Legal
Privacy Policy
Site selection is competitively sensitive, so this policy is specific about what we store, who processes it, what leaves our systems, and the one line we will not cross: your site searches never reach analytics.
Version 2026-08-28
What we collect
- Account data, your name, email, and password credential, handled by our authentication layer (Better Auth on Neon). We store a password hash, never the password itself.
- Site coordinates and resolved results, for each lookup, the resolved latitude/longitude and the screening result and tier, so your history is useful and so we can flag changes to a site you screened.
- Saved designs and projects, the configurations you build and choose to save, including the address you save with a project.
- Usage analytics, only after you consent, and only as bucketed, non-identifying feature events (see below).
- Contact submissions, the name, email, and message you send through our contact form.
What we do not collect
- Raw address strings for unsaved lookups. A lookup stores resolved coordinates and the result, not the address text you typed. The raw address is persisted only when you explicitly save a project. This is described in full on our data-handling page.
- Payment details, there is no payment.
- Any data sold to or purchased from a data broker or ad network.
Service providers we share data with
We use the following processors to run the service. Each receives only the data it needs for its function, and none is permitted to use your data for its own purposes:
- Better Auth / Neon Auth, identity and session management.
- Neon, our primary Postgres database (accounts, lookups, saved projects).
- Vercel, application hosting and delivery.
- Mapbox and the U.S. Census Geocoder, address-to-coordinate geocoding (see the next section).
- Resend, transactional email, such as verification messages.
- Upstash, rate limiting (a hashed identifier, not your identity).
- Google Analytics, product analytics, only after you consent.
Geocoding: addresses leave our systems
- An address you enter is transmitted to a third-party geocoding provider (Mapbox, or the U.S. Census Geocoder) to resolve it into coordinates. This is a plain fact of how screening works: the address text leaves our systems and is sent to that provider at the moment you run a lookup.
- We tell you this directly rather than burying it, because a company screening confidential sites has a legitimate interest in knowing the address leaves the building. We choose geocoding providers with storage-appropriate terms, and we do not ourselves persist the raw address for an unsaved lookup, but the transmission to the geocoder happens, and you should know it does.
How long we keep it
- Account data, for the life of your account, until you delete it.
- Lookup history (coordinates + result), until you delete the entry or your account.
- Saved projects and generated documents, including the files behind them, until you delete the project or your account.
- Policy acceptance records, kept while your account exists as proof of the terms you agreed to, and deleted together with the account.
- Analytics events, retained by Google Analytics per its configured retention; they contain no site or personal identifiers.
- Contact submissions, retained while we handle your inquiry and for a reasonable follow-up period. These are correspondence with our team, not account data: they carry no link to your account, so deleting your account does not remove them. Ask us to delete a submission and we will.
- Administrative action records, if a member of our team ever takes an account action (for example suspending an account or changing a lookup limit), we keep an append-only record of that action, its reason, and when it happened, for accountability and abuse investigation. Because its purpose is to record what we did, this record is retained even after the affected account is deleted.
Apart from the two retained records named above, there is no background expiry you have to trust, the deletion control acts immediately.
Your rights and deletion
You can view what is stored and delete it yourself from your account page, individual lookups, individual saved projects, or your entire account. Deleting the account removes your profile and credentials, your lookup history, your saved projects, your generated documents and their files, and your policy acceptance records, in a single all-or-nothing operation. The two exceptions are named under “How long we keep it” above: any administrative action record about the account, and contact-form submissions, which are not linked to your account. Deletion is immediate and scoped strictly to your own account.
Depending on where you live, you may have additional rights under laws such as the GDPR (EU/UK) and CCPA/CPRA (California):
- GDPR, rights of access, rectification, erasure, restriction, portability, and objection. Our legal basis is legitimate interest in operating the service you requested, and consent for analytics. You may lodge a complaint with your supervisory authority.
- CCPA / CPRA, rights to know, delete, and correct personal information, and to opt out of “sale” or “sharing.” We do not sell or share personal information as those terms are defined, and we do not use it for cross-context behavioral advertising.
To exercise a right that the self-service controls do not cover, contact us at the address below.
Cookies
Strictly necessary
- Sign-in session cookies, so you stay logged in
- Your cookie-consent choice
Required for the site to work and not covered by the consent banner.
Analytics (optional)
- Google Analytics 4, only after you Accept
Denied by default. Turned on only by your explicit choice.
Analytics, and your choice
We use Google Analytics 4 to understand which parts of the product are used, so we can improve them. Analytics storage is off by default for everyone, we set Google's Consent Mode to deny analytics and advertising storage until you make a choice. Nothing is written to an analytics cookie until you press Accept, and you can change your mind at any time using the control above.
What we never send to analytics
The following are never sent to Google Analytics, not as an event parameter, not in a page path, not as a custom dimension:
- Any site address you enter
- Any coordinate or parcel identifier
- Your company name or email
This is enforced in the code, not just promised. Events flow through a single typed helper whose parameters are a fixed list of buckets and categories, so a coordinate or address cannot be attached to an event even by mistake. Counts like rack quantity and confidence are bucketed into ranges before they leave, and the reported page path for a site screening is always just /site, with the address query string stripped off.
International data transfers
Our processors may store or process data in the United States and other countries. Where data is transferred out of the EU/UK, that transfer relies on an appropriate safeguard such as the European Commission's Standard Contractual Clauses, applied by the relevant processor. (Specific transfer mechanisms to be confirmed with counsel.)
Security
We protect your data with encryption in transit, hashed passwords, per-account scoping on every query that touches your data, hashed IP addresses rather than raw ones for rate limiting and acceptance records, and least-privilege access to production systems. No system is perfectly secure, but confidentiality of site searches is a design goal, not an afterthought.
Contact
Questions about this policy or a request about your data can be sent to privacy@rackflow.example. (Contact address to be finalized.)