Privacy Policy

1. Introduction

cite.codes ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and share information when you use our building code compliance and construction intelligence platform at cite.codes (the "Service").

We believe in plain language. This policy tells you what data we collect, why we collect it, who we share it with, and what control you have. By using our Service, you agree to the collection and use of information in accordance with this policy.

We do not sell your personal data. We never have and we never will.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Email Address - For authentication, order confirmation, and document delivery
• Name - For account personalization and document attribution
• Company Name (optional) - For contractor business records and document branding
• Password - Stored as a one-way hash; we never see or store your plaintext password

2.2 Project and Property Data

When you use our compliance tools, we collect:

• Property Addresses - For jurisdiction resolution, geocoding, and document reference
• ZIP Code - Used to resolve jurisdiction and applicable building codes
• Work Scopes - To determine applicable code sections

2.3 Uploaded Files

You may upload files to the Service, including:

• Photos - Property and project photos for photo packets and documentation
• Documents - Estimates, permits, and other project paperwork for scanning and analysis

Uploaded files are stored securely in Cloudflare R2 and are only accessible to you and any team members on your account. We do not use your uploaded files for training models or share them with third parties.

2.4 Storm Report Information

When you request a Storm Report, we collect:

• ZIP Code (required) - Used to identify the search area center
• Property Address (optional) - For geocoding and distance calculations
• Date Range (required) - Start and end dates for the storm event search
• Search Radius (required) - Distance in miles from property location
• Event Type Filters (optional) - Hail, wind, tornado, etc.

Note: We query public weather databases using this information. Your search parameters are used only for retrieving relevant storm data and generating your report. We do not share your location data with weather data providers beyond what is necessary to retrieve public records.

2.5 Automatically Collected Information

We automatically collect certain information when you use our Service:

• IP Address - For fraud prevention and rate limiting
• User Agent - To understand which browsers and devices access our service
• Referrer URL - To understand how users find our service
• Usage Analytics - Pageviews, feature usage, navigation patterns, and conversion tracking via PostHog

3. How We Use Your Information

We use the collected information for the following purposes:

• Document Generation - To resolve jurisdiction and generate compliance documents, storm reports, photo packets, and other deliverables
• Payment Processing - To process your payment through Stripe
• Document Delivery - To provide you with download access to your PDFs and generated files
• Customer Support - To respond to your inquiries and troubleshoot issues
• Service Improvement - To analyze usage patterns and improve our service through analytics
• Map and Location Features - To display interactive maps, hail maps, and canvassing tools via Mapbox
• Fraud Prevention - To detect and prevent fraudulent transactions
• Legal Compliance - To comply with applicable laws and regulations

4. Third-Party Services

We use the following third-party services to operate our platform. We only share the minimum data each service needs to function:

5. Data Storage and Retention

Your structured data (account info, project records, purchase history) is stored in our PostgreSQL database. Your files (PDFs, photos, documents) are stored in Cloudflare R2. Both systems are secured with encryption at rest and in transit.

We retain your information as follows:

• Account Data - Retained while your account is active and for 30 days after deletion request
• Payment Records - Retained for 7 years for tax and accounting purposes
• Generated Documents - Stored indefinitely to allow re-download access
• Uploaded Photos and Documents - Stored while your account is active; deleted within 30 days of account deletion
• Storm Reports - Stored indefinitely to allow re-download access
• Storm Search Parameters - Retained with the purchase record for report regeneration if needed
• Analytics Data - Aggregated data retained indefinitely; individual session data purged after 90 days
• Error Logs - Retained for 90 days via self-hosted Sentry

6. Your Rights

You have the following rights regardless of where you live:

• Access - Request a copy of all personal information we hold about you
• Correction - Request correction of inaccurate information
• Deletion - Request deletion of your account and personal information
• Data Export - Download your data in a machine-readable format (JSON/CSV)
• Opt-Out of Analytics - Disable PostHog tracking via your browser's Do Not Track setting or by contacting us
• Opt-Out of Marketing - Unsubscribe from any marketing emails at any time

To exercise these rights, contact us at support@cite.codes. We will respond to your request within 30 days.

7. We Do Not Sell Your Data

We do not sell, rent, or trade your personal information to anyone. We do not share your data with third parties for their own marketing purposes. The only third parties that receive your data are the service providers listed in Section 4, and only to the extent needed to operate our platform.

8. Security Measures

We implement industry-standard security measures to protect your information:

• TLS/SSL encryption for all data in transit
• Encryption at rest for database and file storage
• Secure payment processing via PCI-DSS compliant Stripe
• Password hashing (never stored in plaintext)
• Regular security audits and updates
• Access controls and authentication for internal systems
• Automated error monitoring and alerting

9. Cookies

We use a limited number of cookies and similar technologies:

• Authentication Cookies - Essential cookies to keep you logged in and maintain your session
• Preference Cookies - To remember your settings like theme (light/dark mode) and display preferences

We do not use cookies for advertising or cross-site tracking. Third-party services (Stripe, PostHog) may set their own cookies as described in their respective privacy policies linked in Section 4.

10. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act and the California Privacy Rights Act:

• Right to know what personal information is collected, used, shared, or sold
• Right to delete personal information held by us
• Right to correct inaccurate personal information
• Right to opt-out of sale or sharing of personal information (we do not sell or share personal information for cross-context behavioral advertising)
• Right to limit use of sensitive personal information
• Right to non-discrimination for exercising your privacy rights

To exercise these rights, email us at support@cite.codes with "CCPA Request" in the subject line. We will verify your identity and respond within 45 days.

11. European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation (GDPR):

• Legal Basis - We process your data based on: (a) your consent, (b) performance of our contract with you, (c) our legitimate business interests, or (d) legal obligations
• Right of Access - Request a copy of your personal data
• Right to Rectification - Correct inaccurate or incomplete data
• Right to Erasure - Request deletion of your personal data ("right to be forgotten")
• Right to Restrict Processing - Limit how we use your data
• Right to Data Portability - Receive your data in a structured, machine-readable format
• Right to Object - Object to processing based on legitimate interests, including profiling
• Right to Withdraw Consent - Withdraw consent at any time where processing is based on consent

To exercise these rights, email us at support@cite.codes with "GDPR Request" in the subject line. We will respond within 30 days.

You also have the right to lodge a complaint with your local data protection supervisory authority if you believe we have not handled your data appropriately.

12. International Data Transfers

Our Service is hosted in the United States. If you access our Service from outside the United States, your information will be transferred to, stored, and processed in the United States. We take steps to ensure your data is treated securely and in accordance with this Privacy Policy regardless of where it is processed.

13. Children's Privacy

Our Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us and we will promptly delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. For significant changes, we will also notify you by email (if you have an account). Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.

15. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: