GridCite Privacy Notice

Effective date: 2026-08-01 Controller/business: VGG Systems Corp (d/b/a GridCite), 515 Flower St, Los Angeles, CA 90071 Privacy contact: hello@gridcite.com

1. Scope

This notice explains how GridCite processes personal information when you use the Service, contact us, create an account, submit a lead form, request a shortlist follow-up, or purchase a plan.

2. Information we process

Depending on how you use the Service, we may process:

• Account and contact information — email address used for magic-link sign-in; name, phone, email, preferred contact time, and message voluntarily supplied in a lead form. Used to authenticate, respond, support, communicate, and operate the Service.
• Land and shortlist information — county, APN/parcel identifier, selected sites, shortlist item IDs and displayed scores, project-interest category. Used to provide requested screening, save a shortlist, and respond to a requested follow-up.
• Billing information — plan status, Stripe customer/subscription identifiers, transaction status. Used to process and administer subscriptions; full payment-card details are processed by Stripe, not GridCite.
• Technical and security information — session and sign-in cookies; user agent supplied with a lead submission; service logs (request metadata retained by our hosting provider, plus minimal application logs for billing, lead, and contact events that record the outcome and account identifier, not message contents). Used to authenticate, prevent abuse, troubleshoot, and secure the Service.
• Browser-stored preferences — saved shortlists, filters, layout and related application preferences stored in browser local storage. Used to retain requested browser-side settings and improve usability.

Do not submit sensitive personal information, payment-card details, social-security numbers, or confidential project information unless we have expressly agreed to receive it.

3. Sources of information

We receive information directly from you, automatically through necessary account/session technology, from Stripe in connection with payment administration, and from public or licensed land/GIS sources used to operate the Service. Public-source data may contain information about parcels or entities; it is not a statement that GridCite has independently verified every record or has rights to every downstream use.

4. How we use information

We use information to:

• provide maps, preliminary site screening, account features, saved shortlists, exports, and requested support;
• authenticate access and protect against fraud, abuse, and unauthorized use;
• process billing, manage subscriptions, and communicate about account or service matters;
• answer a lead or follow-up request that you initiate;
• maintain, troubleshoot, and improve the Service; and
• comply with legal obligations and enforce our agreements.

We do not use your information to train machine-learning models, and we do not run behavioral analytics or advertising measurement. "Improve the Service" means fixing faults and correcting data quality, not profiling you.

5. How we disclose information

We may disclose personal information to service providers that process it for us. As of the effective date these are: Vercel (application hosting and request logging), a managed PostgreSQL provider (application database), Cloudflare (DNS and domain registration), Resend (transactional and notification email), Stripe (payment processing — card details go directly to Stripe and are never stored by us), and Anthropic (only when you use the optional AI explanation feature, which sends the parcel screening facts needed to write that explanation).

We may also disclose information when required by law, to protect rights/safety/security, in connection with a corporate transaction, or with your direction or consent.

GridCite does not sell personal information, and does not share personal information for cross-context behavioral advertising. The Service runs no analytics, advertising pixels, or ad tools.

6. Retention

We retain information for as long as reasonably necessary for the purposes above, including account administration, customer support, security, legal compliance, disputes, and recordkeeping.

In practice that means:

• Sign-in links — expire shortly after they are issued and are single-use.
• Sessions — expire on their own schedule and when you sign out.
• Account records — kept while the account exists, and deleted within 30 days of a deletion request, except where we must keep something to meet a legal obligation.
• Lead and contact submissions — kept for up to 3 years so we can answer follow-ups and show what was requested.
• Billing records — kept for 7 years, because tax and accounting rules require it.
• Server logs — kept on our hosting provider's standard retention schedule, which is measured in weeks, not years.
• Cached property-owner contact details — kept for 90 days from the date we obtained them, then deleted. See section 12.
• Backups — cycle out on their normal schedule, so deleted data can persist briefly in a backup before it ages out.

7. Your choices and rights

You may request access, correction, deletion, or other rights available under applicable law by contacting hello@gridcite.com. We may need to verify your request and may retain information where law permits or requires it.

California residents and residents of other U.S. states may have additional rights, such as rights to know, delete, correct, opt out of sale/share/targeted advertising, or limit certain sensitive-information processing. As stated above, we do not sell or share personal information for advertising, so there is nothing to opt out of.

To exercise any right — or to act as an authorized agent on someone else's behalf — email hello@gridcite.com. We will verify the request before acting on it, and we will not discriminate against you for making one.

You may manage a paid subscription through the customer portal. Subscriptions do not renew automatically, so a paid term simply ends on its end date; deleting an account does not by itself end an active paid term or entitle you to a refund for it.

8. Cookies and local storage

We use necessary session/sign-in cookies and browser local storage to authenticate, preserve requested settings, and operate the Service. As of the effective date we use no analytics, advertising, or other non-essential cookies. See the Cookie Notice for details.

9. Security

We use reasonable administrative, technical, and organizational measures designed to protect information. No system is perfectly secure, and you should not send highly sensitive information through ordinary forms or email.

10. Children and international users

The Service is a business tool and is not intended for children. We do not knowingly collect personal information from anyone under 13. If we learn that we have, we will delete it.

The Service is operated in, and offered to users in, the United States. If information is transferred across borders, we will handle it in accordance with applicable law.

11. Changes and contact

We may update this notice by revising the effective date. Contact hello@gridcite.com with privacy questions or requests.

12. Property owners who are not users of the Service

Most of this notice describes information about you, someone who uses GridCite. This section is different: it describes information about **property owners**, who have not signed up for anything and may not know the Service exists. We think that difference deserves saying plainly rather than being folded into the sections above.

What we hold. Owner names come from county assessor and recorder records, which are public. Where a customer requests it for a specific parcel, we may also obtain an owner's mailing address, phone number, or email address from public records and licensed third-party data providers.

How long. Contact details obtained this way are cached for 90 days from the date we obtained them and are then deleted. We keep them so that looking at the same parcel twice does not repeat the lookup — not to build a directory. We do not sell them, and we do not share them for advertising.

How confident we are. A mailing address printed on a tax roll may name a trust, an agent, or a former owner. A phone number or email address matched to a name by a data provider was inferred, not published by that person, and may be wrong or belong to somebody else. The Service labels these accordingly and never presents them as confirmed.

Your rights if you are a property owner. Email hello@gridcite.com with the parcel number or property address and we will tell you what we hold, correct it, or delete it. You do not need an account, and you do not need to explain why. If you tell us not to hold your contact details, we will delete them and we will not re-acquire them for that parcel.

Outreach. GridCite does not contact property owners on a customer's behalf. A customer who contacts you is responsible for their own compliance with marketing, calling, and anti-spam laws.