Privacy Policy
1. Information We Collect
1.1 Information You Provide
| Data Type | Examples | Purpose |
|---|---|---|
| Account Information | Email address, password (hashed), name | Account creation, authentication, communication |
| Payment Information | Credit card details (processed by Stripe) | Credit purchases, billing |
| Property Addresses | Addresses you search for reports | Report generation, saved reports, search history |
| Problem Reports | What you write in "Report a problem", the report it is about (with its address and map coordinates), your browser's identification string, and which page you were on | Fixing errors and replying to you |
1.2 Automatically Collected Information
| Data Type | Examples | Purpose |
|---|---|---|
| Usage Data | Report generation timestamps, credits used | Service improvement, fraud prevention |
| Technical Data | IP address, browser type, device info | Security, analytics, troubleshooting |
| Authentication Token | Login token stored in your browser | Keep you logged in |
2. How We Use Your Information
- Provide the Service: Generate property reports, manage your account, process payments
- Communicate: Send service updates, email verification, respond to support requests, send receipts
- Improve: Analyze usage patterns, fix bugs, enhance features
- Security: Detect fraud, prevent abuse, enforce Terms of Service
- Legal Compliance: Comply with laws, respond to legal requests
3. How We Share Your Information
We share information with the following service providers, only as needed to operate the Service:
3.1 Service Providers
| Provider | Purpose | Data Shared |
|---|---|---|
| Render | Application hosting and database storage | All account and report data |
| Stripe | Payment processing | Payment information, email |
| Resend | Sending email (verification, account notices, and problem reports you send to our support inbox) | Email address; for a problem report, also your name, what you wrote, the report's address and map coordinates, your browser's identification string and which page you were on |
| Google (Gmail) | Our support inbox, where problem reports and your emails to us arrive | Whatever you send us, including problem reports as described above |
| Google (Geocoding API and Solar API) | Finding the building's exact location, and measuring its roof from aerial imagery | The property's standardized address (Geocoding) and its coordinates (Solar) |
| Town assessing websites (hosted for the town by Vision Government Solutions, Patriot Properties, Tyler Technologies, or the City of Dover with Sanborn's MapGeo) | Reading the town's public property record | The house number and street name of the property. Nothing about you |
| State of Connecticut parcel map service (Connecticut Office of Policy and Management, GIS Office: the "Connecticut CAMA and Parcel Layer") | Reading the town assessor's public building details (year built, living area and similar) for Connecticut properties | The property's map coordinates. Nothing about you |
| MassGIS parcel map service (MassGIS, Bureau of Geographic Information, Commonwealth of Massachusetts EOTSS: the "Massachusetts Property Tax Parcels" layer) | Reading the town assessor's public building details (year built, living area, stories and similar) for Massachusetts properties | The property's map coordinates. Nothing about you |
| FEMA & USDA (U.S. government) | Flood and soil data lookups | Property coordinates |
| U.S. Census Geocoder | Converting an address to map coordinates | Property address you enter |
These lookups are made by our servers, not by your browser, so Google, the town sites, the State of Connecticut, MassGIS, FEMA, USDA and Census see our server's address rather than yours, and never your name, email or account. Google's handling of the data it receives is governed by the Google Privacy Policy. Town records can include the owner's name; we read only the building details (year built, size, roof, siding and similar) and do not copy or keep owner names or mailing addresses. For Connecticut we ask the state's service for named building fields only; owner, co-owner, mailing-address and sale-party fields are never requested. For Massachusetts we ask MassGIS's service for named building and property-address fields only; the owner name, owner mailing address and sale fields are never requested.
Aerial map when you confirm a building: When you confirm a building on the map before a report is made, your browser loads aerial imagery from the U.S. Geological Survey (The National Map). The Survey receives your IP address, like any website you load images from. We do not send it your address or account details.
3.2 Legal Requirements
We may disclose your information if required by law, court order, or to comply with legal process, protect our rights and property, prevent fraud or security threats, or protect user safety.
3.3 Business Transfers
If BuildReport is acquired or merged, your information may be transferred to the new owners.
4. Data Storage and Security
4.1 Where We Store Data
- Location: Render infrastructure in the United States
- Duration: Account data stored while your account is active; reports stored so you can access them in your account
- Lookup cache: To avoid asking the same source twice, we keep the answers from Google, the town sites, FEMA and USDA for an address or location for 30 days. Expired answers are deleted automatically, at the latest a few hours after the 30 days are up
- Saved reports: A saved report keeps the figures, sources and addresses shown in it, but not Google's roof geometry. The roof plan drawing is made again from Google's aerial data when you open a report
4.2 Security Measures
- Passwords hashed with a salted scrypt algorithm (we never store your plaintext password)
- HTTPS encryption for all data transmission
- Secrets stored as protected environment variables, not in source code
- Email verification required before free credits are granted
- Repeated wrong passwords and password-reset requests are refused for a while: we count them by email address and by network (IP) address, and keep those counts for about 2 days. We also remember the networks you log in from for 90 days, so that lock doesn't apply to you there
- Password-reset links work once and expire after 1 hour; we store only a scrambled copy of the link's code
- Changing or resetting your password logs out your other devices
5. Your Privacy Rights
5.1 Access and Portability
- Request a copy of your personal data
- Download your generated reports
- See your credit history (purchases, free credits and reports) on the Account page
5.2 Correction and Deletion
- Correct: Change your name and password on the Account page
- Delete: Delete your account yourself on the Account page. Your account and saved reports are deleted immediately. You can also ask by emailing surryvillagecreations@gmail.com
5.3 Marketing Communications
- We do not send marketing emails unless you opt in
- Transactional emails (receipts, verification, password resets) cannot be opted out
6. Cookies and Local Storage
6.1 Essential
We store an authentication token in your browser to keep you logged in. This is required for the Service to function.
6.2 Analytics
We do NOT currently use third-party analytics. This may change in the future with notice.
7. Third-Party Links
Reports or the site may contain links to external websites. We are not responsible for the privacy practices of those sites.
8. Children's Privacy
BuildReport is not intended for users under 18. We do not knowingly collect information from children.
9. International Users
Our service is based in the United States. If you access it from outside the US, your data will be transferred to and processed in the United States.
10. California Privacy Rights (CCPA)
If you are a California resident, you have the right to know what data we collect, request deletion, and opt out of any sale of personal information (we do not sell it). We will not discriminate against you for exercising these rights. Email surryvillagecreations@gmail.com to make a request.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be announced by email and/or a prominent notice on the website. Continued use after changes constitutes acceptance.
12. Contact Us
- Email: surryvillagecreations@gmail.com
- Operator: BuildReport — Surry Village Creations LLC (New Hampshire). Please contact us by email
13. Data Retention
| Data Type | Retention Period |
|---|---|
| Account Information | While your account is active. Deleted immediately when you delete your account |
| Generated Reports | While your account is active (accessible in your account). Deleted immediately with your account |
| Lookup cache (Google, town, FEMA and USDA answers for an address) | 30 days (deleted automatically within a few hours after that) |
| Payment Records | 7 years (tax/legal requirements). When you delete your account, your email address is removed from them, including any payment made under that email address, and from any payment that arrives after the account is deleted |
| Problem reports you send | While your account is active; deleted with your account. Each is also emailed to our support inbox, where we keep it until we have dealt with it |
| Failed log-in and password-reset counts (email or IP address, and the time) | About 2 days |
| Networks you have logged in from (your email and the network's IP address, and the time), so that a lock against someone guessing your password doesn't lock you out at home | 90 days after your last log-in from that network; deleted with your account |
| Record that an email address has had its free sign-up credits | Kept after the account is deleted, as a one-way code made from the address (not the address itself), so free credits are given once per email |
| Usage Logs | 90 days |
| Backups | Our hosting provider keeps database backups for a limited time, so deleted data can remain in a backup until it expires |