Privacy Policy

1. Introduction

GO GSA ("we," "our," or "us") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our consulting services.

2. Information We Collect

Information You Provide

When you contact us or use our services, we may collect:

• Name and contact information (email, phone number)
• Company name and business details
• Information about your government contracting experience
• SAM.gov registration details (CAGE code, UEI, NAICS codes)
• Financial information necessary for contract applications
• Any other information you choose to provide

Information Collected Automatically

When you visit our website, we automatically collect:

• IP address and browser type
• Device information and operating system
• Pages visited and time spent on our website
• Referring website addresses
• Cookies and similar tracking technologies

3. How We Use Your Information

We use the information we collect to:

• Provide and improve our consulting services
• Respond to your inquiries and requests
• Send you relevant information about our services
• Process and manage your GSA or OASIS+ applications
• Comply with legal obligations
• Analyze website usage and improve user experience
• Protect against fraudulent or unauthorized activity

4. Information Sharing

We do not sell your personal information. We may share your information with:

• Government Agencies: As necessary to submit applications on your behalf (with your authorization)
• Service Providers: Third parties who assist us in operating our website and providing services (subject to confidentiality agreements)
• Legal Requirements: When required by law or to protect our rights

5. Cookies and Tracking

On public pages, we use cookies and similar technologies to:

• Remember your preferences
• Analyze website traffic and interactions (via Google Analytics, PostHog, or another configured analytics provider)
• Improve website functionality

On eligible public pages, PostHog may record clicks, scrolling, and navigation so we can understand how visitors use the site. Text and form inputs are masked in these session recordings. Admin pages, customer-portal pages, and the CMMC readiness diagnostic are excluded from recordings.

You can control cookies through your browser settings. Disabling cookies may affect website functionality.

On the CMMC readiness diagnostic page, the site does not initialize Google Analytics or PostHog for a direct visit. When visitors navigate there within the site, the implementation disables its Google tags, denies analytics and advertising consent, drops Google tag calls, and suppresses other analytics events on that route, including PostHog autocapture and session recording. Tracking resumes on eligible public pages after visitors leave. The site's instrumentation is designed to prevent diagnostic answers, contact details, and the generated report from being sent to those analytics tools. Provider-side project settings and retention are controlled separately and have not been independently verified.

6. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

7. Data Retention

We retain your personal information for as long as necessary to provide our services and fulfill the purposes outlined in this policy, unless a longer retention period is required by law. Client engagement records may be retained for up to seven years after the conclusion of services.

If you submit the CMMC diagnostic form, we store your screening answers and generated report with the contact details you provide, your selected follow-up preferences, and related email-job records. Current and previously versioned diagnostic records covered by our cleanup, including earlier released versions, and their queued email records are scheduled for deletion 12 months after submission. Some historical diagnostic records with no version or a version outside that cleanup are not included in this automated rule and may remain while we review their disposition. An authorized administrator can access saved records through the admin workspace. Your report is shown on screen for printing or saving; a separate generic next-steps email does not include your answers, results, or report. A limited internal notification contains contact details, whether you requested a consultation, and an admin record reference—not diagnostic findings. Email delivery providers process these messages; their independent message/metadata retention settings are not verified here. Do not submit CUI, classified information, credentials, or other restricted material in the assessment.

Application cleanup does not guarantee deletion of database backups, infrastructure logs, provider copies or mailbox messages on the same schedule. Access to the admin workspace uses a shared administrator credential rather than individual accounts; the application does not currently provide an audit trail of record reads.

8. Your Rights

Depending on your location, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your personal information
• Opt out of marketing communications
• Request a copy of your data in a portable format

To exercise these rights, please contact us using the information below.

9. California Privacy Rights

California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect and how it's used, the right to delete personal information, and the right to opt out of the sale of personal information. We do not sell personal information.

10. Children's Privacy

Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If we learn we have collected information from a child, we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy periodically. Changes will be posted on this page with an updated revision date. We encourage you to review this policy regularly.

12. Contact Us

For questions about this Privacy Policy or our data practices, please contact us at:

GO GSA
Email: info@gsa.consulting
Phone: (202) 649-0492