Privacy policy

What we collect

When you visit the site or the app

• Pages you view, what you click, scrolling, errors, page-load timing, your browser, device and screen size, and the page or link that brought you here, including campaign tags in the link (such as utm_source).
• Your IP address, and the approximate location (city, region, country) our analytics provider derives from it.
• Session replay: a recording of the page as you used it, including mouse movement, clicks and what you type into ordinary fields such as a ZIP code, a city or an email address, plus browser console messages. Passwords, sign-in codes, card fields and other secret fields are masked in your browser before anything is sent.
• What you look up: the ZIP code, city or firm name you type, and the region it resolves to.

When you give us your email

When you enter your email to download a list, get Monday's list, ask to hear when your state is covered, book a call or sign up, we store your email, the region you looked at, the page you were on, and where your first and latest visits came from (the referring site and campaign tags).

When you have an account

• Your email, your name if you give it, your firm's region and the people you invite.
• Your plan, trial dates, and sign-in records (time and browser).
• If you pay: Stripe collects your card and billing details on its own page. We never see or store your card number. We keep the Stripe customer and subscription IDs and your plan status.
• The lists you export (CSV or PDF), and when.

What you send us

"Wrong record?" reports, feedback (with a screenshot if you attach one), call requests and your emails to us.

Emails and links

We keep a copy of each email we send you and whether it was delivered. When you click a record link in one of our emails, we log the click (time, browser, and which record) before sending you on to the state's page.

Server logs

Our servers log requests (IP address, browser, the address asked for) to run the service and block abuse.

Cookies and local storage

• bp_ft and bp_lt: where your first and latest visits came from (campaign tags, referring site, landing page). They last over a year unless you clear them.
• bp_internal: marks our own test visits so they don't count in our numbers.
• PostHog's cookie and local storage: an ID that ties your visits together, and, once you sign up, to your account.
• When you sign in to the app, it keeps a sign-in token in your browser so you stay signed in.

These are set for bondpassed.com and its subdomains, so the site and the app share them. We use no advertising cookies, ad networks or ad pixels.

How we use it

• To run bondpassed: show your region, send your weekly list and account emails, and take payment.
• To improve it: see where people get stuck (analytics and session replay), fix errors, and check the records you report.
• To keep our team in the loop: signing up, downloading a list, reporting a wrong record, asking for a call and sending feedback each send our team an alert email with the details you gave.
• To keep it safe: rate limits, and spotting bots and abuse.
• To write to you about your account and the service (next section).

We don't use your data for advertising, and we don't sell it.

Emails we send

• Download a list with your email: if that email has no account yet, we open a trial for it (14-day free trial, no card). We send a receipt with a sign-in link. Trial emails follow: a welcome, the weekly list on Mondays, an offer to tune your region after your first week, a note when we fix something you reported, and a reminder before the trial ends.
• Ask for Monday's list: one email. Nothing more unless you start a trial.
• Sign in: a one-time code or link, when you ask for it.
• Invites: when someone on your firm's account invites you.

The weekly list has an unsubscribe link. You can also reply to any of our emails and ask us to stop.

Who we share it with

We share personal data only with the providers that run bondpassed for us, for the purposes above. Each handles it under its own terms and privacy policy.

Our providers may process data in the United States and other countries. PostHog stores our analytics in its EU cloud.

We may also disclose data when the law requires it, to protect people or our rights, or to a buyer if the business is sold. A buyer would have to keep this policy's promises for data collected under it.

We don't sell personal data, and we don't share it for cross-context behavioral advertising (the "sharing" that some state laws let you opt out of).

Who sees your regions

No other customer. People you invite to your firm's account see its region and its list. Our team can see it to run the service and to answer you.

Public records in the feed

The feed shows public records as filed with the state: project owners, design firm names (sometimes a person's name), projects and bond elections, from TDLR, the Texas Bond Review Board and TBAE. Every line links to its record.

If a record about you or your firm is wrong, use "Wrong record?" on that line or email us, and we'll check it against the source. We can't change the state's own record; the agency that holds it can.

How long we keep it

• Account data: while your account exists, and after that until you ask us to delete it.
• Emails you gave us, reports and messages: until you ask us to delete them.
• Analytics events and session recordings: for as long as our PostHog plan keeps them.
• Billing records: as long as tax and accounting law requires.

Your choices and rights

• See, correct, export or delete your data. Email us. We'll confirm the request and do it, unless the law requires us to keep something (such as billing records). It's free. If you disagree with our answer, reply and we'll look at it again.
• Stop emails. Use the unsubscribe link in the weekly list, or reply and ask.
• Block analytics. A content blocker that blocks PostHog stops our analytics and session replay. The site still works.
• Do Not Track and Global Privacy Control. We don't sell personal data or use it for advertising, so there is no sale or ad sharing for these signals to stop. Our analytics run either way.

Some US states, such as California, give their residents rights to know, correct and delete personal data and to opt out of its sale. We give these rights to everyone, wherever you live.

If we emailed you first

We write to architecture firms using public sources only: the Texas Board of Architectural Examiners' public firm roster, firms' own websites and other public business directories. We keep your name, firm, work email, where we found them and whether you replied. Reply "no" and we won't email you again.

Children

bondpassed is a tool for businesses. It isn't meant for children, and we don't knowingly collect data from anyone under 13.

Changes to this policy

When we change this policy, we update the date at the top. If a change matters for customers, we email account holders before it takes effect.

Contact

Questions or requests about your data:

Email

hello@bondpassed.com

Mail

Helios One
3075 Clay St
San Francisco, CA 94115