Privacy Policy

Effective date: September 19, 2026 · Operated by Athena Data Labs

Thera is a capture intelligence platform for government contractors, operated by Athena Analytics L.L.C., doing business as Athena Data Labs (“Athena Data Labs,” “we,” “us,” or “our”). This Privacy Policy explains what information we collect when you use Thera, how we use and protect it, and the choices you have. We wrote it to be read — if anything is unclear, email us at info@athenadatalabs.com and a person will answer.

1. Scope

This policy covers the Thera web application and the services provided through it. It applies to account holders and to information processed on behalf of the organizations they belong to. It does not cover third-party websites we link to (for example, SAM.gov or a discovered subcontractor’s website), which have their own privacy practices.

2. Information we collect

Account information

• Identity: your name, email address, and organization name, provided at signup.
• Credentials: your password, stored only as a salted PBKDF2-SHA256 hash. We cannot read your password, and session tokens are stored server-side only as SHA-256 digests.

Organization content

Content you or your teammates enter to use the product, including:

• Company profiles (“Digital Twin”): business details such as capabilities, NAICS codes, certifications, service area, address, UEI/CAGE, points of contact, past performance references, and your company logo and brand colors.
• Team roster: the people you propose on bids — name, proposed role, years of experience, credentials, and experience highlights — and, when you upload a resume for Thera to read, the text of that resume and its file name, kept with each person it describes so a draft can be checked against its source. The uploaded file itself is not kept. You are responsible for having each person’s permission to store their information and propose them on bids.
• Pipeline and workspace content: pursuits, checklists, capture notes, pricing inputs, bid decisions, and outcomes.
• Proposal content: AI-drafted and human-edited bid package and capability statement sections.
• Partner directory: business contact details of subcontractors and teaming partners you choose to record. You are responsible for having an appropriate basis to store a partner’s business contact information.

Billing information

Subscription status, plan, and billing history. Payment processing is handled by Stripe, Inc. Card details are entered on a page hosted by Stripe and are transmitted directly to them — your full card number never touches our servers, and we cannot see it. We store only your Stripe customer and subscription identifiers alongside your plan and slot count; card numbers, expiry dates, and billing addresses stay with Stripe.

Usage and log data

Standard server logs (IP address, timestamps, requested endpoints, error traces) collected for security, debugging, and abuse prevention. We do not run third-party advertising or cross-site tracking of any kind.

3. Public government data

Thera’s intelligence is built on public U.S. federal procurement data: contract opportunities from SAM.gov, historical award data from USAspending.gov, and public entity registrations. This data is published by the U.S. government and includes business — not consumer — information about contracting entities (for example, company names, registration details, award history, and company websites). Thera is an independent product of Athena Data Labs and is not affiliated with, endorsed by, or operated by the U.S. General Services Administration or any government agency.

Thera also downloads the documents attached to public notices (statements of work, solicitations, wage determinations) and reads their text, so it can show what a solicitation requires. When you add a partner or search for prospects, Thera looks up that business’s public record on SAM.gov or USAspending.gov by its name, UEI, or the search terms you enter. None of your organization’s other content is sent to these sources.

4. How we use information

• To provide the service: scoring opportunities against your profile, generating briefings and bid drafts, computing pricing scenarios, matching partners, and running your pipeline.
• To operate accounts and billing: authentication, trial and subscription management, and service email (for example, password resets and a notice when your sign-in email or password changes).
• To secure and improve the service: debugging with log data, preventing abuse, and understanding aggregate (non-content) usage patterns.

We do not sell personal information, share it for cross-context behavioral advertising, or use your organization’s content for any purpose other than providing the service to you.

5. AI processing

Thera’s AI features — opportunity briefings, bid package and capability statement drafting, reading an uploaded resume, and suggesting a company profile from a description — are powered by Anthropic’s Claude models via Anthropic’s commercial API. When you use one, the content it needs is sent to Anthropic for processing and the result is returned to your workspace:

• Briefings and drafts: the notice and its attached documents, and the parts of your company profile and team roster the document draws on.
• Resume reading: the text of the resume you upload.
• Profile suggestions: the business description you type.

• Under Anthropic’s commercial API terms, API inputs and outputs are not used to train Anthropic’s models.
• AI processing happens only when you request it (generating or regenerating a briefing or draft, reading a resume, or asking for profile suggestions) — Thera does not send your data to AI providers in the background. Thera’s own background work (reading public notices and their documents, and scoring them against your profile) runs on our servers without AI.
• AI outputs are drafts and analysis for your review. They are advisory, and a human in your organization always makes the final decision (see our Terms of Service).

6. When information is shared

We share information only with the service providers required to run Thera, and only what each needs:

Beyond service providers, we disclose information only if required by law or legal process, to protect the rights, safety, or property of Athena Data Labs or others, or as part of a merger, acquisition, or asset sale (in which case this policy would continue to apply to previously collected data and we would notify you of any successor).

7. Network listings — information you choose to share

Thera includes an optional two-sided network: your organization can publish a subcontractor listing so other Thera customers discover you as a teaming partner. Publishing is off by default and entirely your choice. When you set a listing to “Published,” the information in it — listing name, trade, description, NAICS codes, service states, certifications, and the contact details you enter — becomes visible to other Thera organizations whose contract work matches your profile. Set the listing to “Hidden” at any time to stop sharing it going forward.

8. Security and data isolation

• Tenant isolation: every organization’s data is scoped to that organization. Requests for another organization’s companies, pursuits, tasks, drafts, or documents are rejected as not found.
• Credential protection: passwords are hashed with salted PBKDF2-SHA256; session tokens are random, expire automatically, and are stored only as digests. Changing your password revokes all active sessions.
• Encryption: all traffic to the hosted service is encrypted with TLS, and stored data — the database volume and its backups — is encrypted at rest.
• Least data: we don’t collect data the product doesn’t use.

No system is perfectly secure. If we learn of a breach affecting your personal information, we will notify affected accounts promptly and in accordance with applicable law. To report a suspected vulnerability, email support@athenadatalabs.com with “SECURITY” in the subject.

9. Data retention

• Account and organization content: retained while your account is active so your pipeline history and learning calibration keep working for you.
• After deletion: when you ask us to delete your account, we delete your organization’s content from production systems within 30 days, and from routine backups as those backups expire (daily snapshots are kept for 35 days and database backups for 90).
• Logs: server logs are retained for a limited operational window and then discarded.
• Legal holds: we may retain specific records longer where required by law (for example, billing records for tax purposes).

10. Your rights and choices

You can access and edit your profile and organization content directly in the product at any time. In addition, you may request:

• Export — a copy of your organization’s data in a portable format;
• Correction — a fix to inaccurate account information you cannot edit yourself;
• Deletion — removal of your account and your organization’s content.

Send requests to info@athenadatalabs.com from the email address on the account. We will verify the request and respond within 30 days. Depending on where you live (for example, Virginia, California, or other states with consumer privacy laws), you may have additional statutory rights; we honor the rights above for all customers regardless of location, and we do not discriminate against anyone for exercising them.

11. Cookies and local storage

Thera uses browser local storage for exactly three things: your session token, your selected company profile, and small interface preferences (such as your light or dark theme and a dismissed getting-started guide). If you install Thera as an app, it also caches Thera’s own program files and images so it opens quickly; none of your organization’s data is cached there. We set no third-party cookies and use no third-party analytics or advertising trackers.

We do run our own page analytics, on our own server (Umami, a cookieless analytics program). It records the page viewed, the referring site, browser and general device type, and country. It sets no cookie, creates no identifier, is not linked to your account, and never sees your organization’s data. Nothing is sent to an analytics company. It honours your browser’s “Do Not Track” preference, and turning that on stops it.

12. Children

Thera is a business tool for government contractors. It is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.

13. Changes to this policy

We will update this policy as the service evolves. For material changes we will notify account holders by email or an in-product notice before the change takes effect. The effective date at the top always reflects the current version.

14. Contact

Privacy questions and data requests: info@athenadatalabs.com
Product and account help: support@athenadatalabs.com
Athena Analytics L.L.C., d/b/a Athena Data Labs · United States