Privacy Policy
This explains what we collect about you, what we do with it, and how long we keep it. It also covers the separate and important question of personal information that appears in the public records we publish — information about people who never signed up with us.
1. What we collect about you
What you give us
- Your name, email address and password (stored only as a bcrypt hash — we never hold the password itself).
- For business accounts: company name, job title and contractor licence number where you supply them.
- For resident accounts: the street address you ask us to watch.
- Phone number, only if you provide one.
- The areas you watch, the service areas you draw, the filings you save, and the notes and project records you write.
What we generate as you use the service
- Sign-in records, including the IP address and browser user agent of each successful and failed attempt. This is what makes account lockout and "was that you?" possible.
- A log of messages we sent you — recipient, subject, category and outcome. We never store the body of a message, because those contain password reset links.
- Interface preferences: your saved filters, map settings and remembered views.
- Coordinates derived from addresses you enter, so we can work out what is near them.
- Error diagnostics when something breaks, which may include the page you were on. We do not record query strings, request bodies or authorisation headers.
Payment details
Payments are handled by Stripe. We receive a customer reference, the status of your subscription and the last four digits and brand of your card. We never receive or store your full card number.
2. What we use it for
- Running the service, and sending the alerts you asked for.
- Taking payment and managing your subscription.
- Security: detecting and blocking unauthorised access.
- Support, when you contact us.
- Understanding aggregate usage so we can improve the product.
We do not sell your personal information, and we do not share it with advertisers. We do not use it to build profiles for anyone else.
3. Who else processes it
We use a small number of service providers. Each receives only what it needs.
| Provider | What it handles |
|---|---|
| Amazon Web Services | Hosting and storage (United States) |
| Stripe | Payments and subscription billing |
| Postmark | Sending email |
| Anthropic | The optional AI assistant, where enabled |
| Twilio | Text message alerts, where enabled |
| Shovels | Supplementary construction data, where enabled |
We may also disclose information where the law requires it, or to protect our rights or someone's safety.
4. How long we keep it
These are the retention periods the system actually enforces.
| Data | Kept for |
|---|---|
| Your account and the work in it | Until you delete the account |
| Sign-in records | 90 days |
| Email log | 180 days |
| Alert delivery records | 180 days |
| Account activity log | 365 days |
| Error diagnostics | 30 days |
| Payment event records | 90 days |
| AI assistant conversations | 90 days |
| Password reset and verification tokens | 7 days |
Deleting your account removes your profile, watch zones, service areas, saved maps and filings, saved sites, leads, projects, alert rules, preferences, avatar and assistant conversations, and cancels any live subscription first. Some records we are required to keep for tax or legal reasons are retained.
5. Personal information in public records
ZoneNotice republishes records that Oregon cities, counties and state agencies already publish. Those records can name applicants, property owners, agents and contractors, and can include a business address and phone number. We also load the Oregon Construction Contractors Board's public register of active licences.
Where it comes from: entirely from public sources. We do not buy personal data, and we do not collect it from anywhere that is not already public.
Why we publish it: our legitimate interest in providing a professional information service about public construction and land-use activity — the same records, in a more usable form.
What we do not do: we do not publish personal email addresses harvested from filings, we do not compile profiles of individuals, and our Acceptable Use Policy forbids our customers from using contact details for unsolicited marketing.
Asking us to review a record about you
If you are named in a record and want it reviewed, email support@zonenotice.com with the subject "Record review", telling us your name and, if you can, the case number or address. We will:
- Confirm we have received it.
- Check the record against the jurisdiction's published version.
- Suppress your details from our service where we are able to, in a way that survives our next reload of the source.
- Tell you the outcome.
Two honest limits. We cannot change the jurisdiction's own record — that has to go to the city or county that published it, and we will tell you which one. And where a record is a public record we may be unable to remove it entirely; suppressing it from our copy does not remove it from the public register.
6. Your rights
You can see and change most of your information from your profile page. You can download your data as a CSV export, and delete your account from the billing page.
Depending on where you live you may have additional rights — to access, correct, delete or port your information, or to object to some processing. Email support@zonenotice.com and we will action it. We will not charge you or treat you differently for exercising a right.
7. Email you receive from us
Alerts and other non-essential email carry a one-click unsubscribe link that works without signing in. Service messages — password resets, address confirmations, billing notices — are part of having an account and cannot be unsubscribed from while the account is open.
8. Security
Traffic is encrypted in transit. Passwords are stored as bcrypt hashes and checked against known breach corpora at signup. Two-factor authentication is available, and its secrets are encrypted at rest under a separate key. Access to production systems is limited to those who need it.
No system is perfectly secure, and we do not claim otherwise.
9. If there is a breach
We have a written procedure for this, and we follow Oregon's Consumer Identity Theft Protection Act (ORS 646A.600 to 646A.628).
If your personal information is exposed, we will tell you without unreasonable delay and no later than 45 days after we discover it. Where the law requires it, we will also notify the Oregon Department of Justice. Our notice will say what happened, exactly what information was involved, what we have done about it, and what you should do — not a vague reference to "certain personal information".
Two things are worth knowing in advance. We never hold your card number — Stripe does, and we see only the brand and last four digits. And your password is stored as a bcrypt hash, not as text we could lose, with two-factor secrets encrypted at rest under a separate key.
10. Cookies and local storage
We use browser storage to keep you signed in and to remember small interface conveniences such as a collapsed panel or a chosen tab. We use no advertising cookies and no third-party analytics trackers. Preferences that should follow you between devices are stored on your account rather than in your browser.
11. Children
ZoneNotice is a business tool and is not directed at children. We do not knowingly collect information from anyone under 18. If you believe we have, tell us and we will delete it.
12. Changes
If we change this policy materially we will tell you before it takes effect. The date at the top always reflects the current version.
13. Contact
ZoneNotice LLC
support@zonenotice.com