Information we collect
Information you give us
- Account details: name and email address.
- Google sign-in: if you choose Continue with Google, we keep only your name, email address and Google account ID from Google. We do not store Google's sign-in tokens or your profile photo.
- Messages to us: what you send to contact@hvaclookout.com, including correction and removal requests.
Information collected when you use the service
- Usage data: pages viewed, searches and filters you save, records you follow or export, and the time of each action. When you download a building's permit timeline, we record your account, the building (its BBL) and the time, to apply the free download limits.
- Device and log data: IP address, browser type and basic request logs, used for security, rate limiting and fixing errors.
- Cookies: cookies needed to keep you signed in, remember your analytics choice and protect forms from abuse (Cloudflare Turnstile).
Payment information
Payments are handled by Stripe. We receive the payment status, plan and the last four digits and expiry of your card; we do not receive or store your full card number.
Public-record information
Signals (opportunity records) come from public sources published by government agencies, such as building permits and emissions filings. They mainly describe buildings and businesses, and can include business names and roles such as an applicant or a licensed contractor. We do not show individual property owners' names in the paid app, and owner names in public sample records are masked. You can ask us to review a record about you; see "Your choices and rights".
How we use information
We use personal information to:
- provide the service: create your account, show records, run exports and unlock company contacts;
- bill you and manage your subscription through Stripe;
- send service emails, such as alerts you set up, receipts and notices about changes to these documents;
- keep the service secure, prevent abuse and enforce our Terms of Service;
- understand how the service is used so we can improve it.
We send marketing emails only to people who have agreed to receive them, and every marketing email has an unsubscribe link.
Product analytics
We keep our own record of how the service is used, so we can see which pages, tools and plans are useful and fix what is not. It covers the type of page you open (not its full address), the tools and buttons you use, sign-ups, sign-ins, exports and plan purchases, and where your first visit came from (the referring site and any campaign tags in the link).
It holds no IP address, browser details, text you type into forms, street addresses or building identifiers. Visitors who are not signed in get a random identifier stored in a cookie on this site; when you sign in, that identifier is linked to your account.
If you visit from the EU, EEA, UK or Switzerland, or we cannot tell where you are, we record nothing linked to you or your account until you accept: only an anonymous count of page types. If you decline, it stays that way. Elsewhere this record is on by default, and you can turn it off by declining in the same choice.
We keep these records only as long as we need them to understand how the service is used, then delete them. When you delete your account, we delete the records linked to it.
How long we keep information
We keep your account information while your account is open. After you delete your account, we keep only what we need for refunds and chargebacks, legal and tax obligations, preventing fraud and enforcing our terms, and then delete it or remove what identifies you.
Server and security logs are kept only as long as we need them for security and fixing errors.
Payments are processed by Stripe. We keep records of your subscription and invoices for as long as tax and accounting laws require.
Export files are kept for a short time so you can download them again, then deleted.
Your choices and rights
You can:
- update your account and company details in settings;
- cancel your subscription from the billing page;
- turn off alerts and unsubscribe from marketing emails using the link in any email;
- ask us for a copy of your personal information, or ask us to correct or delete it;
- ask us to review or remove a public-record entry about you.
Email contact@hvaclookout.com. We may need to confirm your identity before acting on a request. Depending on where you live, for example in California, you may have additional rights under local law, including the right not to be treated differently for using them. We will respond within the time the applicable law requires.
Security
We use encrypted connections, restrict access to personal information to people and systems that need it, and keep payment card data with Stripe. No system is completely secure; if you think your account has been compromised, contact us right away.
Where information is processed
HVACLookout is run on cloud infrastructure, and your information may be processed in the United States and other countries where our service providers operate.
Children
HVACLookout is a business service and is not directed to anyone under 18. We do not knowingly collect children's personal information.
Changes to this policy
We may update this policy. If a change is material, we will email account holders before it takes effect. The date at the top shows the latest version.
Contact
contact@hvaclookout.com