Privacy Policy

Our privacy policy and how we use your data

Last updated: October 21, 2026

This Privacy Policy explains what information Permitful collects, how We use it, who We share it with and the choices You have. It applies to the website at permitful.com and the Permitful application (the "Service").

In short:

Your projects are private unless You publish a Public Dashboard or share Your Calendar Feed link.
We do not sell Your personal information or share it for targeted advertising.
We send project details to outside providers only to run the Service, for example to OpenAI when You run Permit Advisor.

Who We Are

Company ("We", "Us" or "Our" in this Privacy Policy) means Gavin Grant Consulting, a sole proprietorship owned by Gavin Grant, which operates Permitful, 1362 Frankfort St APT 4301, San Diego, CA 92110.
You means the person using the Service.
Service Provider means a company that processes information on Our behalf to help run the Service.

The Service is operated from the United States and designed for building projects in the United States.

Information We Collect

Information You give Us

Account information: Your email address and password (stored only in hashed form). If You sign in with Google, Google gives Us Your name, email address and profile picture.
Profile: the name and picture You set in Settings → Profile, often a company name and logo.
Projects and permits: project names, addresses, types, descriptions, floor areas, numbers of stories and drawing-set links; permit types, agencies, statuses and status history, permit numbers, fees, expiration dates and descriptions; and milestone names, dates, notes and privacy settings. This information may include details about Your clients and their properties.
Messages: the name, email address and message You send through Our contact form, and any emails You send Us.

Information created as You use the Service

Permit Advisor results: the permits suggested for a project and whether You have reviewed them. We keep a record of each run, including after the project is deleted, to apply plan limits.
Billing information: Your plan, Subscription status, billing period and Stripe customer ID. Stripe collects Your payment details directly; We never receive Your full card number.
Email preferences: which onboarding emails We have sent You, and whether You have unsubscribed from them.

Information collected automatically

Server logs: Our hosting providers record requests to the Service, including IP address, browser type and the pages requested, to operate and secure the Service.
Analytics: Google Analytics records the pages You visit and actions such as signing up, creating a project or upgrading, together with Your browser, device type, approximate location (derived by Google from Your IP address) and a pseudonymous identifier stored in a cookie. We remove sharing-link tokens, project names and sign-in codes from what We send.
Advertising and campaign information: see Advertising Measurement below.
Cookies and local storage: see Our Cookie Policy.

How We Use Information

To provide the Service and the features You use.
To manage Your Account and Subscription and process payments.
To send You emails about Your Account: confirming Your email address, resetting Your password, and a few emails in Your first days that help You get started (for example, a reminder to add Your first project). Onboarding emails have an unsubscribe link. Stripe sends payment receipts and billing notices. We do not send newsletters or promotional emails.
To answer Your messages and support requests.
To keep the Service secure, including checking that sign-ups and contact messages come from people rather than bots, and preventing abuse of plan limits.
To understand how the Service is used, fix problems and improve it, and to measure which of Our ads lead to sign-ups and purchases.
To comply with the law and enforce Our Terms.

What Others Can See

Public Dashboards

A project is private until You make it public. A public project's dashboard can be viewed, without signing in, by anyone who has its link. It shows:

the name and picture on Your profile;
the project's name, address, type, description, floor area, number of stories and drawing-set link;
each permit's type, agency, status, permit number, fee and last update; and
milestones and their dates, except those You mark private.

It never shows Your email address, milestone notes, permit descriptions, expiration dates or private milestones. Public Dashboards ask search engines not to index them.

Calendar Feed

If You set up the Calendar Feed, anyone with its link can read Your project names, permit types, agencies and permit numbers, milestone names, dates and whether they are complete (including private milestones), and permit expiration dates. Each event also links to the permit in Permitful, which only You can open. Milestone notes are never included. The calendar service You subscribe with, such as Google Calendar, Apple Calendar or Outlook, fetches the feed and handles it under its own privacy policy. You can reset the link in Settings → Calendar.

Service Providers

We share information with the following Service Providers, only as needed for the purposes described:

Supabase (database and sign-in): stores Your Account and Content in its West US (Northern California) region. Privacy policy
Vercel (website hosting): serves the Service and keeps server logs. Privacy policy
Stripe (payments): processes Subscriptions. Its checkout form appears on Our billing page, and Stripe collects Your payment details directly. Privacy policy
Resend (email delivery): sends account emails (email confirmation and password reset), onboarding emails and contact-form messages. Privacy policy
Cloudflare Turnstile (bot protection): checks the sign-in, sign-up, password-reset and contact forms using information about Your browser and device. Privacy policy
Google: Google Sign-In, if You choose it; Google Analytics and Google Ads measurement (below); Google Maps, which suggests addresses as You type a project's location, so Google receives what You type and Your IP address; Google Programmable Search, for Permit Advisor (below); and YouTube, only if You play the video on Our home page. Privacy policy
OpenAI, Perplexity and Brave: for Permit Advisor (below).

Permit Advisor

Permit Advisor runs when You create a project with the "Find permits with Permit Advisor" option on, and when You run it from a project's page. To produce its suggestions:

We search government websites for the project's jurisdiction with one search provider: Google Programmable Search, Perplexity or Brave Search. The search queries contain only the project's city, state and project type, plus general words such as "pool" or "septic" when the description mentions that kind of work, never the project's name, street address or the description itself.
We send the project's name, full address, type, description, floor area and number of stories, the permits already on the project and the search results to OpenAI's API, which generates the suggestions. We do not send Your name, email address or other Account details. OpenAI does not use data sent through its API to train its models, and may keep it for a limited time to monitor abuse. We do not use Your project details to train any model.

You can keep a project out of Permit Advisor by turning the option off when You create it and not running it afterwards. No other part of the Service sends project details to these providers. See OpenAI's, Perplexity's and Brave's privacy policies.

Analytics and Advertising Measurement

We use Google Analytics to understand how the Service is used, and Google Ads to advertise it. We have turned off ad personalization for this data: We do not use it to show You personalized ads, and We do not send Google Your name or email address.

When You arrive from an ad or a tagged link, We record the ad click identifier (such as Google's gclid), the campaign details in the link (source, medium and campaign name), the page You landed on and the referring website, and keep them in Your browser's local storage for up to 90 days. If You create an Account, We store this information with it, together with the pseudonymous identifiers Google Analytics assigned to Your browser. If You confirm Your email address or subscribe in a different browser or on a different device, Our servers send that event to Google Analytics with those identifiers, so that Google can credit the ad that brought You.

In the European Economic Area, the United Kingdom and Switzerland, Google Analytics and Google Ads set no cookies until You accept them, though Google Analytics may still record cookieless page visits that do not identify Your browser. Where We ask for Your consent, the campaign information above is kept only once You accept, and rejecting deletes it from Your browser. Anyone can accept or reject at any time from Cookie Settings. You can also install Google's Analytics opt-out add-on.

Other disclosures

We may disclose information if required by law or valid legal process, to protect the rights, property or safety of the Company, Our users or others, or to investigate a breach of Our Terms. If Permitful is sold or transferred, Your information may be transferred to the new owner, who must continue to honour this Privacy Policy or tell You before applying a different one.

We do not sell personal information, and We do not share it with third parties for cross-context behavioral advertising.

How Long We Keep Information

Your Account, Content, Permit Advisor records and email preferences are kept until You delete them or Your Account. Deleting a project deletes its permits and milestones.
Deleted data may remain in Our database backups for a limited time until they are overwritten.
Campaign information stored with Your Account is kept until You delete Your Account.
Stripe keeps billing and payment records, including after You delete Your Account, for as long as tax and accounting laws require.
Google Analytics data is kept for the retention period set in Google Analytics, after which Google deletes it.
Contact-form messages and support emails are kept as long as needed to help You and keep a record of the conversation.

Your Choices and Rights

Update Your profile in Settings → Profile, and edit or delete projects, permits and milestones at any time.
Delete Your Account in Settings → Profile. This deletes Your Content and Account information from the Service.
Unsubscribe from onboarding emails with the link in each one.
Make a project private, mark milestones private, or reset Your Calendar Feed link at any time.
Accept or reject analytics and advertising cookies from Cookie Settings.
Ask Us for a copy of Your information, or to correct or delete it, by emailing support@permitful.com. We will respond within 45 days, and may ask You to confirm the request from the email address on Your Account.

We will not treat You differently for exercising any of these rights.

California residents

California law gives You the right to know what personal information We collect, use and disclose; to request a copy of it; to correct it; to delete it; and not to be discriminated against for exercising these rights. This policy describes the categories of information We collect, their sources, their purposes and who receives them. You can exercise these rights as described above, or through an authorized agent who provides Your written permission; We may ask You to confirm Your identity directly.

We do not sell or share personal information, so there is nothing to opt out of. We use sensitive personal information (Your sign-in details) only to provide the Service. We do not disclose personal information to third parties for their own direct marketing (California Civil Code § 1798.83).

The Service does not respond to browser "Do Not Track" signals. You can manage analytics and advertising cookies from Cookie Settings.

Visitors outside the United States

Permitful is designed for projects in the United States, and Your information is stored and processed in the United States (Our database is in Northern California), where data protection laws may differ from those where You live. If the European Union or United Kingdom General Data Protection Regulation applies to You, We process Your information to provide the Service You signed up for (performance of a contract), to keep it secure and improve it (Our legitimate interests), to comply with the law, and, for analytics and advertising cookies, with Your consent, which You can withdraw at any time. You may ask Us to access, correct, delete, restrict or export Your information, or object to its use, and You may complain to Your local data protection authority.

Security

The Service uses encrypted connections (HTTPS), stores passwords only in hashed form, and limits each Account's data to that Account through database access rules. No method of transmission or storage is completely secure, so We cannot guarantee absolute security.

Children

The Service is for people aged 18 and over, and We do not knowingly collect information from anyone younger. If You believe a child has given Us personal information, contact Us and We will delete it.

Changes to This Privacy Policy

We may update this Privacy Policy. If a change is material, We will tell You by email or in the Service before it takes effect. Other changes take effect when they are posted here. Either way, We will update the "Last updated" date at the top.

Contact Us

If You have questions about this Privacy Policy or Your information, contact Gavin Grant Consulting:

By email: support@permitful.com
Through our contact form
By mail: Gavin Grant Consulting, 1362 Frankfort St APT 4301, San Diego, CA 92110