Effective September 13, 2026
1. Scope and who is responsible
This policy applies to PermitLoom’s websites, applications, and related services. When an organization provides you access to its PermitLoom workspace, that organization generally decides what workspace information is added and why. In that setting, it is responsible for the workspace content and PermitLoom processes it to provide the service.
For questions or privacy requests, contact privacy@permitloom.com. We may need to verify your identity and, for organization-controlled workspace data, may direct the request to the workspace owner.
2. Information we process
- Account and access information: name, email address, email-verification status, authentication credentials in protected form, workspace memberships, roles, and active-session information such as browser or device details.
- Workspace content: organization and location details, permits, licenses, requirements, applications, inspections, audits, tasks, deadlines, fees, notes, regulator contacts, and related activity history entered by users.
- Documents and submissions: files, file metadata, evidence-request responses, submitter contact information, and review records. Workspace owners decide what documents are appropriate to upload.
- Communications: support requests, invitation and notification recipients, delivery status, and messages you ask us to send through the service.
- Technical and security information: IP address, user agent, timestamps, request and error logs, security events, cookies, and similar data needed to operate and protect the service.
- Billing information: if you purchase a paid plan, Paddle processes payment and billing details. PermitLoom may receive customer, subscription, transaction, tax, country, and limited payment-method details, but does not need your full card number.
3. How and why we use information
We process information to:
- create accounts, authenticate users, and control workspace access;
- store, organize, search, export, and share the records you direct us to handle;
- send requested invitations, verification messages, reminders, and service notices;
- provide support, diagnose failures, and improve usability and reliability;
- protect accounts, prevent abuse, enforce service terms, and maintain audit trails;
- administer subscriptions, billing, taxes, and account status; and
- comply with law and establish, exercise, or defend legal claims.
Depending on the context and applicable law, these activities are based on performing our contract, legitimate interests in operating and securing the service, consent where requested, or legal obligations.
4. Service providers and disclosures
PermitLoom relies on specialist providers to operate the service:
- Neon for hosted PostgreSQL database and authentication services;
- Vercel for application hosting, delivery, logs, and Blob file storage;
- Resend for transactional email delivery; and
- Paddle as merchant of record for paid subscriptions, where billing is used.
These providers process information under their own terms and data-protection commitments. We may also disclose information when required by law, to protect people or the service, in a business transaction, or at your direction—for example when you create a report share or send an evidence-request link. Public and recipient links should be shared only with intended recipients.
We do not sell personal data or use workspace content for targeted advertising.
5. International processing
PermitLoom and its providers may process information in countries other than the one where you live. Privacy laws may differ there. Where required, transfers are supported by recognized safeguards or another lawful transfer mechanism. Contact us for more information relevant to your location.
6. Retention and deletion
We generally retain account and workspace information while the relevant account or workspace remains active and as needed to provide the service. Workspace audit history is retained with the workspace because traceability is a core part of the service. Items in the recycle bin stay there until an authorized user restores or permanently deletes them.
Owners can request workspace deletion from account settings. Account deletion may require an owner to transfer or delete workspaces first so that other users do not unexpectedly lose their records. Deletion removes active database records and queues stored files for deletion. Deletion from provider backups, caches, security logs, and disaster-recovery copies may occur later under provider retention cycles. We may keep limited records when reasonably necessary for security, fraud prevention, billing, legal compliance, dispute resolution, or to document a deletion request.
To request help with access, correction, export, or deletion, email privacy@permitloom.com. Do not email sensitive compliance documents.
7. Security
We use administrative and technical safeguards intended to protect information, including encrypted transport, access controls, scoped workspace permissions, authentication controls, and logging. No online service can guarantee absolute security. Keep credentials and private links confidential, use a unique password, remove access that is no longer needed, and contact support@permitloom.com if you suspect misuse.
8. Your choices and rights
You can update certain account details, manage sessions, control workspace memberships, export workspace records, and manage notification settings in the product. Depending on where you live, you may also have rights to access, correct, delete, restrict, object to, or receive a portable copy of personal data, and to complain to a privacy regulator. These rights may be limited by law and the rights of others.
9. Cookies, children, and changes
PermitLoom uses cookies and similar browser storage needed for sign-in, security, account recovery, preferences, and core functionality. PermitLoom is a business service and is not directed to children. If you believe a child has provided personal data, contact us.
We may update this policy as the service or law changes. We will post the revised policy with a new effective date and provide additional notice when required.