every send has a working unsubscribe link, and unsubscribing removes the address rather than flagging it.
Who processes it
Two vendors touch this data, and only in order to run the site.
Resend delivers the contact-form email and stores the email list. Everything you type into the form passes through Resend to reach my inbox, and Resend keeps a copy in its own delivery log for a limited period as part of sending it. Confirmed subscriber addresses are stored there too, in a single segment used for nothing but the briefing notices. Resend processes all of this on my instructions and does not use it for anything of its own.
Cloudflare hosts the site and runs the analytics. Serving a page means Cloudflare briefly handles the request, including the IP address it came from, which is how any website on the internet works and is also how the site is protected from abuse.
Analytics
The site uses Cloudflare Web Analytics. It is cookieless. It does not set an identifier, does not fingerprint your browser, and cannot follow you to another site. What it reports back to me is counts: how many people landed on a page, which page they came from, roughly what country, and whether the page loaded quickly. None of that identifies anyone, and none of it is joined to a contact-form submission or an email address.
That is why there is no cookie banner on this site. There is nothing to consent to.
I also use Google Search Console, which shows which search queries the site appeared for. Google reports that as totals across everyone. I cannot see who searched, and neither can it tell me.
How long it is kept
Contact form submissions: kept for twenty-four months, then deleted. Two years is long enough to remember a conversation from a bid cycle that came back around, which happens often in this work, and short enough that nothing sits in an inbox forever. If the conversation turns into an engagement, the project records that come out of it are business records and are kept under that practice, not this one.
Email addresses on the list: kept until you unsubscribe, at which point the address is removed rather than flagged. An address that was never confirmed was never stored, so there is no retention period for it to sit through.
Analytics: Cloudflare aggregates it and expires it on their schedule. Since it was never tied to a person, there is nothing in it to delete.
Getting your data deleted
Email hello@contractingauthority.com and ask. Say whether you want the contact submission deleted, the list subscription deleted, or both. You do not need a reason and you will not get a retention pitch back.
It gets done within thirty days, usually the same week, and you get a reply confirming it. The same address works for asking what is held about you, or for correcting something that is wrong. If you only want off the list, the unsubscribe link in any send is faster than emailing me.
What does not happen
Nothing here is sold, rented, or handed to a data broker, an ad network, or a lead-generation service. No pixels from advertising platforms are on these pages. Nobody is retargeted for visiting. The only circumstance in which any of this gets disclosed is a valid legal order, and there has never been one.
Where to write
Postal mail, and the address that appears at the bottom of every email the list receives:
Contracting Authority
United States
hello@contractingauthority.com
Changes
If what this page describes changes, the page changes with it and the date at the top moves. There is no archive of old versions. If a change ever affects data already collected, the people it affects get an email about it rather than a quietly edited page.
Questions about any of this go to the same place as everything else — the contact form, or the address above.