Privacy Policy

1. Information We Collect

We collect the following types of information:

• Personal information: Name, email address, and account credentials when you create an account
• Payment information: Processed securely by Stripe. We do not store credit card numbers on our servers
• Usage data: Building searches, building detail views, feature usage, and interaction patterns
• Device information: Browser type, operating system, IP address, and general location

2. How We Use Your Information

We use collected information to:

• Provide, maintain, and improve the CompliantLens service
• Process billing and subscription management
• Send email notifications including compliance alerts, account changes, and security notices
• Analyze usage patterns to improve service quality
• Monitor for security threats and prevent abuse
• Respond to your requests and provide customer support

3. Data Sources

Building energy data displayed on CompliantLens is sourced from publicly available NYC Open Data datasets, including LL84 Energy Benchmarking reports, PLUTO property records, and DOB Job Application Filings. This data is self-reported by building owners to the City of New York. We do not independently verify its accuracy, and the data is updated according to published schedules set by the City.

4. Third-Party Services

We use the following third-party services to operate CompliantLens. Each has its own privacy policy governing data handling:

• Stripe — Payment processing and subscription management
• Google — OAuth authentication (optional sign-in method)
• Resend — Transactional email delivery
• Sentry — Error tracking and performance monitoring
• Render — Application hosting and infrastructure

5. Cookies & Tracking

CompliantLens uses session cookies for authentication. We do not use third-party advertising cookies or cross-site tracking. Sentry may set performance monitoring cookies to help us identify and fix errors.

6. Data Retention

• Account data: Retained while your account is active
• Deleted accounts: Personal data purged within 30 days, except billing records retained for 7 years for tax compliance
• Building data: Sourced from public records and retained indefinitely

7. Your Rights

You have the right to:

• Export your data: Use the "Export my data" button on the Settings page to download your profile and portfolio data
• Delete your account: Use the "Delete Account" option in Settings > Danger Zone
• Opt out of non-essential emails: Manage your notification preferences in account settings

8. Children's Privacy

CompliantLens is not directed at children under the age of 13. We do not knowingly collect personal information from minors. If you believe a child has provided us with personal information, please contact us and we will promptly delete it.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal information. Passwords are hashed using industry-standard bcrypt, all data is transmitted over encrypted connections (TLS), and MFA secrets are encrypted at rest. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a notice on the Service. Your continued use of CompliantLens after such changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy, please contact us at [email protected].