Privacy.

Who we are

SiteReport is operated by Beneath. For data protection purposes Beneath is the controller of the personal data described here. Reach us at privacy@usebeneath.com.

What we collect

Property checks: the address you enter, the location and parcel it resolves to, and the result. A free check is kept, without an account, so the same property can be answered from the cache and so the report you buy is for exactly the property you checked. It is not linked to you unless you sign in or buy.

Purchases and reports: the report you buy, the evidence it was built from, the property it names, and the email address Paddle holds for the payment, which we keep so the report can be attached to your account when you sign in with it.

Account and team data: your email address, and your name and profile image if you sign in with Google; the workspace you belong to, your role in it, and the addresses you invite. Studio workspaces also keep the name, website and logo they put on reports.

Billing data: your plan, credits, subscription status and invoice history. Card details are entered into and held by Paddle. They never reach our servers.

Operational logs: request metadata, IP address, browser and coarse location, kept for security, abuse prevention and debugging. Rate limits are keyed on them. We do not build advertising profiles and we do not sell anything about you.

Why we are allowed to

We process checks, reports, account and billing data to perform the contract you enter into when you use the service. We process operational logs under our legitimate interest in keeping the service secure and working. Where we rely on consent, such as analytics, you can withdraw it at any time.

Who else processes it

Supabase, for authentication, application data and private report storage. Paddle, as merchant of record, for payment, tax and invoicing. Cloudflare, for hosting and for rendering PDFs. Resend, for the emails we send about your reports and your team, which receives your address and the message. The US Census Bureau geocoder, which receives the address you check; the Texas Geographic Information Office and the Texas Water Development Board, whose public services answer with parcels and well records; and the map imagery provider your browser requests tiles from when a map is shown. Google Analytics and PostHog, for product analytics, which see which pages are opened and which actions are taken, never the address you checked or the contents of a report.

Each is bound by a data processing agreement. We do not share your reports with anyone else, and we do not use them to train models for other customers.

Share links

A share link you create shows the report it names to anyone who holds the link, without an account. It is a random token, it can expire, and you can revoke it. A refunded report's links stop working. We record when a link is opened.

Where it lives

Data is processed in the United States, where the service and its sources are, and may be processed in the European Union. Where personal data leaves the region it was collected in, transfers rely on Standard Contractual Clauses or an equivalent safeguard.

How long we keep it

A report you bought, and the evidence snapshot behind it, is kept while your account is open and for thirty days after you close it, so a report you paid for is there when you come back for it. A free check is kept for thirty days. The email held for an unclaimed purchase is kept until the report is claimed or deleted. Billing records are kept for as long as tax and accounting law requires, typically seven years. Operational logs are kept for ninety days.

Your rights

You can ask for a copy of your data, correct it, delete it, restrict or object to processing, or take it elsewhere in a portable format. You can delete a saved property yourself. Write to privacy@usebeneath.com and we will answer within thirty days.

If you are in California you have the rights described in the CCPA, including the right to know and the right to delete; we do not sell or share personal information as those terms are defined there. If you are in the EEA or the UK you may also complain to your local supervisory authority.

Cookies

We set the cookies needed to keep you signed in, to remember your interface preferences, and to attach a report you bought without an account to the browser you bought it in. These are essential.

Google Analytics and PostHog set analytics cookies when they run. Neither is loaded until you allow it where the law asks us to ask, and either way you can turn analytics off, or back on, with the switch in the footer of every page. A Do Not Track signal is treated as a refusal.

Changes

If we change this policy materially we will say so by email or in the application before the change takes effect. The date at the top of this page always reflects the current version.