What we will never do

SitePath is a research platform, not a data broker. We do not sell, license, syndicate, or publish what you research on the Platform. Specifically:

• Your searches stay private. Counties you view, watchlists you save, comparisons you run, and reports you export are not shared with developers, counties, opposing parties, or any third party.
• No "who's looking at your county" feed. If you are a landowner, council member, attorney, advocacy group, or stakeholder, your interest is not announced to the developer community in any form.
• No data brokerage. We do not sell, license, or syndicate your account data, watchlists, or search history to advertisers, lead-generation firms, or anyone else. We make money from subscription fees, not from your data.
• No advisory agenda. We have no project-consulting contracts and earn no fees tied to any developer succeeding or failing in any specific market.

If we ever materially change any of the above commitments, we will update this Policy, give active subscribers at least thirty (30) days' email notice, and require an explicit "Accept" before the change applies to your account.

1. Who we are & scope

SitePath Intelligence ("SitePath", "we", "us", "our") operates sitepathintel.com and the related research platform (collectively, the "Platform"). This Privacy Policy ("Policy") explains how we collect, use, share, and protect personal data when you visit our website, create an account, subscribe to a paid plan, or otherwise interact with the Platform.

For purposes of the EU General Data Protection Regulation ("GDPR") and the UK GDPR, SitePath acts as a controller of the personal data described in this Policy. To the extent SitePath processes personal data on behalf of a business customer (for example, account records you upload as part of an Enterprise subscription), SitePath acts as a processor, and that processing is governed by the Data Processing Addendum.

For purposes of the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), SitePath is a business and, where applicable, a service provider to its customers.

2. Definitions

• "Personal data" means any information that identifies, relates to, describes, or could reasonably be linked to a particular individual. Where U.S. state laws use the term "personal information", treat it as equivalent for purposes of this Policy.
• "Process" means any operation performed on personal data, including collection, storage, use, disclosure, transfer, or deletion.
• "You" means the individual whose personal data is being processed — typically the account holder, an Authorized User on an account, or a visitor to the Platform.
• "Sub-processor" means a third party engaged by SitePath to process personal data on our behalf. The current list is in our DPA.

3. Personal data we collect

We collect the categories of personal data described below. We collect data directly from you, automatically as you use the Platform, and (in limited cases) from third parties such as our payment processor.

(a) Account data

• Email address, first name, last name, and a hashed password (you create your own password; we never see the plaintext).
• Subscription plan, billing interval, and the states selected on Basic plans.
• Account metadata maintained by our identity provider (Netlify Identity), including creation timestamp, last sign-in, and email-confirmation status.

(b) Payment data

• Stripe customer ID, subscription ID, and payment status. Stripe handles your card number, billing address, and payment-method details directly — we never see or store them.

(c) Usage data

• Pages and counties you view, search queries, watchlist contents, comparison sessions, and exported reports.
• Approximate location derived from IP address (city/region level) for security, fraud prevention, and per-IP rate limiting.
• Device and connection information: IP address, user-agent string, referrer, time zone, screen resolution, and similar technical signals.

(d) Communications

• Email correspondence with our support team and any feedback you submit through the Platform.

(e) Optional analytics data

• If you accept analytics cookies, our analytics providers (Google Analytics 4, Microsoft Clarity) collect aggregate metrics such as session duration, page paths, click events, and (for Clarity) anonymized session recordings with masked input fields. You can decline these cookies; the Platform remains fully functional without them.

(f) Categories we do not collect

We do not knowingly collect biometric identifiers, government identification numbers, precise geolocation, financial-account numbers, health data, or special-category data under GDPR Article 9 (race, religion, political views, sexual orientation, etc.). Do not submit such data to the Platform.

4. How we use personal data

We use personal data for the following purposes:

• Account management — to create and authenticate your account, enforce subscription access, and provide customer support.
• Service delivery — to render the map, generate reports, run comparisons, send digest emails you have opted into, and operate AI-assisted features (Enterprise tier only).
• Payments & billing — to process subscription payments through Stripe, send invoices and renewal notices, and respond to billing inquiries.
• Security & fraud prevention — to detect account sharing, brute-force sign-in attempts, scraping, and other abuse; to enforce rate limits; and to investigate security incidents.
• Service improvement — to understand how the Platform is used and to improve its features, performance, and data quality.
• Legal compliance — to comply with applicable law, respond to lawful requests, enforce our Terms, and protect our rights.
• Communications — to send service-related messages (sign-in confirmations, billing receipts, security alerts) and, if you have opted in, marketing communications.

We do not use personal data for cross-context behavioral advertising, do not sell personal data, and do not share it with third parties for their own marketing.

5. Legal bases (GDPR / UK GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, the legal bases on which we rely under Article 6 of the GDPR (and the equivalent UK provisions) are:

• Contract (Art. 6(1)(b)) — to provide the Platform and perform our obligations under the Terms of Service: account management, payments, service delivery.
• Legitimate interests (Art. 6(1)(f)) — for security, fraud prevention, rate limiting, service improvement, and aggregate analytics. Where we rely on this basis, our legitimate interests are balanced against your rights and freedoms.
• Consent (Art. 6(1)(a)) — for optional analytics cookies, marketing emails, and any other processing for which we ask for your opt-in. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Legal obligation (Art. 6(1)(c)) — to comply with tax, accounting, anti-fraud, and other laws.

6. Retention periods

We retain personal data only as long as necessary for the purposes for which it was collected, plus any period required by applicable law. The principal retention windows are:

After the applicable retention period expires, we delete or irreversibly anonymize the data, except where continued retention is required by law.

7. How we share data

We share personal data only as needed to operate the Platform, comply with law, or with your consent. The recipients are:

We do not share personal data with advertising networks, lead-generation firms, or any party for cross-context behavioral advertising. The full sub-processor list, with addresses and contact emails for data-protection inquiries, is maintained in the DPA, Schedule 3.

8. International transfers

SitePath is based in the United States. Personal data is stored and processed primarily in the United States. If you access the Platform from outside the United States, your data is transferred to and processed in the United States, and may also be processed in any country where our sub-processors operate.

Where we transfer personal data from the EEA, the UK, or Switzerland to the United States or another third country, we rely on one or more of the following safeguards:

• the European Commission's Standard Contractual Clauses (2021/914) or the UK International Data Transfer Addendum, included in our DPA;
• the EU–US Data Privacy Framework and its UK and Swiss extensions, where the recipient is certified;
• any other lawful transfer mechanism, including derogations under GDPR Article 49 in narrowly defined situations.

You may request a copy of the relevant transfer mechanism by emailing Support@sitepathintel.com.

9. Cookies & similar technologies

We use two categories of cookies and similar technologies:

Strictly necessary

These are required for the Platform to function — authentication session cookies, the GoTrue JWT, security tokens (CSRF), and consent preferences. They cannot be disabled while you are signed in.

Optional analytics

These are loaded only after you accept analytics cookies in the consent banner. They include cookies set by Google Analytics 4 and Microsoft Clarity. You may withdraw consent at any time by clicking "Essential only" in the cookie banner (which reappears after clearing your local storage) or by emailing Support@sitepathintel.com.

We do not use cookies for cross-context behavioral advertising and do not allow third parties to set advertising identifiers on our domain.

10. Your rights — EEA, UK, Switzerland

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights with respect to your personal data:

• Access. Confirm whether we process your personal data and obtain a copy.
• Rectification. Correct inaccurate or incomplete data.
• Erasure ("right to be forgotten"). Request deletion of your data, subject to legal retention obligations.
• Restriction. Ask us to limit how we process your data in certain circumstances.
• Portability. Receive your data in a structured, commonly used, machine-readable format.
• Objection. Object to processing based on legitimate interests, including profiling.
• Withdraw consent at any time, where processing is based on consent.
• Lodge a complaint with the data-protection authority of your country of residence. We would appreciate the chance to address your concerns first — please email us.

To exercise these rights, email Support@sitepathintel.com. We respond within thirty (30) days (extendable by an additional sixty (60) days for complex requests, with notice). We may need to verify your identity before acting on a request.

11. Your rights — California (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

• Right to know. Request the categories and specific pieces of personal information we collected about you in the past 12 months, the sources, the business purposes for collection, and the third parties with whom we shared it.
• Right to delete. Request deletion of personal information we collected from you, subject to legal exceptions.
• Right to correct. Ask us to correct inaccurate personal information.
• Right to opt out of sale or sharing. SitePath does not sell personal information and does not share it for cross-context behavioral advertising. There is therefore nothing to opt out of, but you can confirm this position at any time.
• Right to limit use of sensitive personal information. We do not collect or use sensitive personal information beyond what is strictly necessary to provide the Platform.
• Right to non-discrimination. We will not deny service, charge a different price, or provide a lower quality of service because you exercised your rights.

Categories collected in the past 12 months

Identifiers (email, account ID, IP address); commercial information (subscription and payment records); internet activity (usage data); inferences (account-state inferences for security and rate-limiting). We do not collect biometric, geolocation, or sensitive personal information beyond IP-derived approximate location.

How to exercise these rights

Email Support@sitepathintel.com with the subject line "California Privacy Request". We respond within forty-five (45) days. You may designate an authorized agent to submit a request on your behalf with proof of authorization.

12. Your rights — other U.S. states

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), and other states with comparable laws have rights to access, correct, delete, and (where applicable) appeal denials. We honor these rights on the same timeline as the corresponding California rights. To exercise any state right, email Support@sitepathintel.com with the subject line "Privacy Request" and identify your state of residence.

13. Global Privacy Control, Do Not Track, opt-out signals

We honor the Global Privacy Control (GPC) signal as a request to opt out of sale or sharing under U.S. state privacy laws. Because we do not sell or share personal information for cross-context behavioral advertising in the first place, the practical effect is that we treat the signal as a confirmation of your existing protections.

We do not separately respond to traditional Do Not Track headers because no industry standard for their interpretation exists; the GPC signal supersedes it.

14. Marketing communications

We send transactional emails (sign-in confirmation, billing receipts, security alerts, password resets, watchlist digests you have opted into) as part of providing the service. You cannot opt out of strictly transactional messages while your account is active.

If we ever send promotional or marketing emails, they will include a one-click unsubscribe link. You can also email Support@sitepathintel.com with the subject "Unsubscribe" to opt out of all promotional communications.

15. Children's privacy

The Platform is intended for business and professional use by individuals 18 years of age or older. We do not knowingly collect personal data from children under 18, and the Platform is not directed to children. If we become aware that we have collected personal data from a child under 18, we will delete it. If you believe a child has provided personal data to us, please contact Support@sitepathintel.com.

16. Security

We implement technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, and destruction. These measures include:

• TLS 1.2+ encryption for data in transit; AES-256 (or equivalent) for data at rest on managed infrastructure;
• password hashing with industry-standard algorithms (passwords are never stored in plaintext);
• JWT-based authentication with short-lived tokens;
• per-IP and per-user rate limiting on sensitive endpoints;
• strict origin and CSRF protections on server-side functions;
• least-privilege access controls and audit logging for administrative actions;
• regular security review of dependencies and configuration.

A more detailed description of the technical and organizational measures we apply when processing personal data on behalf of business customers is in Schedule 2 of the DPA.

If you become aware of a security issue, please report it to Support@sitepathintel.com. We acknowledge security reports within two business days.

17. Automated decision-making & AI features

SitePath does not make decisions about you that produce legal effects or similarly significant effects through automated means.

Enterprise subscribers can request an "AI brief" — a generated summary of a county's research data. Generation works as follows: we send the relevant county research fields, with no account identifiers, to Anthropic's API for the purpose of producing the brief; Anthropic processes the prompt under its zero-retention API terms and does not use it to train models; the response is returned to you and is not retained by SitePath beyond your own session. You are not the subject of profiling.

18. Changes to this Policy

We may update this Policy from time to time. The effective date and version string above will be updated. For material changes — for example, changes to the categories of personal data we collect or how we use them — we will notify active subscribers by email at least thirty (30) days before the change takes effect. Continued use of the Platform after the effective date constitutes acceptance of the updated Policy.

19. Contact us & complaints

For privacy questions, to exercise any right described above, or to send a complaint or breach report:

• Email: Support@sitepathintel.com
• Subject lines: "Privacy Request", "California Privacy Request", "GDPR Request", "Security Report", or "DPA Inquiry" as appropriate.
• Postal: SitePath Intelligence, c/o Legal, Wilmington, Delaware (please email first for the current mailing address).

EEA / UK residents have the right to lodge a complaint with their local data-protection authority. We encourage you to contact us first so we can try to resolve any issue directly.