Privacy Policy

1. Who we are and what this policy covers

This Privacy Policy describes how Verg (“Verg”, “we”, “us”, or “our”) collects, uses, discloses, and protects information in connection with the Verg website, web application, and related services (collectively, the “Service”).

This policy applies to information we process as a controller of that information — that is, where we determine the purposes and means of processing. It does not apply to the practices of third parties we do not own or control, including the government agencies whose public records the Service summarizes.

By accessing or using the Service, you acknowledge that you have read and understood this policy. If you do not agree with it, do not use the Service.

2. Information we collect

2.1 Information you provide to us

We collect the following categories of information directly from you:

Account information

Your email address, and, if you choose to supply them, your first and last name. You also create a password. We do not store your password. We store a one-way cryptographic hash of it (Argon2id), from which the password cannot be recovered.

Business profile information

Optional information you enter to tailor the Service to your work: your primary trade, your company name, the ZIP code you work out of, the metropolitan area that ZIP falls in, and the service radius in miles you are willing to travel. This information is used to decide which areas the map opens on and which permits your alerts cover. It is not used for any other purpose.

Communication preferences

Whether you have opted in to product marketing email, to new-permit alerts, and to competitor-activity alerts. Each is off by default and each is recorded separately. Transactional messages — address verification, password resets, and billing notices — are not governed by these preferences and are sent regardless, because they are necessary to operate your account.

Watched contractors

If you use the competitor-watch feature, we store the contractor business names you have chosen to watch, associated with your account. These are business names as they appear in public permit records.

Feedback

If you submit the feedback or bug-report form, we receive the message you write, the page you submitted it from, and — only if you choose to enter it — an email address for us to reply to.

2.2 Information we collect automatically

Session information

When you sign in, we create a session and store, alongside it, the IP address and browser user-agent string the sign-in came from. We retain this for two purposes only: so that you can see and revoke the devices signed in to your account, and so that we can investigate suspected unauthorized access. It is deleted when the session ends or expires. We do not use it to build a profile of you and we do not combine it with information from other sources.

Server logs

Our servers and our hosting providers generate operational logs in the ordinary course, which may include IP addresses, request paths, timestamps, and error details. These are used for security, debugging, abuse prevention, and capacity planning, and are retained on a short rolling basis.

Rate-limiting records

To prevent automated abuse of the free lookup on our home page, we hold a short-lived, in-memory count of recent requests per IP address. It is not written to our database and is discarded within minutes.

Trial-eligibility record

To enforce a limit of one free trial per email address, we store a salted, one-way hash of your verified email address together with the date the trial began. The hash cannot be reversed to recover the address. This record is retained after account deletion; see §8.

2.3 Information we do not collect

To be explicit, because the absence of these is a design choice rather than an oversight:

• We do not use web analytics, product analytics, tag managers, advertising pixels, conversion trackers, heatmaps, or session-recording tools. There is no such script on any page of the Service.
• We do not set advertising or cross-site tracking cookies, and we do not participate in advertising networks or data-sharing cooperatives.
• We do not collect your device's precise geolocation. The only location information we hold is the ZIP code you type in and the service radius you choose.
• We do not purchase personal information about you from data brokers, and we do not enrich your account with information obtained from third parties.
• We do not collect special categories of personal data (such as health, biometric, genetic, precise geolocation, racial or ethnic origin, religious beliefs, or sexual orientation), and we ask you not to submit them to us.

3. Payment information

We do not collect, process, transmit, or store payment card information.

All payments are handled by Stripe, Inc. (“Stripe”), a PCI-DSS Level 1 certified payment processor. When you subscribe or update a payment method, you are taken to a checkout or billing page hosted by Stripe on Stripe's own infrastructure. Your card number, expiration date, security code, and any billing address you supply are transmitted directly from your browser to Stripe. They do not pass through our servers, are never written to our database, and are not accessible to us or to our personnel.

What we do store, and all that we store, is: a Stripe customer identifier, a Stripe subscription identifier, the subscription's status (for example “trialing”, “active”, or “past due”), the identifier of the price you are subscribed to, the date the current billing period ends, the date any trial ends, and whether the subscription is set to cancel. These are the minimum facts required to decide whether your account has access to paid features. We may also see a truncated card brand and last four digits within Stripe's own interface; we do not copy them into our systems.

Stripe processes your payment information as an independent controller under its own privacy policy, available at stripe.com/privacy.

4. How we use information

We use the information described in §2 only for the following purposes:

• To provide the Service. Authenticating you, keeping you signed in, determining which features your subscription entitles you to, and opening the map on the area and trade you told us you work in.
• To communicate with you. Sending address-verification and password-reset messages, billing and account notices, and — only where you have opted in — permit alerts, competitor alerts, and product email.
• To take payment. Creating and maintaining your subscription through Stripe.
• To secure the Service. Detecting and preventing fraud, credential stuffing, scraping, trial abuse, and other unauthorized activity.
• To improve the Service. Diagnosing errors and acting on the feedback you send us.
• To comply with law. Meeting our legal, tax, accounting, and regulatory obligations, and enforcing our agreements.

We do not use your personal information to train machine-learning models. The forecasting models described on our methodology page are trained exclusively on public permit records, public property records, and public census data. They are not trained on, and do not use, your account information, your searches, your saved filters, or your activity within the Service.

We do not engage in profiling that produces legal or similarly significant effects concerning you, and we do not make automated decisions about you without human involvement.

5. How we share information

5.1 We do not sell your personal information

We do not sell your personal information, and we have not done so at any time. We do not sell, rent, license, trade, or otherwise disclose personal information to third parties in exchange for monetary or other valuable consideration. We do not “share” personal information for cross-context behavioral advertising, and we do not process personal information for targeted advertising purposes of any kind.

5.2 We do not sell or resell your leads

The properties, areas, and forecasts the Service surfaces to you, together with the searches you run, the filters you save, and the contractors you watch, are for your use. We do not sell, resell, syndicate, or otherwise make your leads or your activity available to any other party, including other Verg subscribers, distributors, lead-generation companies, marketing agencies, or advertisers. We do not operate a shared lead marketplace and we do not broker introductions.

Verg is sold as a subscription to a research tool. It is not, and does not operate as, a lead-selling business.

5.3 Service providers

We disclose information to a small number of vendors who process it on our behalf and under contract, only to the extent necessary to perform their function, and who are prohibited from using it for their own purposes. Those categories are:

• Payment processing. Stripe, as described in §3.
• Cloud hosting and database services. The infrastructure on which the Service and its database run.
• Transactional email delivery. The provider that delivers verification, password-reset, billing, and alert messages. This provider receives your email address and the contents of those messages.

5.4 Third-party resources loaded by your browser

Certain assets are served to your browser from third-party networks rather than from us. When your browser requests them, those networks necessarily receive your IP address and standard request headers. We do not send them your account information, and they are not permitted by us to use these requests to track you across sites. They are:

• Google Fonts (fonts.googleapis.com, fonts.gstatic.com) — the typefaces used across the site.
• unpkg (unpkg.com) — the open-source mapping library the map is built on.
• CARTO and OpenStreetMap (basemaps.cartocdn.com) — the base map tiles drawn beneath our data.

Address and ZIP code lookups you perform inside the Service are sent to our servers, not to a third party from your browser. Where we need an external geocoding service to resolve them, our servers make that request on your behalf, so your search terms are not transmitted from your browser to a third party.

5.5 Legal and safety disclosures

We may disclose information where we believe in good faith that doing so is required by applicable law, regulation, legal process, or enforceable governmental request; where necessary to investigate or prevent fraud, security incidents, or technical issues; or where necessary to establish, exercise, or defend legal claims, or to protect the rights, property, or safety of Verg, our users, or the public. Where we are legally permitted to do so, we will make reasonable efforts to notify you before disclosing your information in response to legal process.

5.6 Business transfers

If Verg is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of its assets, information covered by this policy may be transferred as part of that transaction. We will require any successor to honor the commitments in this policy with respect to information transferred, and we will notify you of any change in control of your personal information and of any material change to this policy that results.

6. Public records and information about other people

The core of the Service is public information. Building permits are public records published by city and county permitting authorities. Parcel and assessment data are public records published by county assessors. Demographic estimates are published by the United States Census Bureau. Environmental and hazard data are published by federal agencies. We obtain this information from the agencies' own public data portals and application programming interfaces.

Because permit records are public, they may include information relating to identifiable people — most commonly a property address, and often the name of the contractor who pulled the permit. We surface that information as it is published. In connection with it:

• We do not append, purchase, or infer contact information. We do not attach homeowner names, telephone numbers, email addresses, or household demographics to any property.
• We do not contact property owners, and we do not market to them on our own behalf or on behalf of any subscriber.
• We do not sell public-record data as a standalone product or feed.
• Demographic figures shown in the Service are census-tract aggregates published by the Census Bureau. They describe an area of roughly one to eight thousand people. They are never about a specific household and cannot be used to identify one.

If you are a property owner or contractor named in a public permit record and you have a question about how that record appears in the Service, contact us using the form linked in §14. Please note that we are not the source of the record and cannot amend the underlying government dataset; corrections to the record itself must be sought from the issuing authority.

You are responsible for using information obtained through the Service lawfully, including compliance with the Telephone Consumer Protection Act, the CAN-SPAM Act, state do-not-call and solicitation rules, and any other law applicable to how you contact prospective customers.

7. Cookies and local storage

We set one cookie. It holds an opaque, randomly generated session token and exists so that you remain signed in between requests. It is marked HttpOnly (so it cannot be read by scripts running in your browser) and SameSite=Lax (so it is not sent on cross-site requests), and is transmitted over an encrypted connection. Only a cryptographic hash of the token is stored on our side, so the value in your browser cannot be recovered from our database. It is strictly necessary to the Service and cannot be disabled while remaining signed in.

We use no other cookies. We do not use analytics cookies, advertising cookies, or third-party cookies of any kind.

Separately, the Service stores a small amount of information in your browser's local storage, on your device. This includes your light or dark theme preference, searches you have chosen to save, and whether you have dismissed certain notices. This information stays on your device and is never transmitted to us. Clearing your browser's site data removes it.

8. Data retention

We retain information only for as long as it serves the purpose it was collected for, or for as long as we are required to retain it by law.

Account and profile information

Retained for as long as your account exists. When you delete your account, it and the records associated with it — profile, communication preferences, watched contractors, sessions, and pending tokens — are deleted.

Sessions, IP addresses, and user-agent strings

Deleted when the session expires, when you sign out, or when you revoke it, whichever is first. Sessions have a maximum lifetime after which they expire regardless of activity.

Email verification and password reset tokens

Stored only as hashes, expire within hours (verification) or minutes (password reset), and are marked used on first redemption.

Subscription records

Retained for the life of the account and afterwards as required for tax, accounting, and audit purposes. Stripe retains its own records under its own policy.

Trial-eligibility hashes

Retained indefinitely, including after account deletion. This record contains only a one-way hash of an email address and the date a trial began. It is kept because deleting it would allow the one-free-trial-per-address limit to be defeated by deleting and recreating an account. It cannot be reversed to recover the address and is not used for any other purpose.

Server logs and rate-limiting records

Retained on a short rolling basis for security and operational purposes.

Feedback messages

Retained for as long as needed to act on them and to understand recurring issues.

Public-record data described in §6 is retained for as long as it is useful to the Service. It is not personal information we collected from you and is not affected by deletion of your account.

9. Security

We maintain administrative, technical, and physical safeguards designed to protect information against unauthorized access, disclosure, alteration, and destruction. These include: hashing passwords with Argon2id; storing only hashes of session, verification, and password-reset tokens, so that a database disclosure would not yield usable credentials; transmitting data over encrypted connections; scoping database credentials to least privilege; rate limiting authentication and public endpoints; and requiring a custom request header on state-changing requests as a cross-site request forgery control.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your password confidential and for notifying us promptly if you believe your account has been compromised.

10. Your choices and your rights

10.1 Available to everyone

• Access and correction. You can view and edit your name, email address, company, trade, ZIP code, service radius, and communication preferences at any time from your account settings page.
• Deletion. You may delete your account, which deletes the information described in §8. Contact us if you cannot complete this from your settings page.
• Email preferences. Marketing email, permit alerts, and competitor alerts are each off unless you turn them on, and each can be turned off again from your settings page or by using the unsubscribe link in the message. Transactional messages necessary to operate your account cannot be turned off while the account is open.
• Portability. You may request a copy of the personal information associated with your account in a portable, machine-readable format.

10.2 Utah residents

If you are a Utah resident, the Utah Consumer Privacy Act (Utah Code §§ 13-61-101 et seq.) gives you the right to: confirm whether we are processing your personal data and access that data; delete personal data you provided to us; obtain a copy of the personal data you provided to us in a portable format; and opt out of the processing of your personal data for targeted advertising or the sale of personal data.

We do not sell personal data and we do not process personal data for targeted advertising, so the last right has nothing to operate on with respect to us; we state it here because you are entitled to know it applies. To exercise the others, use the contact method in §14. We will respond within 45 days of receipt, and may extend that period once by a further 45 days where reasonably necessary, in which case we will inform you of the extension and the reason for it. If we decline a request, we will tell you why and how to appeal; an appeal may be submitted by the same contact method and will be decided within 45 days. If your appeal is denied, you may contact the Utah Division of Consumer Protection.

10.3 Residents of other states

Several other states grant residents rights similar to those in §10.2, including rights to access, correct, delete, and port personal information, and to opt out of its sale or of targeted advertising. Where those laws apply to us, we honor those rights on the same terms. We do not discriminate against anyone for exercising a privacy right: we will not deny you the Service, charge you a different price, or provide a different level of quality because you made a request under this section.

10.4 How to submit a request

Submit privacy requests through the contact form, which is reachable from any page on this site. Tell us which right you are exercising and include the email address on your account so that we can locate it. We will take reasonable steps to verify your identity before acting on a request, which normally means confirming control of the account's email address. An authorized agent may submit a request on your behalf with written authorization that we may verify with you directly.

11. Children's privacy

The Service is a business tool intended solely for use by adults in the course of a trade or business. It is not directed to children, and we do not knowingly collect personal information from anyone under 18 years of age. If we learn that we have collected personal information from a child, we will delete it. If you believe a child has provided us with personal information, contact us.

12. Where information is processed

The Service is operated from, and information is stored and processed in, the United States. It is intended for use by businesses operating in the United States. If you access the Service from outside the United States, you understand that your information will be transferred to, stored in, and processed in the United States, where data-protection law may differ from that of your jurisdiction.

13. Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. If we make a material change — in particular, any change to what we collect, to the purposes we use it for, or to the commitments in §5.1 and §5.2 — we will provide notice by email to the address on your account, or by a prominent notice within the Service, before the change takes effect. Your continued use of the Service after a change becomes effective constitutes acceptance of the revised policy.

14. Contact us and governing law

Questions about this policy, and requests under §10, should be sent through the contact form available on every page of this site. We read every message it receives. You can also reach us directly at support@vergapp.com.

This policy, and any dispute arising out of or relating to it, is governed by the laws of the State of Utah, without regard to its conflict-of-laws principles.