This policy describes how the Wolverine business development platform handles information. Wolverine is provided by Sparrow Technology Solutions, LLC (“Sparrow”) to the organization that licenses it (the “Customer”). Sparrow acts as a processor on the Customer’s behalf; the Customer decides what information is entered and who may access it.
1. What the Service holds
Account information
Your name, work email address, job title, assigned role, and the time of your last sign-in. Passwords are stored only as a salted hash and are never recoverable in readable form.
Business development content
Opportunity records, capture plans, tasks, notes, activity history, reports, and uploaded documents, together with the text extracted from those documents. Records are attributed to the person who created or changed them.
External partner information
For teaming partners, the name, email address, and company of each individual granted portal access, plus the notes and documents they contribute.
Activity records
Sign-in attempts, record changes, document downloads, external sharing, report generation, and content refused by security screening — each with the acting user, a timestamp, and the originating IP address. These are retained as a security and compliance record.
2. What the Service does not hold
Wolverine is authorized for non-classified, non-CUI information only. It does not knowingly hold Controlled Unclassified Information, classified national security information, or ITAR- or EAR-controlled technical data, and uploads are screened for markings that suggest such content. It does not collect personal information unrelated to your professional role — no home address, no financial details, no biometric or health data.
3. Why information is processed
- To operate the pipeline, capture, tasking, and reporting features you use;
- To authenticate you and enforce role-based access;
- To send operational email — invitations, password resets, task digests, weekly pipeline digests, and the monthly security summary;
- To generate AI-assisted assessments and drafts where those features are enabled;
- To retrieve opportunity information from configured sources such as SAM.gov and GovWin IQ;
- To maintain the audit trail described above.
Information is not used for advertising, and is not sold or rented to anyone.
4. Third parties that receive information
The Service depends on the following providers. Which are active depends on the Customer’s configuration.
- Render — hosting and managed PostgreSQL. All application data, including uploaded documents, is stored here.
- AI providers (Anthropic, OpenAI, Microsoft Azure OpenAI, or AWS Bedrock, as configured) — receive the specific content submitted for an AI-assisted feature: opportunity fields, notes, document text, or capture plan content. They receive it only when such a feature is invoked.
- Resend — delivers outbound email, and therefore receives recipient addresses and message content.
- SAM.gov (U.S. General Services Administration) — receives search parameters and notice identifiers when opportunity data is retrieved.
- Deltek GovWin IQ — receives authentication credentials and query parameters when that source is enabled.
Sparrow does not permit these providers to use Customer data to train machine learning models, and does not provide Customer data to anyone else except where required by law.
5. Where information is held
Data is stored in the United States. Some configured providers may process data in other regions depending on the Customer’s settings; the Customer’s administrators control that configuration.
6. Retention
Business development content is retained for as long as the Customer keeps it, and is deleted when the Customer deletes it. Audit records are retained as a compliance record and are not routinely purged. Password reset and invitation links expire after 72 hours and can be used once. On termination of the Customer’s agreement, data is exported or deleted as that agreement provides.
7. Security measures
- Transport encryption for all traffic, and encryption at rest for the database;
- Password hashing with bcrypt; session tokens that expire;
- Role-based access control, with external partners restricted to individually shared records;
- Screening of uploaded content for markings indicating controlled information;
- Audit logging of access and changes.
No system is perfectly secure. If you believe an account or data has been compromised, contact the Customer’s administrators immediately.
8. Your choices
Because Sparrow processes information on the Customer’s behalf, requests to access, correct, or delete information should go to the Customer’s administrators, who can act on records directly. Operational email is part of using the Service rather than marketing, but digest recipients are configurable by an administrator.
9. Changes
This policy may be updated as the Service changes. The effective date above indicates the current version, and material changes will be communicated to the Customer’s administrators.
10. Contact
Questions about this policy should be directed to Sparrow Technology Solutions, LLC at sboyd@sparrowsolutions.co. Questions about how your organization uses the Service should go to your administrators.