Privacy Policy

Information we collect

• Account and contact information you provide, including the email address used for sign-in.
• Project, property, evidence, document, and finding data you add to the service or choose to import from a connected Autodesk account.
• Autodesk account and project identifiers, connection permissions, and server-held credentials needed to operate your authorized integration.
• Technical and usage information needed to operate, secure, and improve the product.
• Subscription status and transaction identifiers from the billing provider used for your plan. For AWS Marketplace buyers, this includes Marketplace customer/account and agreement identifiers needed to provision access, enforce subscription lifecycle, attribute usage, and reconcile billing. Permit Sheriff does not require or store payment-card details for AWS Marketplace purchases.

How we use information

We use information to provide and secure the service, generate requested outputs, support customers, process subscription status, prevent abuse, and improve reliability. Connecting Autodesk allows the service to access resources permitted by your Autodesk account. Imports and supported issue writebacks use that authorized connection.

When you use an AI-assisted workflow, relevant source text and assessment context may be sent to OpenAI to generate the requested response. Our integration requests that the response not be stored through the API's response-storage feature; this setting does not replace the provider's applicable data-processing and retention terms.

Service providers

Providers receive information needed for their role in delivering the requested service and process it under applicable terms and privacy commitments.

• Vercel provides web application infrastructure and web analytics.
• Render provides backend application infrastructure and database hosting.
• Resend delivers sign-in and other service emails.
• Autodesk provides the connected account, project, document, and issue APIs used when you enable that integration.
• OpenAI processes the relevant inputs for AI-assisted workflows when those features are used.
• Stripe processes supported direct web and API subscriptions. Where an Autodesk subscription is purchased through PayPal, PayPal processes that payment under its own terms.
• AWS Marketplace processes AWS Marketplace purchases and provides the commercial identifiers and lifecycle events Permit Sheriff needs to provision and meter Marketplace access.

Storage, encryption, and tenant isolation

Permit Sheriff's production backend application and primary PostgreSQL database are deployed in Render's Ohio region. The web application is delivered through Vercel. Production customer evidence is kept in protected storage configured for the service rather than exposed as public application assets.

Protected traffic uses encrypted HTTPS/TLS connections. Customer access is organization-scoped and enforced on the server. Integration secrets and protected credentials are held in server-side configuration or credential stores rather than browser-public variables.

AWS Marketplace data handling

• Collection: account identity, organization membership, Marketplace customer/account and LicenseArn-style agreement identifiers, product identifiers, lifecycle state, and usage records needed to fulfill the purchase.
• Use: account linking, subscription activation and deprovisioning, access control, usage attribution, reconciliation, customer support, security, and auditability.
• Sharing: Marketplace billing quantities and required commercial identifiers are exchanged with AWS Marketplace for the AWS purchase. Permit Sheriff does not send AWS Marketplace buyers to a separate payment rail for the Marketplace-listed product.
• Retention: commercial, audit, support, and customer-content records are retained only as needed for the service, security, contractual obligations, dispute handling, and applicable legal requirements.
• Backups and recovery: Permit Sheriff maintains backup, restore, replay, reconciliation, and recovery procedures. Backup copies age out through the configured provider backup lifecycle rather than being treated as active customer content.

Permit Brief email choices

Permit Brief is a separate, optional marketing subscription. We store the email address, optional first name, signup source, consent version, and subscription, confirmation, and unsubscribe timestamps. We send a confirmation email and activate the subscription only after you confirm. AWS Marketplace customer contacts and Permit Sheriff account holders are not automatically enrolled.

Resend delivers these requested confirmation and marketing emails. You can unsubscribe using the link in each Permit Brief email without changing your account, purchase, or transactional service messages. We retain a minimal consent and suppression record to honor your choice; contact support for access or deletion requests.

Newsletter abuse prevention uses short-lived keyed digests instead of storing raw IP addresses with subscriptions. Expired abuse counters are removed automatically. Marketing analytics contain event names and public article/source labels, not subscriber names, email addresses, or confirmation tokens. These events respect browser Do Not Track and Global Privacy Control signals.

Retention and security

We retain information as reasonably needed to provide the service, meet legal obligations, resolve disputes, maintain security and audit records, and support recovery. Security-relevant access, entitlement, and administrative audit records are retained for at least one year and are protected as an append-only ledger. Active customer content is retained while needed for the active service. After termination or a verified deletion request, active-system deletion is governed by applicable contractual, legal, security, and operational requirements; backup copies expire through the configured backup lifecycle. Disconnecting Autodesk revokes the connection; it does not by itself delete documents already imported into a workspace.

We use technical and organizational safeguards, including server-side protection of Autodesk credentials and access controls for workspace data. No online system can guarantee absolute security.

Your choices

You may request access, correction, or deletion of your information, subject to legal and operational retention requirements, by contacting us. You can disconnect your Autodesk integration to stop future access through that connection.

Contact

Privacy questions, data requests, and security reports can be sent to support@permitsheriff.com. Put “Security” in the subject line for suspected security incidents.