Draft notice: This Privacy Policy describes how Permit Pulse LLC ("PermitArc," "we," "us," or "our") handles information when you use the PermitArc application and related services (the "Service"). Counsel review is recommended before paid launch.
1. Overview
We collect information needed to operate a compliance intelligence platform: account credentials, business locations, uploaded compliance documents, AI chat history, alert preferences, and usage data. We do not sell your personal information.
2. Information we collect
Account and profile
- Email address and authentication identifiers (via Supabase Auth).
- Name, business contact details, and communication preferences you provide.
Business and compliance data
- Storefront names, addresses, business types, and jurisdiction fields.
- Documents you upload or scan (PDFs, images) and metadata extracted from them (permit numbers, expiration dates, agencies, etc.).
- Notes and binder fields you save in the app.
AI and activity data
- Chat prompts, voice transcripts (when you use voice input), and AI responses.
- Compliance intelligence log entries and saved answers.
- Interactive AI usage metering data (for monthly allowance tracking).
Device and technical data
- Device tokens for push notifications (when enabled).
- IP address, browser or app type, and diagnostic logs for security and rate limiting.
3. How we use information
We use information to:
- Provide, maintain, and secure the Service.
- Extract document fields, index content for AI search, and answer your questions in context.
- Send expiration alerts, patrol summaries, and notifications you configure (email, SMS, Discord, push).
- Enforce rate limits, prevent abuse, and improve reliability.
- Comply with law and respond to valid legal requests.
4. AI processing
Document scans and chat features send relevant text and images to AI services (currently Google Gemini via our Supabase edge functions) for processing. We use AI to extract fields, generate summaries, and assist with regulatory questions grounded in your vault and verified sources.
We do not use your uploaded documents or chat content to train public AI models for general use. Processing is limited to delivering the Service to your account.
5. How we share information
We share information only as needed to operate the Service:
Service providers (sub-processors)
- Supabase — authentication, database, file storage, and serverless functions.
- Google (Gemini / related APIs) — document AI extraction and chat inference.
- Email delivery providers — transactional and alert email.
- Twilio (or similar) — SMS alerts when you enable SMS.
- Discord — webhook delivery when you configure a Discord channel.
- Firebase Cloud Messaging (FCM) — mobile push when enabled.
- Payment processor (e.g., Stripe) — when paid subscriptions launch; we do not store full payment card numbers on our servers.
Legal and safety
We may disclose information if required by law, to protect rights and safety, or to investigate abuse.
We do not sell personal information. We do not share your data with advertisers for cross-context behavioral advertising.
6. Data retention
We retain account and compliance data while your account is active. You may delete storefronts and documents from within the app. If you request account deletion, we will delete or anonymize personal information within a reasonable period, subject to backups, legal holds, and logs retained for security.
7. Security
We use industry-standard measures including encrypted transport (HTTPS), access controls, and cloud infrastructure security. No method of storage or transmission is 100% secure; you use the Service at your own risk.
8. Your choices and rights
- Update profile and communication settings in the Intel Deck.
- Delete documents and locations in the app.
- Opt out of non-essential notifications by turning channels off.
California residents (CCPA/CPRA)
You may have the right to know, access, delete, and correct personal information, and to opt out of sale or sharing (we do not sell personal information). To exercise rights, contact support@permitarc.com. We will not discriminate against you for exercising privacy rights.
9. Children
The Service is for businesses and is not directed to children under 16. We do not knowingly collect personal information from children.
10. International users
Our infrastructure is primarily located in the United States. If you access the Service from outside the U.S., you consent to processing and storage in the U.S. and other countries where our providers operate.
11. Changes to this policy
We may update this Privacy Policy. Material changes will be posted in the app or on our website with a revised effective date.
12. Contact
Permit Pulse LLC — privacy requests: support@permitarc.com