Privacy Policy

Account and organization information

We collect information used to create and administer an account or organization, including name, email address, telephone number, company name, account type, job function, team role, profile image, sign-in credentials, invitation records, and verification status. Passwords are stored in hashed form; we do not store a readable copy of your password.

Property and permit-project information

We collect the property address and project facts you submit, including proposed work, dimensions, construction details, estimated project value, parcel or zoning context, responsible authorities, applicant or property-owner contact details, permit status, deadlines, inspections, tasks, notes, and related records. We may supplement this information with public government, GIS, parcel, zoning, code, and permit-office sources.

Files, images, and credentials

The Services may store documents and images you upload or generate, such as permit applications, surveys, plans, site plans, photos, correction notices, issued permits, contractor licenses, bonds, certificates of insurance, company-verification documents, and profile images. These materials may contain personal information about property owners, employees, subcontractors, or other people.

Communications and AI interactions

We collect comments, messages, mentions, support requests, Concierge applications, referral requests, Permibot prompts and responses, task instructions, feedback, and records of actions performed in a workspace. If you provide a photo or document to an AI-assisted feature, its contents may be processed to provide the requested result.

Payments and subscriptions

We collect plan selection, subscription status, billing interval, seat count, trial status, transaction identifiers, and limited billing metadata. Payment-card details are collected and processed by Stripe. Permitech does not receive or store the full payment-card number.

Device, usage, and cookie information

We may collect IP address, browser and device type, operating system, referring page, timestamps, pages and features used, performance and error information, approximate location derived from IP, and cookie or browser-storage identifiers. We also record security and audit events needed to prevent abuse and investigate account activity.

We use information to:

• Create, authenticate, verify, and secure accounts.
• Resolve permit authorities and organize requirements, evidence, checklists, documents, project facts, and deadlines.
• Generate, review, and deliver permit packets, reports, site-plan materials, analytics, and project recommendations.
• Operate Permibot and other AI-assisted research, extraction, classification, summarization, and workflow features.
• Enable team collaboration, invitations, assignments, messages, comments, notifications, and customer support.
• Process subscriptions, trials, payments, refunds, and usage allowances.
• Provide Concierge services or referral introductions you request.
• Monitor reliability, measure product use, debug errors, prevent fraud, enforce our Terms, and protect users and the Services.
• Improve our products, source coverage, models, workflows, and customer experience using feedback and appropriately aggregated or de-identified information.
• Send operational notices and, where permitted, product or marketing communications. You may opt out of marketing messages.
• Comply with legal obligations and resolve disputes.

Permitech uses third-party model providers, including Anthropic and Google, depending on the feature and system configuration. Relevant prompts, selected project context, public-source excerpts, and files or images you direct the feature to analyze may be sent to a model provider to produce a response. We aim to send only the context needed for the requested task.

AI output can be incomplete or incorrect. Permitech may retain prompts, responses, citations, tool results, and feedback as part of the project record, for safety review, or to improve the Services. Model providers may process limited usage and content data under their commercial terms, security controls, abuse monitoring, and retention practices. Do not submit secrets or sensitive personal information that are unnecessary for the permit task.

We may disclose information in these circumstances:

• Service providers. Vendors may process data for hosting, database and file storage, payments, email delivery, analytics, security, customer support, mapping, and AI services. Current providers may include Vercel, Supabase, Stripe, Resend, Microsoft Clarity, Anthropic, Google, and public GIS or mapping providers, depending on the feature used.
• Your organization and invitees. Organization owners, administrators, team members, and people invited to a project may view information made available to their role. Team administrators may manage access and certain profile information.
• Permit authorities and project providers. At your direction, or when necessary to perform a purchased Concierge or filing service, information may be provided to an authority having jurisdiction, permit technician, plan preparer, contractor, or other project participant.
• Printing and counter delivery. If you order Permit Delivery, we print the documents the department needs and a Permitech agent carries them to the department and back. Printed copies are handed only to the department or to you.
• Referral matching. If you request an introduction or consent to matching, we may share the contact and project details reasonably needed for the recipient to evaluate and respond to the opportunity. We do not sell raw homeowner or contractor contact lists.
• Legal and safety reasons. We may disclose information when reasonably necessary to comply with law, legal process, or a valid government request; investigate fraud or security issues; enforce agreements; or protect rights, safety, and property.
• Business transactions. Information may be transferred as part of a financing, merger, acquisition, reorganization, sale of assets, or similar transaction, subject to appropriate confidentiality protections.
• Aggregated information. We may share statistics or insights that do not reasonably identify an individual or a specific customer project.

Essential cookies and browser storage support authentication, security, consent choices, saved preferences, and core workflows. Vercel Analytics provides aggregate traffic and performance measurement. Microsoft Clarity and optional attribution or behavior analytics operate only according to the consent controls presented on the Site. We limit analytics URLs and event data to reduce the exposure of property addresses and project identifiers.

You may reject optional analytics in the cookie banner without losing access to core Services. Browser settings can also restrict cookies, but blocking essential storage may prevent sign-in or saved preferences from working.

We retain information for as long as reasonably needed to provide the Services, maintain project history and evidence, administer an account or subscription, meet contractual or legal obligations, prevent abuse, and resolve disputes. Retention depends on the data type and customer relationship; permit evidence and audit records may need to outlast an active project.

You may delete certain files, messages, or projects using available product controls and may request account deletion. Deletion may not be immediate in backups, security logs, payment records, or records we must retain by law. Information shared with a project team, authority, referral recipient, or service provider may remain in that recipient's records.

When you delete your account, we delete your personal information and your project files. What we learned about a building department's rules while working on your projects, such as a requirement, its source and whether a permit technician verified it, stays in our library without your name, contact details or street address. Accounts linked to Permitech GOV records are closed by our team rather than from the account page.

When a building department uses Permitech GOV, we process the department's records and the applications residents submit to that department on the department's behalf, under its agreement with us. The department decides which of its staff can see an application and makes every decision about it. Its own records rules, including public-records laws, may apply to what you submit, and its agreement with us governs how long those records are kept.

Department staff sign in with a passkey or security key. We store the key's public credential, sign-in times and security events to protect department accounts. The private key stays on the staff member's device.

Permitech GOV pages run without analytics, advertising or attribution tools and without the cookie banner. Documents a department adds to its private knowledge library stay with that department: they are not sent to AI model providers and are not used for other customers unless the department separately chooses to share approved material.

We use administrative, technical, and organizational safeguards designed for the nature of the information we process. Measures may include access controls, hashed passwords, encrypted network transport, signed file-transfer links, private storage controls, audit records, rate limits, and restricted administrative access. No security program or transmission method is completely secure, and we cannot guarantee that unauthorized access will never occur.

You are responsible for using a strong, unique password, maintaining control of your devices and account, reviewing team and invitee access, and notifying us promptly if you suspect misuse.

Depending on where you live and applicable law, you may have the right to request access to, correction of, deletion of, or a copy of certain personal information; to object to or restrict certain processing; to withdraw consent; or to appeal a denied privacy request. We may need to verify your identity and authority before completing a request. Authorized agents may be required to provide proof of authority.

You can update many account and project details in the Services, change cookie preferences through the consent controls, and use the unsubscribe link in marketing emails. We will not discriminate against you for exercising a privacy right protected by law.

The Services link to permit-office sites, portals, maps, public records, and other third-party resources. Permitech does not control those services or their privacy practices. Public-source content may contain information supplied by government agencies or other publishers; use of those sites is governed by their own terms and policies.

Permitech is based in the United States. Our vendors may process information in the United States and other countries where they or their service providers operate. Those locations may have data protection laws different from the laws where you live.

The Services are not directed to children under 13, and we do not knowingly collect personal information from a child under 13. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.

We may update this policy as the Services, vendors, and legal requirements change. We will update the date above and provide additional notice when required. Material changes apply prospectively unless otherwise permitted by law.

To ask a privacy question or submit a privacy request, contact: