Privacy Notice

1. What we collect, and from where

From you, when you create or use an account: your email address, your password (our sign-in provider, Supabase, keeps only a one-way hash of it, which cannot be turned back into the password; we never see or store the password itself), the account (organization) name, your role in the account, the states and project types you choose to follow, your email preferences, and what you enter: watchlists, followed rules, projects (names, addresses and site outlines), and lawyer referral requests (your name, organization, email, telephone if given, the state, county, project type, timing and your description of the matter). Please do not include sensitive personal information in a referral description.

From other people: an account owner or administrator who invites you gives us your email address.

From public sources: for firms and companies we may contact about the Service, business contact details (name, title, business email and firm) published on firm and company websites and in professional directories.

Automatically: when and from which IP address and browser you accepted the terms; when a briefing share link was created and first opened; and server logs of requests (IP address, browser, page and time) kept by our hosting providers for security and reliability.

From our payment processor: your plan, subscription status and invoices. Card numbers are entered with and held by Stripe, not by us.

If you turn on push alerts on a phone or computer: the subscription your browser creates for that device (an address at Apple’s, Google’s or Mozilla’s push service and two keys that let only that device read the alert), a short description of the device and browser, and when each alert was last sent to it.

2. Cookies

We use only cookies needed for the site to work: to keep you signed in and to show a one-time message after you submit a form. We do not use advertising, analytics or social media cookies or trackers, and the site’s fonts are served from our own domain, so your browser does not contact font or advertising networks. Because we do not track you across sites, browser “do not track” and Global Privacy Control signals do not change anything we do.

3. How we use it

To provide the Service: sign-in, your desk, alerts and the Monday preview, screening your projects against public maps, matching rules and dates to your projects and watchlists, team invitations, and billing.

To pass on a lawyer referral request, only when you have ticked the box agreeing to share it, and only with the law firm it is referred to.

To send push alerts you have turned on: one short notification when your daily digest goes out, with the number of matches, the first headline and a link to your projects. You can turn them off on each device from the Projects page or in the browser’s notification settings; the email digest is separate.

To send business emails about the Service to firms and companies, using published business contact details. Every such email includes our postal address and a one-click way to stop further emails, which we honour.

To keep the Service secure, prevent abuse (for example, the daily limit on referral requests and one free trial per person), keep records of acceptance, and meet legal obligations.

We do not sell personal information, share it for cross-context behavioural advertising, or use it to train artificial intelligence models. Our briefings and rulebooks are drafted with an AI model (Anthropic’s Claude) from public sources only; your personal information and what you enter are not sent to it.

4. Who receives it

Service providers that process it for us under contract and only on our instructions: Supabase (database and sign-in), Vercel (website hosting), Stripe (payments), Resend (email delivery) and GitHub (scheduled jobs).

If you turn on push alerts, the push service of your device’s maker or browser (Apple, Google or Mozilla) carries each alert to the device. The alert is encrypted to your device, and the push service receives the device’s address and the encrypted alert, under that company’s own privacy practices.

Public map services, for screening: a project’s address is sent to the US Census Bureau geocoder, and its location or outline to the federal and state map services listed on the project page. We send the location only, not your name or the project’s name.

The law firm you agree to be referred to, which receives your referral request and contact details and handles them under its own privacy practices. Our team reads referral requests to make referrals; a request goes to a firm affiliated with our owners only if you agree to that firm.

People in your own account: the account owner and members can see the account’s projects and watchlists. A briefing you share by link can be read by anyone holding the link for twenty-four hours after it is first opened.

Others where the law requires it, to protect rights, property and safety, or to a successor if our business is sold or reorganized, who must handle it consistently with this notice.

5. How long we keep it

Account information and what you enter: while the account is open, then deleted or de-identified within sixty days after it is closed, except copies in routine backups until they are overwritten. Records of acceptance and billing: as long as needed for legal, tax and accounting purposes. Referral requests: [three years after the request is closed — counsel to confirm]. Business contact details: until the person asks us to stop or the details are no longer current. Server logs: for the periods our hosting providers set. Push alert subscriptions: until you turn alerts off on the device, the push service tells us the device is no longer reachable, or the account is closed.

6. Your choices and rights

You can change your email preferences on your account page, and every newsletter and alert has a one-click unsubscribe link. You can ask us to tell you what personal information we hold about you, give you a copy, correct it or delete it by writing to legal@environmentalshortcut.com. We answer these requests from anyone, whether or not a state law requires it, within forty-five days, and we may need to confirm your identity first. If we decline a request, you can ask us to reconsider by replying to our answer, and you may contact your state attorney general. We will not treat you differently for making a request.

If your access comes through an organization’s account, some requests (for example, deleting the account’s projects) are decided by the account owner, and we may refer you to them.

7. Security

Each account’s data is separated by access controls enforced in the database, connections to the site are encrypted, and payment card details are handled by Stripe. No system is perfectly secure; we will notify you of a breach affecting your personal information as the law requires.

8. Changes and contact

We will post changes here with a new effective date and, for material changes, tell people with accounts by email. Questions or requests: legal@environmentalshortcut.com, or [Company legal name], [Street address, City, State ZIP].