Privacy Policy
Last updated 31 August 2026
The entity responsible for the processing described here is [LAWYER: legal entity name, form and registered address — must match the entity named in the Terms of Service], referred to as “we” and “us”.
This policy covers permitsapi.com, the Permits API service, and the marketing site. It describes two quite different things, and it is worth keeping them apart:
- Information about you, our customer — because you signed up, called the API and paid us. Sections 2 and 3.
- Personal information about other people, contained in the public permit records we republish — property owners, applicants and contractors who never had any dealing with us at all. Section 4.
Contents
1. The short version
We collect the minimum needed to run an API business: your name and email, a hash of your API key, Stripe identifiers, and a count of what you called. We do not sell customer information and we do not run advertising or third-party analytics. There are no trackers on this site.
Separately, the permit records we serve contain names and addresses that governments published. We did not collect those from the individuals concerned, and we cannot remove a record from the government source — but we can suppress it from our copy, and section 8 says how to ask.
2. Information we collect from customers
| What | Where it comes from | Why |
|---|---|---|
| Name and email address | You, when you request access. | To identify the account, send the key, and reach you about the service and billing. |
| API key hash | Generated by us. | Authentication. We store a keyed hash and a short non-secret prefix, never the key itself — which is why a lost key can be replaced but never recovered. |
| Stripe customer and subscription identifiers | Stripe, when you subscribe. | To link your account to its subscription and apply the right plan. |
| Usage records | Generated as you call the API. | Counts of records read and semantic queries, per key, in one-minute buckets. This is what your invoice is built from, so it is also our billing audit trail. |
| Request logs | Generated automatically. | Our reverse proxy records the time, method, path, status, response time and IP address of each request. We also keep the IP most recently seen for each API key, to spot a shared or stolen key. Used for security, abuse prevention and debugging. |
| Support correspondence | You, by email or through the contact form on this site. | To answer you, and to keep a record of what was asked and agreed. Messages sent through the form are stored in our database as well as delivered to us by email. |
We never receive your card number. Payment details are entered directly with Stripe and stored by Stripe; we see only the identifiers and the status of a subscription.
The marketing site sets no cookies, loads no external scripts, fonts or images, and runs no analytics. There is nothing to opt out of because there is nothing collecting.
3. How we use customer information
- To provide the Service and authenticate your requests.
- To meter usage and bill you accurately.
- To enforce rate limits and detect abuse or key compromise.
- To email you about the Service — outages, breaking API changes, billing problems, and changes to these policies. These are service messages and you cannot unsubscribe from them while you hold an account.
- To answer support requests.
- To comply with law and to establish or defend legal claims.
We do not sell customer information, share it for cross-context behavioural advertising, or use it to train machine-learning models.
4. Personal information inside permit records
A building permit is a public record, and a public record about a house is usually also a record about a person. The records we serve routinely contain an owner, applicant or contractor name and the street address of the property. For a homeowner re-roofing their own house, that is their name and their home address.
Where it comes from
Exclusively from open-data portals published by US state, county and municipal governments — the same records those governments make available to anyone. We do not collect any of it from the individuals concerned, have no relationship with them, and add no data from other sources. We do not append phone numbers, email addresses, demographics, credit attributes or household information, and we do not merge permit records with consumer databases.
What we do to it
We normalise it: mapping each jurisdiction's column names onto one schema, parsing dates, classifying the type of work, and generating a numeric embedding of a text summary so the records can be searched by meaning. The original values are preserved unmodified alongside the normalised ones.
What we do not do with it
- We do not use it to make, or help anyone make, decisions about a person's eligibility for credit, insurance, employment or housing. The Service is not a consumer reporting agency and the data is not a consumer report under the Fair Credit Reporting Act (FCRA).
- We do not send marketing to the people named in the records.
- We do not build profiles of individuals across records.
What our customers may do with it
Customers query it to find work in progress in a market — which is the point of the product, and for lead-generation customers that means contacting the people named. Our Terms require them to obey the law that governs that contact, including the TCPA, state do-not-call rules and CAN-SPAM. We are not in a position to police every customer's outreach, and we do not claim to be. If a customer contacted you because of a permit, they — not we — chose to do so, and we will pass a complaint on to them.
Asking us to suppress a record
If you are named in a permit record we publish, write to contact@permitsapi.com with enough detail to identify the record. Two honest limits:
- We can suppress our copy, and we will. We cannot remove the record from the government portal it came from, or from anyone else who obtained it there.
- A customer who already downloaded the record has their own copy. We will notify customers of suppressions, and our Terms require them to honour them, but we cannot reach into their systems.
5. Who we share data with
We disclose data to the service providers below, each processing only what its function requires. We do not sell data to anyone.
| Provider | What it receives | Why |
|---|---|---|
| Stripe | Your name, email, payment details you enter with them, and metered usage quantities. | Payments, subscriptions and invoicing. |
| OpenAI | Permit record text, which can include owner, applicant and contractor names and the property address. Not your account details, and not your queries' results. | Generating the embeddings used for semantic search, and structuring records from unstructured sources. Sent through the API, which under OpenAI's published API terms is not used to train their models and is retained by them only briefly for abuse monitoring. That is their commitment, not ours to give. |
| Our hosting provider | Everything, as the operator of the server the database runs on. | Hosting. The database is not exposed to the public internet. |
| Email provider | Your email address and the content of correspondence. | Sending and receiving support and service email. |
We will also disclose data where legally required — a valid subpoena, court order or lawful demand — and, where we are permitted to, we will tell you first. If the business is sold or merged, data transfers with it, and this policy continues to apply until you are notified of a replacement.
The table above is a subprocessor list, and its value is that it is accurate. Name the hosting and email providers explicitly before publishing, and update it whenever you add a vendor that touches customer or record data. Counsel should also advise whether you need a written data processing agreement with any enterprise customer, and whether to commit to advance notice of subprocessor changes.
6. How long we keep things
| Data | Retention |
|---|---|
| Account details (name, email, key hashes) | For the life of the account, then deleted or anonymised within 90 days of closure, except where we must keep records longer for tax or legal reasons. |
| Usage and billing records | Retained as financial records for 7 years. These are counts tied to an account, not the content of your queries. |
| Request logs (including IP addresses) | Rotated automatically; retained for roughly 30 days in normal operation, longer only where a specific security investigation requires it. |
| Ingestion job records | Deleted automatically 30 days after the job finishes. |
| Permit records | Retained indefinitely, because historical permit data is the product. Subject to suppression requests under section 4. |
| Support correspondence | Up to 3 years after the last message. |
Backups are taken nightly and rotated; data deleted from the live database persists in backups until those backups age out.
7. Security
What we actually do, rather than a list of adjectives:
- All traffic is served over HTTPS with HSTS; plain HTTP is redirected.
- API keys are stored as keyed hashes, never in plaintext, and compared in constant time.
- The database, the cache and the application are on a private network. Only ports 80 and 443 are open to the internet; the database port is not reachable from outside the host.
- The administrative API is not routed publicly at all — it is reachable only over an authenticated SSH tunnel.
- The host runs automatic security updates, a default-deny firewall and SSH brute-force banning, with password and root login disabled.
- Secrets are held in a file readable only by the service account, and are not in the source repository.
No system is perfectly secure, and we do not promise that ours is. If you find a vulnerability, please write to the contact address; we will not pursue good-faith research that stays within your own account.
Every US state has a breach-notification statute, and the deadlines and triggers differ. Counsel should confirm the commitment to make here — a drafted default of notifying affected customers without undue delay and within 72 hours of confirming a breach affecting their data is common, but it is a commitment you have to be operationally able to keep.
8. Your rights
Depending on where you live, you may have the right to know what personal information we hold about you, to get a copy of it, to correct it, to delete it, and not to be discriminated against for exercising those rights.
To exercise any of them, email contact@permitsapi.com with the subject “Privacy request”. Say which right you are exercising and give us enough information to find your data — for a customer account, the email address on it; for a permit record, the property address and the name as it appears.
We will acknowledge within 10 business days and respond substantively within 45 days, extendable once by a further 45 days where the request is complex, in which case we will tell you why. We will verify your identity before acting, proportionately to the sensitivity of the request. Using the Service or asking about your rights costs you nothing and changes nothing about your pricing.
An authorised agent may act for you with written proof of authorisation.
This section makes a promise with a clock on it. Before publishing, decide who monitors that mailbox, how identity is verified for someone named in a permit record who has no account, and where suppressions are recorded so a re-sync does not silently reinstate a record you removed. A rights process that exists only on this page is worse than not offering one.
9. US state privacy notices
Several states — California, Colorado, Connecticut, Virginia, Texas and others — give residents statutory privacy rights. We extend the rights in section 8 to all US residents regardless of state, which is simpler than maintaining a matrix.
For California residents specifically, under the CCPA as amended by the CPRA:
- Categories collected. From customers: identifiers (name, email, IP address), commercial information (subscription and usage), and internet activity (request logs). From public records: identifiers (name, property address) and, where the source publishes it, professional information such as a contractor licence.
- Sources. You, Stripe, and government open-data portals.
- Purposes. As set out in sections 3 and 4.
- Sale or sharing. We do not sell personal information and do not share it for cross-context behavioural advertising.
- Sensitive personal information. We do not collect it.
The CCPA excludes “publicly available” information, defined to include information lawfully made available from government records, from the definition of personal information. Our position is that the permit records fall within that exemption — but the exemption has been read narrowly, and the analysis changes once data is combined, enriched or inferred from. Because our product includes derived fields and vector embeddings, counsel should confirm the position rather than assume it, and should say whether any state requires registration as a data broker. That question is specific to this business and is not a formality.
10. Where data is processed
The Service is operated from and intended for the United States, and data is stored on servers in the United States. If you access it from elsewhere you are transferring your information to the US, which may have different protections than your own country.
If you intend to sell to customers in the UK or EU, this page needs a GDPR-facing section: a lawful basis for each purpose, transfer mechanism, and — because the permit data concerns identifiable people — an assessment of your role as controller for that data. Counsel should advise whether to serve those markets at all in year one, or to say plainly that the Service is offered only in the US.
11. Children
The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect information from children. If you believe a child has given us information, write to us and we will delete it.
12. Changes to this policy
We will update the date at the top when this policy changes. For material changes affecting customer information we will email account holders at least 30 days before they take effect. Adding a subprocessor to the table in section 5 is not by itself a material change, but we will keep the table current.
13. Contact
Privacy questions, rights requests and record suppression requests all go to contact@permitsapi.com.
See also the Terms of Service.