Privacy Policy

• Account information: your name, email address, company name, role, email preferences, and the organizations you belong to.
• Project information: site addresses and map coordinates, project and site details, questionnaire answers, BMP selections, contact and operator details you enter, and the documents we generate from them.
• Uploaded files: documents and images you attach to a project. When we read an uploaded document, we store the values it proposes (as read and as normalized), the page each came from, and a short quote from the source, before you accept, edit, or reject them.
• Payment records: Stripe collects your card details; we never receive the full card number. We keep the Stripe customer and payment identifiers, amount, plan, status, and receipt link.
• Consent records: which version of our Terms and this policy you accepted, and when.
• Technical information: IP address (used for rate limiting and security), device and browser details, pages viewed and features used (through product analytics), and error reports.

We use information to provide and maintain the Service; to generate and deliver your documents; to process payments; to send account, generation, and payment emails; to understand how the Service is used and fix problems; and to protect against fraud and abuse. We do not sell your personal information, share it for targeted advertising, or use your project information or files to train AI models.

We share information with these providers, which process it on our behalf and only to perform services for us:

• Cloudflare: hosting and running the application.
• Supabase: database, sign-in, and file storage.
• Stripe: payment processing.
• Anthropic: an AI model that drafts plan narrative from your project information and reads uploaded files to propose values for you to accept, edit, or reject. Anthropic does not train its models on this data.
• Postmark: transactional email.
• PostHog: product analytics.
• Sentry: error monitoring.
• Upstash: rate limiting, using IP addresses and account identifiers.
• Mapbox: maps, satellite imagery, and address lookup.

To build your plan, we send the site’s address or coordinates (not your name or email) to public data services, including the U.S. Census Bureau geocoder, the U.S. Environmental Protection Agency, the USDA Natural Resources Conservation Service, the National Oceanic and Atmospheric Administration, and the Water Quality Portal.

Members of your organization can see its projects. We may also disclose information when the law requires it, to protect our rights or the safety of others, or as part of a sale or reorganization of our business.

We use cookies that keep you signed in. Product analytics (PostHog) uses a cookie and local storage to record pages viewed and features used. When your browser sends a “Do Not Track” signal, analytics records nothing for that browser. We do not use advertising trackers.

• We keep account information while your account exists. Deleting your account in your settings permanently deletes your sign-in, profile, organization memberships, and consent records.
• Projects, uploaded files, generated documents, and payment records belong to your organization. They are not deleted with your account and are kept while the organization exists, until the project is deleted or we act on a deletion request.
• Deleting a project removes it from the Service. Files stored for a deleted project are not erased automatically; email us to have them erased.
• For each project we keep the five most recent generated versions and delete older ones. Once a project has an amendment, we keep every version of it.
• Seven days after we read an uploaded document, we delete the values proposed from it that you did not accept or edit, and clear the source quotes. Values you accepted or edited are kept with the project.
• Stripe keeps payment records as its own legal obligations require, and our providers keep backups and logs on their own schedules.

We apply administrative and technical safeguards designed to protect your information, including access controls that keep each organization’s data separate and encryption in transit. No method of transmission or storage is completely secure.

If a breach affects your private information and you live in New York, we will notify you as New York General Business Law § 899-aa (the SHIELD Act) requires — in the most expedient time possible and without unreasonable delay, and no later than 30 days after the breach is discovered, unless a law-enforcement agency determines that notice would impede a criminal investigation. Wherever you live, we will also notify you as other state and federal breach-notification law requires.

You can update your profile in your account settings. To request a copy of your data, or deletion of your organization’s projects and files, email us. Depending on where you live, you may have additional rights under applicable privacy laws. We will verify and respond to requests as the law requires.

The Service is for adults using it for work. We do not knowingly collect information from anyone under 18.

When we change this policy, we post the new version here and update the date at the top of this page. When a change comes with new Terms of Service, you will be asked to accept both before you continue using your account.

For privacy questions or requests, contact support@siltworks.com.