Last updated: October 12, 2026
When you create an API key, we collect your name and email address and, if you provide it, your company. We also record the page you signed up from and the site that referred you. When you make API requests, we log the request time, the endpoint, the query parameters you sent (for example the city or filters you searched), the response status and how long it took, together with an internal identifier for your API key. We use this for rate limiting, usage reporting and troubleshooting. We do not log the data we return to you. Our web server also keeps standard access logs (IP address, URL and time), which are deleted after 14 days. Our text message program (section 8) has one enrolled mobile number, that of PermitStack's owner and operator; for it we keep the messages sent and received and the opt-in and opt-out records. If anyone else texts or calls the program's number, (754) 260-1306, we log the calling number, the time and any message text, and we do not reply except for the standard keyword replies described in section 8.
We use your information to:
PermitStack aggregates publicly available building permit data from official U.S. government sources: city and county permit systems and open-data portals, county property appraisers and assessors, and state contractor licensing boards. All permit data served through our API is derived from public government records. We do not collect, store, or serve private personal information beyond what is published by government agencies.
We use the following third-party services:
gclid) and any campaign parameters in the link are recorded and stored against your account, so we can tell which advertising produced a signup. If you create an account, we send Google a one-way SHA-256 hash of your email address (Google calls this "enhanced conversions") so it can match that signup to the ad click. We do not send Google your name, your plaintext email address, or any permit data you query. The Google Ads tag may also be used to build audiences for advertising.We do not sell your personal information for money. Under the California Consumer Privacy Act as amended by the CPRA, the use of advertising cookies and identifiers described above may be considered a “sale” or “share” of personal information for cross-context behavioural advertising. You can opt out at any time using the controls in section 7, or by emailing support@permit-stack.com with the subject “Do Not Sell or Share My Personal Information”. We will not discriminate against you for exercising that right.
We do not rent or share your personal information with third parties for their own marketing purposes.
Apart from Twilio, which receives phone numbers only to deliver our text messages (section 8), and our hosting provider, OVH, which stores our own records on our servers, none of the services above receives mobile phone numbers or text message opt-in data and consent, and none of the advertising, analytics or other sharing described in this section includes them.
Account data (name, email, company if provided, and your API key in the forms described in section 6) is retained for the lifetime of your account. API usage logs are retained for 90 days and web server access logs for 14 days. Text message and call logs and SMS opt-in and opt-out records are kept as described in section 8 (at least 4 years). You may request deletion of your account and data by contacting us.
We verify API keys against a SHA-256 hash. So that you can view your key again from the dashboard, we also keep an encrypted copy of it (encrypted at rest with a key stored separately from the database), which is decrypted only when you ask to reveal it after confirming a code sent to your email. We never write your raw API key to our logs. All traffic is encrypted via TLS.
The PermitStack website uses Google Analytics and Google Ads (gtag.js), and a Meta pixel on some pages. These set cookies to measure aggregate site traffic, to attribute signups to the advertising that produced them, and to build advertising audiences. We also store the advertising identifiers described in section 4 in your browser’s local storage for up to 90 days. The API itself does not use cookies, and none of this applies to requests you make with an API key.
You can opt out in any of these ways:
PermitStack, a sole proprietorship owned by Daniel Pfledderer and registered as Permit Stack, runs one text message program, PermitStack System Alerts, from the number (754) 260-1306. It sends one-way automated operational alerts about the PermitStack service (for example a failing API health check, a failed nightly backup, failed overnight data import jobs, a failed subscription payment or customer support emails waiting for a reply) to PermitStack's owner and operator, who is its only recipient. The operator opts in from his own mobile phone by texting START to (754) 260-1306 and then replying Y to confirm; only the operator's number can complete enrollment. Customers, API users and website visitors are never enrolled, and customers cannot reach PermitStack by text message. We never send customers text messages, and (754) 260-1306 is never used to call or text a customer; we contact customers by email.
What we collect for this program. The operator's mobile number; each message sent and received, with its time and send status; and the opt-in and opt-out records (the START and Y texts, any STOP, and their times). (754) 260-1306 does not take texts or calls from anyone else. If another number texts or calls it, we log that number, the time and any message text. We send no reply to it apart from the standard keyword replies (to STOP, to HELP, and to START or another re-subscribe keyword) that our messaging provider sends automatically to any number, and calls from other numbers are declined. Alert messages never contain a customer's name, email address or other personal data.
Sharing. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties. We do not sell or share SMS opt-in data or the mobile number used for this program with third parties for marketing purposes. Our messaging provider, Twilio, receives phone numbers and message text only to deliver these messages for us. None of the advertising, analytics or other sharing described in section 4 includes mobile phone numbers or text message opt-in data and consent.
Frequency, cost and opting out. Message frequency varies. Message and data rates may apply. Reply STOP to opt out at any time, or HELP for help. Help is also available at support@permit-stack.com.
Retention. We keep SMS message and call logs for at least 4 years. Opt-in and opt-out records are kept while the number is enrolled and for at least 4 years after it opts out. Program details, the opt-in instructions and the exact messages: SMS alerts.
We may update this policy from time to time. Changes will be posted on this page with an updated date.
For privacy-related questions, contact us at support@permit-stack.com.