Effective September 23, 2026 · See also our Terms of Service

This policy explains what information NSN-Recon collects, why, who can see it, and what you can do about it. We wrote it to be read. If something here is unclear, email us at support@nsnrecon.com.

1. Who we are and what this covers

NSN-Recon is the service at https://nsnrecon.com. In this policy, "we" and "us" mean NSN Recon, and "you" means a person who visits or uses NSN-Recon, including each team member on an account. The account owner accepts this policy on behalf of the team.

This policy covers the NSN-Recon website at https://nsnrecon.com, any read access we provide by API or MCP, and the emails we send from the service. NSN-Recon is a business tool for companies in the defense supply chain. It is not meant for personal or consumer use.

2. What we collect

(a) Account and team information

• Company: company name, CAGE code, and an optional postal address and billing contact email. If you leave city, state or ZIP blank at signup, we fill them in from the public DLA CAGE file.
• People: each person's login email, and a name if one is given, either typed by the owner when inviting or given by the teammate when accepting. The owner of the account can see the team list, including each person's email, name, role and status.
• Passwords: we never store your password itself. We store a salted, one-way hash of it.
• Settings: your plan, seat limit, usage counters, an optional daily digest email address, and display preferences such as hidden page sections and whether bid matching is on.
• Invitations: when an owner invites a teammate, we store the invitee's email, an optional name the owner types, and a one-time invitation link token until the invitation is accepted or the person is removed. The teammate may also give or change their name when they accept.

We do not currently verify email addresses or CAGE codes when you sign up, so we treat this information as what the account holder told us.

(b) Content you add

• Targets (watches): the CAGE codes, NSNs, product classes (FSC) and keywords you follow, plus any notes you attach.
• Notes and bid decisions: free-text notes on an NSN or CAGE, and your Bid, Watch and No-bid marks with any note. These are not attributed to a named person inside your account.
• Inventory listings: NSN, part number, quantity, unit price, condition and a free-text note. See section 5 for who can see these.
• AI RFQ assistant input: text you paste into the assistant (the first 20,000 characters are used) and any files you attach (PDF, Excel, CSV or text; up to 5 files, 8 MB each, 14 MB in all). We read an attached file in memory only to run that one extraction. We do not save the text, the files or the result in our database or on disk, and what is held in memory while a request is processed is discarded when it ends. Hidden sheets in an Excel file are not read, but hidden rows and columns on a visible sheet are, so remove anything you do not want shared before you attach it. We keep only a count of how many times the account has used the feature. See section 5 for what happens to the content.

Everyone in your account shares this content. There is no privacy between teammates on the same account.

(c) Usage and log data

• Sign-in events: each time someone signs in or accepts an invitation, we record the account, the person, the date and time, the IP address our servers see for the connection, and the browser's user-agent text (up to 300 characters). We do not save failed sign-in attempts in the database. To slow down password guessing, we keep a temporary in-memory counter of failed attempts by IP address and email. It disappears when the server restarts.
• Searches: each search you run from the search box is saved with your account, your login, the date and time, and the text you typed (up to 300 characters). Please do not type personal or confidential information into the search box. We do not save searches from batch lookups or API calls this way, and we do not save which pages you view.
• Server logs: our web server and application write ordinary logs. These include the IP address, the date and time, the page requested including any query string (for example, the words in a search URL), and the response status. They do not include form contents such as passwords, notes or pasted text. One-time reset and invitation links contain their token in the address, so the token appears in those logs. Slow-request logs record the page and query string but not who made the request. If a password-reset email cannot be sent, the log records the recipient address.
• Email sending: when the daily digest runs, our job log records the company name and the address the digest was sent to.

(d) Cookies and similar technology

• One cookie: nsn_account keeps you signed in. It holds a random session code, not your personal details. It is HttpOnly (page scripts cannot read it), SameSite=Lax, and marked Secure on HTTPS. The browser keeps it up to 30 days, but our server ends a session that has been idle for 30 minutes. It is strictly necessary for the service to work.
• Browser storage: your browser's local storage holds your color theme choice (nsn_theme), and its session storage remembers which tab you had open on an item page (stockline-tab). Neither is sent to us.
• Google Fonts: our pages load fonts from Google (fonts.googleapis.com and fonts.gstatic.com). Your browser therefore sends Google your IP address, browser details and the page it came from, under Google's own privacy policy.
• Surplus photos: when you view a surplus lot, your browser may fetch its photo directly from a U.S. General Services Administration storage host, which then sees your IP address and browser details.
• None of this: we do not use analytics scripts, advertising cookies, tracking pixels or social media widgets. Our emails are plain text with no open or click tracking.

(e) Business and public work contact information from public records

Most of the data in NSN-Recon is public government information about items, contracts, solicitations and companies, such as DLA catalog and procurement files, SAM.gov opportunities, USAspending and FPDS awards, DIBBS and NECO solicitations, and GSA surplus auctions. Some of it names businesses and their public points of contact, for example a contracting officer's name, work email and phone number in a solicitation, or a company's registered phone and address. We may also retrieve and display a company's named contacts from public government or small-business registries when someone views that company's page.

We did not collect this from the individuals themselves. We show it because it is already public and business-related. If you are named in it and want it corrected or removed from NSN-Recon, email support@nsnrecon.com with the name and the page where you saw it. We will remove or correct what we control, and we will tell you if the same data is republished from the government source on our next update, since we cannot change the government's records.

The requests our servers make to these public sources contain only public identifiers such as NSNs, part numbers and CAGE codes. They do not contain customer data. The one exception is the AI assistant described in section 5.

3. What we do not do

• We do not sell your personal information.
• We do not share your personal information for advertising, and we do not run targeted advertising.
• We do not build advertising profiles or use third-party analytics on the service.
• We do not take card or bank details through NSN-Recon. There is currently no payment system in the service.

4. How we use information

• To create and run your account, sign you in, and enforce seat and plan limits.
• To provide the features you use: your Targets, matches to open solicitations, notes, bid list, inventory, exports and the AI assistant.
• To send account emails: password resets, teammate invitations, and the daily digest if you turned it on. Email delivery can be unavailable at times; when it is, an invitation or reset link may be shown to the account owner, or given to you by our support staff, instead of being emailed.
• To operate the service, improve it, and make business decisions, using the account information and usage described in section 5. That use is not limited to aggregated or de-identified data.
• To keep the service secure, investigate abuse, and troubleshoot problems.
• To provide support, correct an account, and review what a signed-in person is doing in the product, whether or not they asked for help.
• To meet legal obligations and enforce our Terms of Service.

5. Who sees your information

Other NSN-Recon customers

Your Targets, notes, bid decisions, profile and team are private to your account, apart from our own staff (below). The one deliberate exception is inventory listings.

Inventory listings are shared. The company name and CAGE code on a listing are entered by the customer, and we do not verify them or vouch for any customer, listing or seller. Confirm who you are dealing with through SAM.gov and their own contact details. If you believe someone is using your company name or CAGE code without authority, email support@nsnrecon.com. When you post a listing, every other signed-in NSN-Recon customer who views that item's page can see your company name, your CAGE code, the quantity, the unit price, the condition, and your listing note, together with the date you last updated it. They do not see your email address, phone number or the name of the person who posted it, but your company name and CAGE code may lead them to public contact details. Any signed-in account can see listings, whatever its plan. There is no setting to make a listing private. To stop showing a listing, delete it. Listings remain visible after an account is canceled until they are deleted (see section 7).

Our staff

NSN Recon may access, review, correct, export, and use any information in a customer account, and any record of how that account is used. That includes the company profile, billing contact, postal address, team list, Targets, notes, bid decisions, inventory listings, searches, sign-ins (time, IP address, and browser), the pages a signed-in person opens, and any other data or action inside NSN Recon. We may use that data for support, to operate and improve the service, and for NSN Recon's own business. We do not need a support request first. NSN Recon is not exclusive to you.

We may watch or record what a signed-in person does inside NSN-Recon, including the page they are on and the recent pages they opened. That is limited to this product. We do not see their computer screen, other programs, camera, or microphone unless they start a screenshare themselves and invite us.

Staff do not see your password. We store only a salted hash, and the support console does not display password hashes or session codes. Staff can create a one-time password reset link for a login. The console records each time a staff member opens an account and each time a reset link is created. Those records identify the staff account, not the person at the keyboard. Staff who administer the servers can also read the database directly, and that access is not recorded by the console.

Service providers

• DigitalOcean (hosting). Our servers are hosted by DigitalOcean. All account data, content and logs are stored there, so DigitalOcean provides the infrastructure on which they sit.
• Google (AI assistant). When you use the AI RFQ assistant, the text you paste, the names and contents of any files you attach, and the names of the fields you asked to extract are sent to Google's Gemini API to pull out line items. File names often contain customer or people's names. A PDF is sent as the file itself, so everything on its pages goes to Google, including images, signatures, drawings and other people's details; scanned pages are read that way too. A spreadsheet, CSV or text file is converted to text first, and hidden Excel sheets are left out (hidden rows and columns are not). We do not include your name, email or account number in the request. Google handles that content under its own terms, which we do not control. We use a standard Google Gemini API key that we hold for the service. Google's terms for that kind of access may allow Google to keep submitted content and use it to improve its products, and people at Google may review it. Do not paste or attach anything you are not permitted to share with a third-party service, or anything you would not be comfortable sharing with one, and check a customer's RFQ for restrictions before you send it. If the text or a file contains other people's names, prices or contact details, those go to Google too.
• Google (fonts). As described in section 2(d), your browser contacts Google to load fonts.
• Email delivery. When we send an account email, it goes through an outside email delivery provider, which receives the recipient address and the message contents (a reset or invitation link, or digest contents such as your watch labels and matching solicitations).

Service providers may use your information only to provide services to us.

6. Legal requests and business transfers

We may disclose information if we believe in good faith that the law requires it, for example in response to a subpoena, court order or valid government request, or to protect the rights, safety or property of NSN-Recon, our customers or others. Where the law and the request allow, we will tell the affected account holder first.

If NSN Recon is sold, or the business is transferred to another company, your information may transfer to the new owner. We will notify account owners by email before personal information is transferred and becomes subject to a different privacy policy, and we will require the new owner to honor this policy for existing information or give you notice of changes.

7. Retention, cancellation and deletion

Here is what really happens today:

• We do not automatically delete account data. Account details, Targets, notes, bid decisions, inventory listings, sign-in records, search records and support-console records stay until they are deleted at your request or ours. We have not set a fixed retention period for them; we keep them as long as needed to provide the service, secure it and meet legal obligations.
• Server logs are kept as long as we need them for security and troubleshooting. We have not yet set a fixed rotation period. Logs can contain IP addresses, search words in page addresses, one-time link tokens and, for failed sends, email addresses.
• Sessions end when you sign out, change or reset your password, or are removed from a team. Auto-logout is off. A session lasts until one of those, or 30 days.
• Canceling a plan switches off your access to the product and stops the daily digest. It does not delete anything. Your data stays in place, your inventory listings stay visible to other customers with the date they were last updated, and you can reactivate the account later. Canceling is not the same as deleting your data. If you ask us to remove your listings, we will do so within 10 business days.
• Removing a teammate deletes their login and sessions. Sign-in and search records that name that person may remain.
• You can delete individual items yourself: a Target, a note, a bid decision, or an inventory listing. You can also erase your billing contact and postal address by saving those fields empty.

To delete your account and its data, email support@nsnrecon.com from the account owner's login address, or from an address we can verify. There is no self-service button to delete an account. If you email us, we will delete the account and its data by hand and confirm when done; we aim to finish within 30 days. Before requesting it, delete any inventory listings you want gone right away. Once deleted, we cannot recover the data. Records we keep about staff access to your account may remain. We may also keep limited records where the law requires it or to resolve a dispute, and deleted data may remain for a limited time in server logs, database files or copies made at the hosting level until they are overwritten.

We may make copies of data for operational continuity, but we do not promise that we keep backups you can rely on. Keep your own copies of anything important.

8. Security

These are the protections we have in place today:

• The site is served over HTTPS, and requests to http://nsnrecon.com are redirected to HTTPS.
• Passwords are stored only as salted one-way hashes. Reset links are single-use and expire after 60 minutes.
• Your sign-in cookie is HttpOnly and Secure. Auto-logout is off. A password reset signs out every session for that login.
• Repeated wrong passwords are throttled, and reset requests are rate limited. The password reset form gives the same answer whether or not an email is registered.
• Customer data is separated by account inside the application, with one deliberate exception, inventory listings, and the staff access described in section 5.
• Access to the support console is limited to designated staff accounts, and the console records account views and reset-link actions.
• Administrative access to our servers is by SSH key.

We want to be direct about what we do not do. We do not currently offer two-factor authentication. We do not add our own encryption layer to the data in our database. We do not verify email addresses at signup. No system is perfectly secure, and we cannot guarantee that your information will never be accessed, lost or disclosed. If we discover a breach of security that compromises personal information, we will notify affected account owners without unreasonable delay and, where required, within 45 days (or sooner if the law requires), and we will notify affected individuals and regulators as required by law. Notices will describe what happened, what data was involved and what we are doing about it.

You can help by using a strong, unique password, signing out on shared computers, and removing teammates who leave your company.

9. Restricted information: do not upload it

10. Your choices and rights

• Access and correction: you can view and edit your company profile, billing contact, postal address and digest address on your account pages, and edit or remove your Targets, notes, bid decisions and listings. For anything else, email us and we will tell you what we hold about you and correct what is wrong.
• Export: most pages offer CSV downloads, including solicitations, your bid list, matches for a Target, and batch lookup results. There is no single download of all your account data. If you want a copy of the information we hold about your account, email us and we will provide it in a common file format.
• Deletion: delete individual items yourself, or ask us to delete your account as described in section 7.
• Email: the daily digest goes only to an address you enter. Clear that field on your account page to turn it off. Account emails such as password resets are sent only when you or an owner ask for them.
• Closing your account: you can cancel your plan on your account page. To have the data deleted as well, ask us as described in section 7.
• Cookies: you can block or delete cookies in your browser, but you will not be able to stay signed in.

To make a request, email support@nsnrecon.com. We may need to confirm who you are before acting, and we will not act on account data at the request of someone who cannot show they are authorized for that account. If you are a team member and not the owner, we may refer your request to the account owner.

11. U.S. state privacy laws

Some states give residents rights over their personal information, such as the right to know what is collected, to access, correct or delete it, and to opt out of its sale or sharing for advertising. NSN Recon is a small business and may not be subject to every state privacy law. We extend the rights below to all U.S. residents as a matter of policy. We do not sell personal information or share it for cross-context behavioral advertising, and we do not use it for targeted advertising.

Categories of personal information we collect, and why:

• Identifiers (name, email, company, CAGE code, IP address), collected from you or your account owner, used to run and secure the service.
• Login credentials (a salted password hash and session code). This is sensitive personal information under some state laws. We use it only to provide the service and not to infer characteristics about you.
• Internet activity (sign-in events, searches, server logs), used for security, support and troubleshooting.
• Commercial information (Targets, notes, bid decisions, inventory listings), provided by you and used to provide the features you use.
• Business contact details from public records (section 2(e)), collected from government and registry sources.

We do not draw inferences about individuals. We disclose these categories only to the service providers in section 5, and in the case of inventory listings, to other customers.

To use a right, email support@nsnrecon.com. We treat a request as received when it arrives there, confirm it within 10 business days, and respond within 45 days (we may extend once by 45 days and will tell you why). We may need to verify your identity first. You may appoint an authorized agent with written permission. We will not treat you differently for making a request. If we deny a request, you may appeal by replying with the word "Appeal" in the subject line. We will answer within 60 days, and you may contact your state Attorney General if you disagree. We do not track you across other sites, so we do not respond differently to Global Privacy Control or Do Not Track signals.

Because NSN-Recon is a business-to-business service, we mostly handle information about people in their business roles.

12. International visitors

NSN-Recon is operated in the United States, and your information is processed and stored in the United States, where privacy laws may differ from those of your country. If you use the service from elsewhere, you understand that your information will be transferred to the United States. The service is aimed at U.S. defense supply chain businesses.

13. Children

NSN-Recon is not for anyone under 18. We do not knowingly collect information from children. If you believe a child has given us information, email us and we will delete it.

14. Changes to this policy

We may update this policy as the service changes. The effective date is at the top of this page. For a material change, such as a new kind of data collected or a new provider handling your content, we will give at least 30 days' notice in the service, and by email to the account owner once email delivery is enabled, before it takes effect, matching our Terms of Service. Other changes take effect when posted. We will not use information we have already collected in a materially different way without your consent. If you do not accept a change, you may cancel before it takes effect.

15. Contact us

Questions, requests, or corrections: support@nsnrecon.com

This policy is governed by the laws of the State of Alabama, as explained in our Terms of Service.