Privacy notice

• Account: your email address, an optional display name, and sign-in records. Sign-in codes and sessions are handled by our authentication provider. Accounts do not have passwords.
• Organization: company name, website and main phone; who belongs to it and their roles; invitations, including the invited email address.
• Settings: the areas you choose and your email preferences.
• Subscription: plan status and dates, and Razorpay subscription and payment identifiers and the subscription events Razorpay sends us. Card details are entered in Razorpay's checkout; we don't receive or store your full card number.
• Your team's work: statuses, saved opportunities, estimated job values, private notes, outcome feedback and data reports, and the activity history they create.
• Email: a delivery log for emails we send (recipient, subject, status and the provider's message id), and anything you send to our support mailbox.
• Product analytics: first-party events such as viewing the home page, opening a sample, or starting and abandoning checkout. Events are stored in our own database with your account identifiers when you are signed in. They never contain email addresses, street addresses, names or free text.
• Security and operations: short-lived rate-limit counters keyed by one-way hashes of email and IP addresses, server logs, and an audit log of actions our staff take in the operator console. When an error occurs, we send the error message and technical context to our error-reporting service.

To build opportunities we collect public New York City records (FDNY summonses from the OATH Hearings Division, housing registrations and tax-lot data) and research public business contact details: company names, their role at a property, business addresses, and business phone numbers, email addresses and websites, with where and when we found them. We also keep the FDNY's public list of approved fire alarm companies and records of our own sales outreach to those companies.

Public records sometimes name individuals. We keep individuals' details internal: our systems do not show a person's name, phone number or email address to customers. To ask us to correct or remove information about you or your business, email fanlight@hane.studio.

• to run your account and deliver opportunities to your organization;
• to send sign-in codes, invitations, account emails and the daily opportunity email you can switch off;
• to take payment and keep subscription records;
• to answer support requests and correct research;
• to keep the service secure and prevent abuse;
• to understand how the product is used and improve it.

• Sign-in session cookies from our authentication provider, needed to keep you signed in.
• An organization cookie that remembers which organization you are working in, if you belong to more than one.
• An anonymous session cookie with a random id that groups the analytics events of one visit and limits request rates. It expires when your browser session ends.

We don't use advertising cookies, tracking pixels, session recording or third-party analytics.

We use these service providers, each for the part of the service it runs:

• Supabase: database and authentication, including sign-in emails.
• Resend: invitations, account emails and the daily opportunity email.
• Razorpay: subscription payments and billing.
• Sentry: error reporting.
• Our website hosting provider, which serves the site and processes requests to it.

When you open checkout, Razorpay's payment window loads from Razorpay. Links to maps, city records and business websites take you to those sites, which have their own policies. We share information with others only when the law requires it. We don't share your account information with advertisers.

• Account, organization and workflow data are kept while your account exists, including after a subscription ends, so your notes return if you subscribe again.
• Subscription and payment records are kept as billing records.
• City records that never became part of an opportunity are deleted automatically after a set period (120 days by default).
• Rate-limit counters are deleted after about a day.
• We have not set fixed deletion periods for email logs, analytics events and audit logs yet. You can ask us to delete your account at any time.

Email fanlight@hane.studio to ask for a copy of your information, to correct it, or to delete your account. You can change your name and email preferences in Settings, and switch off the daily opportunity email at any time.

Access to an organization's data is limited to its members and to our staff who run the service, and this is enforced in the database as well as in the app. Connections to the site are encrypted. No system is perfectly secure; tell us at fanlight@hane.studio if you notice a problem.

We'll post changes to this notice here and update the date at the top. The Terms of service describe the service itself.