Permitless Privacy Policy
Who we are. Tokenburner Labs LLC, a Wisconsin limited liability company, operates Permitless. Address: 1213 S 71st St, West Allis, WI 53214, USA Person accountable for privacy: Justin Nichols, Sole Member, at the address above or legal@permitless.co Where we offer Permitless: the United States Effective date: October 29, 2026 · Version: 1.0
1. Summary
Permitless helps trade contractors find out which permits a job may need, what they may cost, and which published sources support the answer. To do that we keep your account, your profile, the jobs you save and the fees you report, and we send job addresses to two services that turn them into locations. We keep our own records of lookups to improve the service. We do not sell your personal information, we do not use it for advertising, and we use no third-party analytics or advertising trackers.
2. Who this applies to
This policy covers the Permitless website and web application at permitless.co. Permitless is a tool for businesses and the people who work for them, and it is not directed to children (section 11).
3. What we collect, and why
| Data | Where it comes from | Why we use it |
|---|---|---|
| Account records: an account ID, your email address, your password (held only in scrambled form by our sign-in provider), sign-in sessions, and the business or name and trades you give when you sign up | You | Run your account, keep you signed in, and set up Permitless for your trades |
| Acceptance records: which versions of the Terms and Privacy Policy you accepted, whether you used email sign-up or Google, and when | You and generated by us | Show what you agreed to and when, and establish or defend legal claims |
| Google sign-in details, if you use Google (section 4) | Create your account and sign you in | |
| Device and connection data: IP address, browser type, and sign-in times, recorded by our sign-in and hosting providers | Automatic | Security, preventing abuse, and keeping you signed in |
| Contractor profile: company or business name, trades, licenses (state, type, number, expiration), contact phone and email, a default address, and any bond and insurance details you add | You | Fill in your details on permit prep sheets |
| Jobs: the job address, property type, whether it is owner-occupied, the trade, a description of the work, and optional details such as project value, start date, fixtures, equipment and square footage; and the permit answer we produce | You | Produce the permit answer and keep the jobs you save |
| Fee reports: what a permit office charged you, with the permits it covered, line items, date, permit number, the kind of evidence, and any note | You | Show you what you paid against our estimate, and improve our fee information (section 6) |
| Coverage requests: a municipality, county, state and trade you ask us to add | You | Decide which places to cover next |
| Corrections: the part of an answer you say is wrong, your note, and the value you say is right | You | Fix our data |
| Lookup records: for each lookup, an ID, the time, the trade, the property type, how precisely the address was matched, the jurisdiction we found, the result, and a code made from the address and a secret value (a salted hash) in place of the address | Generated by us | See which places and trades are looked up and where lookups fail, and tell when the same address is looked up again. The code is not anonymous: anyone holding the address and our secret value could match it. If you save the job, the lookup record is linked to your account |
| Address cache: a standardized form of each looked-up address and its map coordinates | Generated by us | Make repeat lookups faster. It is stored without any account information |
| Request logs: the time, the page or service requested, the result, and a request ID | Our hosting provider | Security and fixing problems |
| Support correspondence | You | Answer you |
Addresses of your customers. A job address is often someone else's property. Enter only addresses you have a business reason to look up. We use them only to answer and save your lookup.
Permit prep sheets. When you download a prep sheet, we build it from the job and your profile at that moment. We do not keep a copy.
Required information. No law requires you to give us this information. An email address or a Google sign-in is necessary to create an account, and a job address is necessary for a lookup. Your profile details are optional.
4. Google sign-in
If you choose Continue with Google, Google sends us your email address, name, profile picture and Google account ID. We use them only to create your Permitless account, sign you in, show which account you are signed in with, and send account emails to that address. We request Google’s basic sign-in permissions: openid, email and profile. Google may also return identifiers and verification details used to handle your sign-in. We do not ask for access to Gmail, Google Drive, Calendar, contacts or any other Google service. Supabase, our sign-in service provider, may store a Google access token and any refresh token Google provides in our project database during a sign-in that uses a code exchange (PKCE). Supabase deletes that record after a successful code exchange. If the exchange is not completed, the tokens can remain in our project database, and we do not promise a time by which they are removed. Permitless does not put those Google tokens in your sign-in cookie or use them to access Gmail, Google Drive, Calendar, contacts or other Google services beyond basic sign-in.
We do not sell Google user data or use it for advertising. We share it only with Supabase (sign-in and database), Vercel (hosting) and Resend (account emails to that address); where the law requires it; or, with your prior consent, as part of a merger, acquisition or sale of our business. People at Permitless read it only to answer a support request you make, to investigate a security problem, or where the law requires it. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. If we want to use Google user data in a new way, we will update this policy and ask for your consent first.
You can remove Permitless's access to your Google account at any time at myaccount.google.com/connections. That stops future Google sign-ins. It does not delete your Permitless account (section 9).
5. Who receives it
These organizations receive personal information when Permitless runs. Supabase, Vercel, Resend, Geoapify and Google Workspace do so as our service providers, under their published data-processing or customer terms. The Census Bureau and Google sign-in do so under their own terms.
| Organization | Role | What it receives | Where it is based |
|---|---|---|---|
| Supabase | Accounts, sign-in and our database | Everything in section 3 except request logs and support correspondence | United States |
| Vercel | Hosting the website and application | Requests to Permitless, device and connection data, request logs and lookup records | United States |
| Resend | Sending account emails, such as sign-up confirmation and password reset | Your email address and the email | United States |
| Google Workspace | Our email inboxes | Messages you send us | United States |
| Geoapify (Keptago Ltd) | Address suggestions as you type | The text you type into the address field, sent by our server, so not your IP address | Cyprus |
| U.S. Census Bureau Geocoder | Turning an address into a location to find the jurisdiction | The job address, sent by our server | United States |
| Google sign-in | Signing you in, if you choose it | Google knows you used it to sign in to Permitless, under Google's privacy policy | United States |
We will also disclose personal information where the law requires it, or to establish or defend legal claims. If we sell or transfer our business, the buyer would take on the information under this policy, except Google user data, which moves only with your prior consent (section 4).
No sale, no advertising. We do not sell personal information, we do not share it for cross-context behavioral advertising, and we send no marketing email. The emails we send relate to your account.
6. Fee reports and corrections
Your fee reports are visible only to you in Permitless. We use them, together with other contractors' reports, to check and improve our fee information. We may publish fee figures based on reports, but only figures that combine reports from at least three different accounts for the same jurisdiction and permit type, and never with a report's date, permit number or note.
A fee report is a record. If you correct one, we keep the earlier version marked as replaced. If you withdraw one, we keep it marked as withdrawn.
If you delete your account, we keep limited fee-report data to compare local fees: the place named in the permit answer Permitless gave for the job (a city, village or town, or a statewide estimate where we did not cover the municipality, in which case we also keep the city, village or town the address was in, if we identified it) and its state, the permit type or trade, fee amounts, year, the kind of evidence, whether the report said it covered every charge, and whether it was corrected or withdrawn. Each retained report also keeps the name and list position of each permit it covered, as they appeared in that permit answer, and whether the report said plan-review charges, surcharges or technology fees were included. In every retained version, including corrected or withdrawn versions, we remove the permit number, note and links to your account and saved job, replace receipt-line labels with “Line N,” and keep dates only as years. We replace report IDs and account and job references with random IDs, while keeping links between corrections. These steps reduce identification risk, but the remaining details may still allow someone to match a report to public permit records. Copies made before your account was deleted can remain in our providers' backups until those providers remove them.
7. Cookies and storage in your browser
We set no advertising or analytics cookies, and we run no cross-site tracking. There is no Google Analytics, no advertising pixel, no session replay and no fingerprinting. No other company collects information about your activity on Permitless over time or across other sites through our site.
Permitless stores these on your device:
- Sign-in cookie, set by our sign-in provider to keep you signed in.
- Local storage: drafts and recent permit answers, jobs saved on this device, and your usual trade. They stay until you clear your browser's site data for permitless.co.
- Session storage: the answer you are working on, and your sign-up choices while you sign in with Google. These are cleared when you close the tab.
Do Not Track and Global Privacy Control. Our site does not respond to these signals. We do not track you across sites or sell or share your data for advertising.
8. How long we keep it
| Data | How long |
|---|---|
| Account records, profile, saved jobs, coverage requests | Until you delete your account (section 9) |
| Acceptance records | While your account exists, and for 3 years after you delete it. After deletion, we keep them under your former account ID, with a code made from your email address and a secret value in place of the email address itself |
| Fee reports | Until you delete your account, then we keep the limited fee-report data described in section 6 indefinitely to compare local fees. There is no planned deletion date. The remaining details may still allow someone to match a report to public permit records. |
| Google sign-in flow tokens | For sign-ins using a code exchange (PKCE), Supabase deletes the record after a successful exchange. If the exchange is not completed, the tokens can remain in our project database. We do not promise a time by which they are removed. |
| Lookup records and corrections in our database | 24 months, then deleted. Records linked to your saved jobs are deleted sooner if you delete your account |
| Request logs, device and connection data, and lookup records in our providers' logs | The period our providers set for the plans we use. We do not export a copy |
| Account emails | Resend keeps a sending record under its own retention |
| Address cache | Kept, without account information |
| Support correspondence | 24 months from our last exchange with you |
| Information we must keep by law, or to establish or defend legal claims | As long as that requires |
Some of these deletions are done by hand rather than automatically, on a schedule we keep.
9. Your rights
Everyone we serve gets the same rights, wherever they live:
- Access: ask what personal information we hold about you, how we use it, and who we have shared it with, and get a copy.
- Correction: fix your profile and jobs in Permitless, or ask us to fix anything else that is inaccurate.
- Deletion: ask us to delete your account. We delete your account records, profile, saved jobs, coverage requests, and the lookup records and corrections linked to your saved jobs. We do not delete: fee reports are kept with the limited details described in section 6, which may still be matched to public permit records; lookup records and corrections not linked to a saved job, which are deleted on the schedule in section 8; the address cache; copies already in our providers' logs or backups, which remain until those providers remove them under their own retention; a record of an unfinished Google sign-in (section 8); your acceptance records, for the period in section 8; or records the law requires us to keep.
- Withdraw consent: where we rely on your consent, you can withdraw it.
How to ask: email legal@permitless.co from the email address on your account. We may need to confirm the request is yours, usually by confirming you control that address.
How long we take: we answer within 30 days, and we complete an account deletion within 30 days of confirming the request. If we need longer, we will tell you within those 30 days and explain why. We do not charge for a request, and we will never treat you differently because you made one.
Your state's law may give you additional rights or a right to complain to your state attorney general. Where a state privacy law applies to us, we will meet it.
Automated decisions. We make no decision about you by automated means that has a legal or similarly significant effect on you, and we do not profile you. Permit answers are produced automatically and describe a job.
10. Where your information is processed
We are in the United States, and so are our providers in section 5 except Geoapify, which is in Cyprus. Text you type into the address field is therefore processed outside the United States. Our providers may also process information in other countries where they operate.
11. Children
Permitless is a business tool and is not directed to children. Our Terms require you to be at least 18. We do not ask for age or date of birth. If you believe a child has given us personal information, email legal@permitless.co and we will delete it.
12. Security
We use HTTPS, use database access rules so that your account records, profile, saved jobs, fee reports and coverage requests can be read only through your account, and limit access to our systems to the people who run Permitless. No method of transmission or storage is completely secure, and we cannot guarantee the security of information you send us. We are not end-to-end encrypted, SOC 2 certified or HIPAA compliant.
If a breach happens. We will investigate, contain and assess it. If it puts your information at risk, we will tell you directly and as soon as we can, in plain language: what happened, what information was involved, what we are doing, and what you can do. We will meet the notification deadlines of any state law that applies to you.
13. Accountability
Justin Nichols, Sole Member of Tokenburner Labs LLC, is accountable for our compliance with this policy. Write to him at 1213 S 71st St, West Allis, WI 53214, USA, or at legal@permitless.co.
14. Changes
We will post changes here with a new effective date and version. For a change that materially affects how we handle your information, we will notify you by email or in Permitless before it takes effect, and where the law or Google's policy requires it, we will ask for your consent.
15. Contact
Tokenburner Labs LLC, 1213 S 71st St, West Allis, WI 53214, USA legal@permitless.co: privacy questions, access, correction and deletion requests support@permitless.co: everything else security@permitless.co: security reports