Last updated 12 September 2026

Privacy Policy

What we collect, why we collect it, who else touches it, and how to get it deleted. Pulld runs no advertising and no third-party analytics, so this is shorter than most.

1. What we collect

You give us

Email address — to identify your account and send your digest.
Company name — optional, shown on your account.
Alert filters — the cities, zip codes, permit types and minimum job value you choose.
Password — stored only as a salted hash by our authentication provider. If you sign in with Google we never receive a password at all.

Created by using the service

Which permits we alerted you to, so we never send the same one twice.
Subscription state — a Stripe customer and subscription identifier, your plan status and trial end date. We never receive or store your card number.
Server logs — ordinary request logs kept by our host for security and debugging.

What we do not do

No advertising, no third-party analytics, no tracking pixels, no selling or renting your data to anyone, ever. The only cookies Pulld sets are the session cookies that keep you signed in — there are no advertising or analytics cookies to consent to.

2. Permit data is public record

The permit records Pulld distributes are published by city governments as public record. We collect them from official open-data portals, and every alert links back to the source. We are not the controller of that data and cannot amend it. To correct a permit record, contact the issuing city.

3. Why we are allowed to hold it

To perform our contract with you — running your account, matching permits, sending the digest, taking payment.
Legitimate interests — keeping the service secure and working, and preventing abuse.
Legal obligation — retaining billing records for the period tax law requires.

4. Who processes it on our behalf

We keep the list short and use each for one job:

Supabase — database and authentication.
Stripe — payments. Stripe is the controller of your card data, under its own privacy policy.
Resend — sending email.
Vercel — hosting and server logs.

Each is bound to use the data only to provide its service to us. We do not share your personal data with anyone else except where the law requires it.

5. How long we keep it

Account data — while your account is open, and for 30 days after you delete it, so an accidental deletion can be undone.
Alert history — deleted with your account.
Billing records — retained as long as tax and accounting law requires, typically seven years, even after account deletion.
Server logs — short-lived, per our host's retention.

6. Your rights

Wherever you are, you can ask us to access, correct, export, or delete your personal data, and to stop marketing email. Email privacy@pulledpermit.com and we will respond within 30 days.

If you are in the UK or EEA you may also object to or restrict processing and complain to your data protection authority. If you are a California resident, we do not sell or share personal information as those terms are defined by the CCPA, and we will not discriminate against you for exercising any right.

7. Stopping the emails

Every digest carries a one-click unsubscribe link and an unsubscribe header your mail client can act on. Unsubscribing stops the digest immediately and keeps your filters and account intact, so you can turn it back on later.

8. Security

Traffic is encrypted in transit. Each customer's rows are isolated at the database level, so one account cannot read another's. Passwords are hashed by our authentication provider, never stored by us in readable form. No system is perfectly secure; if a breach affects your data we will tell you and the relevant authority as the law requires.

9. Children

Pulld is a business tool and is not directed at anyone under 18. We do not knowingly collect data from children.

10. International transfers

Our providers process data in the United States. If you use Pulld from outside the US, your data is transferred there and handled under this policy.

11. Changes

If we change this policy materially we will email registered customers before it takes effect. The date at the top always reflects the current version.

12. Contact

TODO — your registered legal entity, e.g. Pulld LLC
TODO — registered business address
privacy@pulledpermit.com