Privacy Policy

Last updated: October 12, 2026 · Effective date: October 12, 2026

This policy explains how Hazard Clarity, the operator of hazardclarity.com, collects, uses, retains, and discloses information through property reports, professional tools, pilot applications, requested communications, and the website. Privacy questions and requests may be sent to thano@hazardclarity.com or submitted through the contact page using the privacy/data-request reason.

1. Information we collect and why

We collect information from your submissions, your use of the website, public data sources, participating agencies, and the service providers that help us operate the service. The categories and purposes below also describe our notice at collection. Information linked or reasonably linkable to a person is treated as personal information; an address hash or browser identifier is not assumed to be anonymous.

  • Property searches and report records: the address you enter, a matched or confirmed address, derived property coordinates, state, ZIP code, county information when available, hazard results, source diagnostics, report and request references, generation times, and address-confirmation information. We use these to locate the property, generate and retain the report, diagnose errors, and support a requested follow-up.
  • Every submitted address-check attempt: we retain an internal submission record even when a check needs confirmation, cannot resolve an address, is invalid, is rate-limited, or fails. It includes the submitted address when provided, timing, outcome, confirmation/retry information, geography when resolved, limited page/referrer attribution, technical status, and hashes used to distinguish repeated searches. This supports complete request accounting, reliability, and county/state activity summaries.
  • Optional insurance requests: name, email, phone when supplied or needed for your chosen call/text response, property and report information, selected agency, contact preference, relationship to the property, financing context, requested insurance product, and optional context such as roof age, bundle interest, purchase or renewal timing, and current-insurance status. We also retain consent records, routing information, delivery/retry history, and recorded request outcomes to fulfill and support your request.
  • Agency applications and professional accounts: agency and producer names, business contact details, claimed service states, physical office states, license or NPN references, products, service area, application notes and contact permission. Approved accounts may include profile/branding information, approved markets and capacity, credential and session information, review and activation history, agreement references, and authorized delivery recipients. We use these for eligibility review, access, routing, personalization, security, and participation administration.
  • Brief subscriptions and intelligence-report early access: name, email, organization or role when supplied, requested states, cadence or delivery preferences, permission and subscription status, and delivery history. We use these for the specific brief, availability updates, or early-access request you make. A waitlist request does not activate a pilot account.
  • Contact and support messages: your name, email, chosen topic, optional property address, message, attachments if you send them by email, and related correspondence. We use these to respond, investigate, and maintain an operational record.
  • Usage and technical information: page and feature interactions, coarse traffic source, report categories and levels, property state/ZIP, availability outcomes, and repeat-search indicators. Hosting, security, and analytics providers may also process IP addresses, browser/device information, browser identifiers, cookies, timestamps, and request or error logs to deliver, protect, and measure the website.

We do not request Social Security numbers, payment-card details, bank-account credentials, medical records, or biometric identifiers through these forms. Do not put that information in application notes, support messages, or other free-text fields. We do collect professional license/NPN references for agency review. We derive coordinates for the property you research; we do not request your device's GPS location.

2. How we use information

We use the information for the purposes described above: delivering reports and requested professional follow-up; reviewing and administering participation; providing approved dashboards and communications; troubleshooting and preventing abuse; measuring service activity; preparing aggregate intelligence; responding to privacy and support requests; and meeting applicable legal and recordkeeping obligations. Educational screening results are not insurance underwriting, lending approval, or a decision to grant or deny a policy.

3. When an insurance agency receives information

Running a property report does not automatically send your address or report to an insurance agency. When you select an eligible agency and affirmatively submit a follow-up request, we disclose the request, relevant report, contact preferences, and consent information to that agency through its authorized dashboard, notification recipients, or configured agency system. Hazard Clarity retains an operational copy, and its authorized administrators may receive notifications to support the request and delivery.

We do not send your request to an unselected agency merely because that agency serves your state. The selected agency separately controls the information it receives for the requested professional service and its legal recordkeeping. Its own privacy notice applies to its subsequent processing. Contact it directly about its communications or records; you may also ask us for help identifying the agency associated with your request.

4. Address tracking, analytics, and county intelligence

Our internal submission ledger and report storage contain property addresses and operational references. Raw submission rows are restricted to authorized Hazard Clarity administration. County, state, and market activity summaries can count searches, completions, repeat properties, and unresolved or excluded attempts. Those summaries do not turn every search into an insurance lead.

Separately, our application analytics store accepts a limited set of fields such as event type, property state/ZIP, hazard category and level, traffic source, page attribution, availability outcome, and a random screening-group reference. It does not receive contact names, emails, phone numbers, street addresses, property coordinates, IP addresses, or operational report/lead IDs through that event interface. Repeat-property detection uses a one-way address hash with first/last-seen times and a count. Hashes reduce direct exposure but can still be linkable to a property; we do not describe them as fully anonymous.

Partner-facing aggregate reporting must not expose raw searched addresses, address hashes, individual contact details, or internal request identifiers. Monthly and quarterly county/market reports remain early access and are released only when verified inputs and privacy-protected aggregate activity support a report-ready foundation. Public-event intelligence and educational content are distinct from private consumer-request records.

5. Cookies, browser storage, and analytics choices

We use necessary browser/session storage to operate professional sign-in, keep preferences, and support the interface. Professional browser access uses a signed, expiring session cookie with security protections. You can clear cookies or browser storage, but doing so can sign you out or reset preferences.

Google Analytics measures page usage and selected funnel interactions and may use cookies and browser/device identifiers. Our tag configuration disables Google signals and advertising personalization. We remove query strings from the page location sent to Google and restrict referrer information; we do not intentionally send report addresses, contact-form fields, operational report IDs, or lead IDs to Google Analytics.

The “Do Not Sell or Share My Personal Information” control in the website footer stores an analytics opt-out preference in that browser's local storage. It disables our extra client-side engagement events and Google Analytics for that browser and removes applicable Google Analytics cookies through our preference code. The control can be used again to change that browser preference. A supported Global Privacy Control (GPC) signal also disables those client-side events and Google Analytics, regardless of a conflicting local preference.

These choices do not stop records needed to fulfill and secure an address check or professional request, the submission ledger, or server-side report-generation/repeat-search statistics. They do not withdraw a request already sent to your selected agency. The browser preference is not an account-wide setting; use it on each browser/device or keep GPC enabled. For broader data or communication requests, contact us.

6. Sale, targeted advertising, and communications

We do not sell personal information, raw address-submission records, or consumer contact lists. We do not share personal information for cross-context behavioral advertising or use it for targeted advertising across unrelated websites. The disclosure of a follow-up request to the agency you select is for the service you request, not permission to sell that request or contact information onward.

Applications, contact messages, and report requests do not automatically enroll you in unrelated marketing. Brief enrollment and early-access availability updates use the permission and preferences associated with that request. To stop those communications, use available preference controls or email thano@hazardclarity.com identifying the email address and communication you want stopped. An agency's direct response to your insurance request is handled separately.

7. Service providers and other disclosures

  • Government and hazard-data sources: Census geocoding receives the entered address to resolve its location. Hazard-data services, including FEMA, USGS, and US Forest Service sources, receive relevant location coordinates or geographic queries. These requests do not include your contact-form name, email, or phone number.
  • Mapbox: when enabled, receives partial address input for suggestions and may receive a full address for an alternate location match. You must confirm an alternate match before it is used for the report. Permanent alternate geocoding allows the matched address and coordinates to be retained with report records. We do not send your insurance-request contact details to Mapbox. See Mapbox's privacy policy.
  • Hosting, storage, and network operations: Railway, Supabase, and relevant network/DNS providers such as Cloudflare process the records and technical information needed to run, store, secure, and troubleshoot the service. Authorized administration and infrastructure diagnostics can include request logs and connection metadata.
  • Email and approved integrations: Resend and authorized agency notification/integration systems receive the recipient addresses, message content, and delivery metadata needed for requested communications. We retain provider acceptance, failure, and retry records. A provider acceptance record is not proof of inbox receipt.
  • Analytics: Google Analytics receives the limited browser/page information described in Section 5, subject to the browser preference and GPC controls.
  • AI-assisted public content: OpenAI supports research and preparation of educational articles and partner content about public hazard events. That content workflow uses public-event/source information, not consumer contact lists or private insurance-request records.

We may also disclose information when necessary to comply with applicable legal process, protect rights or safety, investigate abuse, or support a lawful business transfer with appropriate handling of affected records. Service providers receive information for their relevant service functions. Independent government tools, linked websites, and the selected agency have their own privacy practices.

8. Retention and deletion

We retain records according to their purpose: open requests and professional participation; report support and error investigation; permission, delivery, and audit history; useful activity summaries; and applicable legal, dispute, or security needs. We consider whether the record still supports one of those purposes, whether a request or account remains active, whether legal retention is required, and whether deletion or de-identification is appropriate.

Current retention behavior: report snapshots, address-submission records, application analytics, and operational delivery/audit records do not have a fixed automatic expiration schedule. They remain stored until removed or de-identified through an operational review or a verified privacy request, subject to applicable retention exceptions. We do not claim that all analytics are anonymous or exempt from privacy requests.

Verified deletion requests are handled manually. A request can be limited by lawful recordkeeping, fraud prevention, security, an ongoing authorized transaction, or other applicable exceptions; we explain an applicable limitation. Backups and provider logs can retain limited records for their recovery or retention cycle; retained backup copies are not used to restore a deleted record to routine use. A selected agency may have separate legally required retention duties and must handle requests concerning its own records.

9. Privacy rights and how to exercise them

You may contact us to ask whether we process information about you, request access or a usable copy, correct inaccurate information, request deletion, or withdraw permission for optional communications. Depending on your location and applicable law, additional rights may include information about data categories, sources, purposes, and recipients; limits on sensitive-information uses; and opt-outs of sale, targeted advertising, or certain significant automated decisions. Our current service practices concerning advertising, sale/sharing, and screening are described above.

Submit a request: email thano@hazardclarity.com with “Privacy request” as the subject, or use the contact page and select the privacy/data-request topic. Tell us the action you request and enough information to locate the relevant record, such as the email used, report or application reference, property address, or approximate submission date. Do not send Social Security numbers, payment credentials, or unnecessary identity documents.

We may request information reasonably needed to verify your identity or an authorized representative's authority before disclosing, correcting, or deleting private records. No account is required to submit a privacy request. We handle qualifying requests without charge and do not discriminate against you for exercising an applicable privacy right.

Response and appeal: we respond within applicable legal deadlines, ordinarily within 45 days for a qualifying access, correction, or deletion request. If a legally permitted extension is needed, we notify you within the initial response period and explain it. If we decline a request, we explain the reason and you may appeal by emailing the same address with “Privacy appeal” and the original request reference. We review the appeal and respond within 60 days, or a shorter period when applicable law requires. You may also contact your state's attorney general or appropriate privacy regulator; Indiana residents may use the Indiana Attorney General's complaint process.

10. Children and sensitive information

The service is intended for adults and professional organizations, not children. We do not knowingly collect personal information from children under 13, or under a higher age threshold when applicable law requires. If you believe a child has submitted personal information, contact us so we can investigate and remove it as required. A parent or guardian may exercise applicable rights for their child.

Property addresses and derived property locations may be sensitive in context. We use them to provide the requested property service, maintain the operational records described here, and prepare protected aggregate activity—not to track your physical movements or infer protected personal characteristics. Do not submit sensitive personal information unrelated to the service.

11. Security and processing locations

We use administrative and technical measures such as HTTPS, restricted operational access, agency-scoped access controls, credential/session protections, and database protections. No system can guarantee absolute security. Report suspected unauthorized access or disclosure to thano@hazardclarity.com.

Hazard Clarity serves United States properties. Information may be processed in the United States and other countries where our infrastructure or providers operate, and local privacy laws can differ. This policy does not represent that every record is stored only in the United States.

12. Changes and contact

We update this policy when our practices change and publish the updated effective date and version. We provide additional notice or seek additional permission for a material change when required by applicable law. A policy update does not by itself authorize a new use that requires your consent.

Privacy questions, rights requests, or appeals: thano@hazardclarity.com or the contact page. Service and pilot participation are governed by the Terms of Service.

Privacy version: HC-PRIVACY-2026-10-12. Effective date: October 12, 2026.