Last updated: September 2026
PermitIntel is operated by Contract Advantage LLC, a Florida limited liability company ("we," "us," "our"). This policy covers permitintel.ai, the PermitIntel Data API, and the Supplier Portal at /app. It is written to describe what the product actually does rather than to cover every possibility, so if something here does not match what you see, tell us and we will fix one or the other.
Your use of the API is also governed by our Data API Terms of Service. Section 7 of those terms covers the contact information the API returns about contractors, which is a different subject from this policy and is summarized near the bottom of this page.
We run Microsoft Clarity on this site. Clarity is a session-recording and heatmap tool: it reconstructs what happened in your browser on our pages, including mouse movement, clicks, scrolling and how you moved between pages, and it records technical details such as your browser, your operating system, your screen size, the page you arrived from, and an approximate location derived from your IP address. We watch those recordings to find pages that are confusing or broken.
Two things you should know rather than have to discover. First, the tag is loaded site-wide, which includes the pages you see after you sign in to the Supplier Portal, so a recording can show the data displayed on your screen there. Second, we explicitly mask the API key shown on the trial confirmation screen so that it is never captured.
Clarity is a Microsoft product and Microsoft processes this data under its own terms. Their privacy statement is at privacy.microsoft.com/privacystatement. If you do not want to be recorded, blocking clarity.ms in your browser or with any tracker-blocking extension stops it, and the site works normally without it. You can also write to us and we will tell you what we can see.
Clarity is the only third-party analytics or recording tool on the site. We run no advertising pixels, no ad-network tags and no cross-site tracking.
Your email address, and the name, company, intended use and country you type into the form. We also record the IP address and browser user-agent string the request arrived with, and the time you accepted the Data API Terms of Service along with the version you accepted. If you sign in with Google to prove you own the address, we receive your Google account identifier, your email and your basic profile from Google, and nothing else: the sign-in is scoped to openid email profile.
Authentication runs on Supabase Auth, with either an email address and password or Google sign-in. We never see your password: Supabase stores it hashed. Administrator accounts additionally use a time-based one-time code. For each seat we store the email address, the display name and title you enter, the role on the account, and an identifier for the current session so that one seat cannot be used from two places at once.
Every call is logged against the API key that made it. The log holds the key identifier, the time, the path, the query string, the number of records returned, the HTTP status, any error, and how long the call took. It does not hold your IP address. We also keep a monthly per-key total of calls and records, which is what the meter on /api/v1/usage and your invoice are built from. Because the query string is part of that record, do not put anything confidential in a query parameter.
We record activity per seat: sign-ins, page views, profile views, opening a contractor record, adding one to your book, exports, and invitations sent. Each of those entries carries a hashed IP address and a hashed user-agent string, not the values themselves. This is how seat counts, export allowances and the "who on my team is using this" view are calculated.
Payments run through Stripe. Card numbers are entered on Stripe's own pages and we never see or store a card number. What we store is the Stripe customer and subscription identifiers, and, for free trials, the domain of your billing email and the opaque fingerprint Stripe returns for the card or bank account you pay with. That fingerprint is not a card or account number and cannot be turned back into one. We use it for one purpose: stopping the same card or bank account from starting a second free trial under a new account.
Signup forms are protected by Cloudflare Turnstile, which receives the challenge token and your IP address in order to decide whether you are a person. Transactional email, such as your API key, trial reminders and account notices, is sent from records@permitintel.ai over Google's mail servers.
We do not sell personal information, we do not share it with advertisers, and we do not use it to build profiles for anyone else.
These are the companies that process data on our behalf, by name:
We may also disclose information if the law requires it, or where we need to in order to establish or defend a legal claim. If the business is ever sold or merged, customer records would move with it, and this policy would follow them until it is replaced by one you are told about.
PermitIntel is a United States product built on United States public records, sold to a United States market. The application and the database run in US regions on our providers' infrastructure, so anything you give us is processed in the United States. If you are using the service from outside the US, that is where your data goes.
Some US states give residents specific rights over their personal information, and the details differ state by state. Rather than reprint a table of statutes, we will do the same thing for anyone who asks: tell you what we hold, correct it, or delete it, on the terms in section 7. Write to us.
Account records, keys and billing history are kept for as long as your account exists and afterwards for as long as we need them for tax, accounting and dispute purposes. Request logs, usage counters and portal activity are kept for operations, billing and abuse prevention.
We are not going to quote you a retention schedule we have not built. There is no automatic deletion job running today, and saying otherwise would be a promise rather than a description. If you want your data removed, ask, and read the next section for what we can and cannot do.
Write to info@permitintel.ai from the address on your account and tell us what you want: a copy of what we hold about you, a correction, or deletion. We will answer you and tell you what we did.
Two honest limits. We will keep what we have to keep for billing, tax and legal reasons, and we will keep the minimum needed to stop a deleted account from being used to start a fresh free trial. Anything else goes.
We are a small company and we do not run a ticketing system for this. You will get a person.
Separately from anything above: the API returns building permit records and contractor license information sourced from public records published by permitting authorities and by the Florida Department of Business and Professional Regulation. Some of that is personal information about identifiable people, usually in a business capacity. It is not collected from you and it is not collected from the contractor. Section 7 of the Data API Terms of Service sets out what customers are allowed to do with it.
If you are a contractor and a record we publish is wrong, write to info@permitintel.ai and we will check it against the source. Note what that means: where the underlying public record itself is wrong, the correction has to be made with the authority that issued it, because we are reflecting their record and not replacing it.
PermitIntel is not a consumer reporting agency and this data is not a consumer report. It must not be used to decide anyone's eligibility for credit, insurance, employment or housing.
Traffic to the site and the API is encrypted in transit. Database credentials and service keys are held server-side and never shipped to a browser. Administrator access requires a second factor. We have not been audited against SOC 2, ISO 27001 or any other certification, and we are not going to imply that we have. If your procurement process needs one, tell us before you buy.
This is a business product. It is not directed at children, we do not knowingly collect information from anyone under 18, and if we learn that we have, we will delete it.
If we change this policy we will change the date at the top. If the change is a significant one for existing customers, we will email the address on the account rather than rely on you noticing.
Contract Advantage LLC, operator of PermitIntel.
info@permitintel.ai