Privacy Policy

2. Information We Collect

2.1 Information You Provide

We collect information you voluntarily provide to us, including:

• Account Registration: Name, email address, password, organization name, job title, and professional contact information.
• Project Data: Property addresses, building types, project specifications, financial details, construction timelines, and other information about real estate development projects you submit for incentive matching.
• Payment Information: When you subscribe to paid services, payment information is collected and processed by our payment processor, Stripe. We do not store complete credit card numbers on our servers.
• Communications: Information you provide when contacting our support team, responding to surveys, or participating in promotional activities.

2.2 Information Collected Automatically

When you access or use our Service, we automatically collect:

• Usage Data: Pages visited, features used, search queries, incentive programs viewed, reports generated, and interaction patterns within the platform.
• Device Information: Browser type and version, operating system, device type, screen resolution, and device identifiers.
• Log Data: IP address, access times, referring URLs, and pages viewed before and after using our Service.
• Location Information: Approximate geographic location based on IP address (city/region level, not precise location).
• Cookies and Similar Technologies: As described in Section 11 below.

2.3 Information from Third Parties

We may receive information from other sources, including:

• OAuth Providers: If you choose to sign in using Google, GitHub, or other OAuth providers, we receive basic profile information (name, email) from those services.
• Public Records: We access publicly available information about incentive programs, tax credits, grants, and regulatory requirements from government sources to provide our matching services.
• Business Partners: We may receive information from partners who refer users to our Service or integrate with our platform.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Provide and Improve the Service: To operate our platform, process incentive matching requests, generate reports, and continuously improve our algorithms and user experience.
• Process Transactions: To manage subscriptions, process payments, and maintain billing records.
• Communications: To send transactional emails (account confirmations, password resets), service notifications (new incentive matches, deadline reminders), and marketing communications (with your consent).
• Analytics and Research: To analyze usage patterns, measure performance, identify trends, and conduct research to improve our services.
• Security and Fraud Prevention: To detect, prevent, and respond to security incidents, fraudulent activity, and violations of our terms of service.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, and governmental requests.
• AI Model Improvement: We may use anonymized and aggregated data to train and improve our AI models. Individual project data is not used for model training without explicit consent.

4. How We Share Your Information

We may share your information in the following circumstances:

4.1 Service Providers

We share information with third-party service providers who perform services on our behalf:

• Supabase: Database hosting and authentication services
• Anthropic: AI processing for incentive matching and analysis
• Stripe: Payment processing
• Vercel: Website and application hosting
• Analytics providers: Usage analytics and performance monitoring

These providers are contractually obligated to protect your information and use it only for the services they provide to us.

4.2 With Your Consent

We may share your information with third parties when you explicitly consent or direct us to do so, such as when sharing project data with application assistance partners.

4.3 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., court orders, subpoenas, government investigations).

4.4 Business Transfers

If IncentEdge is involved in a merger, acquisition, asset sale, or bankruptcy, your information may be transferred as part of that transaction. We will provide notice before your information is subject to a different privacy policy.

5. Data Retention

We retain your information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

• Account Data: Retained for the duration of your account plus 30 days after account deletion to allow for account recovery.
• Project Data: User-controlled. You may delete individual projects at any time. Deleted project data is removed within 30 days.
• Usage Analytics: Retained for up to 2 years in anonymized and aggregated form for research and improvement purposes.
• Payment Records: Retained for 7 years as required by financial regulations and tax laws.
• Legal Holds: If we are involved in litigation or government investigation, relevant data may be retained beyond normal retention periods.

6. Your Rights and Choices

6.1 All Users

Regardless of your location, you have the right to:

• Access Your Data: Request a copy of the personal information we hold about you.
• Correct Inaccurate Data: Update or correct information that is inaccurate or incomplete.
• Delete Your Account: Request deletion of your account and associated personal information.
• Export Your Data: Request your data in a portable, machine-readable format.
• Opt Out of Marketing: Unsubscribe from marketing communications at any time using the link in our emails or through account settings.

6.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You may request information about the categories and specific pieces of personal information we have collected, the sources of collection, the purposes of collection, and the categories of third parties with whom we share personal information.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: We do not sell or share your personal information for cross-context behavioral advertising. Therefore, no opt-out is necessary.
• Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information for purposes beyond those permitted under CCPA/CPRA.
• Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise these rights, please contact us at privacy@incentedge.com. We will respond to verifiable consumer requests within 45 days.

6.3 EU/UK Residents (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, you have rights under the General Data Protection Regulation (GDPR):

• Legal Basis for Processing: We process your personal data based on: (a) your consent, (b) performance of a contract with you, (c) our legitimate business interests, or (d) compliance with legal obligations.
• Right of Access: Request access to your personal data.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your personal data ("right to be forgotten").
• Right to Data Portability: Receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: Object to processing based on legitimate interests or for direct marketing purposes.
• Right to Restrict Processing: Request restriction of processing in certain circumstances.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time.
• Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority in your country of residence.

To exercise these rights, please contact our Data Protection Officer at legal@incentedge.com.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction:

• Encryption in Transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher.
• Encryption at Rest: Personal information stored in our databases is encrypted using AES-256 encryption.
• Access Controls: We implement strict role-based access controls, ensuring only authorized personnel can access personal data, and only to the extent necessary for their job functions.
• Infrastructure Security: Our infrastructure is hosted on SOC 2 Type II certified platforms with continuous monitoring.
• Regular Security Assessments: We conduct periodic security assessments, vulnerability scans, and penetration testing.
• Incident Response: We maintain incident response procedures to promptly address any security breaches and notify affected users as required by law.

While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

8. International Data Transfers

IncentEdge is based in the United States. If you access our Service from outside the United States, your information will be transferred to, stored, and processed in the United States where our servers are located.

For users in the EEA, UK, or other jurisdictions with data protection laws, we rely on the following mechanisms to ensure adequate protection of your personal data:

• Standard Contractual Clauses (SCCs): We use EU-approved Standard Contractual Clauses with our service providers and data processors.
• Data Processing Agreements: We maintain data processing agreements with all third-party processors that include appropriate safeguards.
• Privacy Shield Successor Mechanisms: We monitor and implement applicable data transfer frameworks as they become available.

9. Children's Privacy

Our Service is designed for business professionals and is not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18.

If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly. If you believe we may have collected information from a child under 18, please contact us at privacy@incentedge.com.

10. Third-Party Links

Our Service may contain links to third-party websites, including government incentive program portals, regulatory agencies, and partner organizations. We are not responsible for the privacy practices or content of these third-party sites.

When you click on a link to a third-party website, you are leaving our Service, and any information you provide to those sites will be governed by their privacy policies. We encourage you to review the privacy policies of any third-party sites you visit.

11. Cookies and Tracking

We use cookies and similar tracking technologies to collect and track information about your use of our Service.

Types of Cookies We Use

• Essential Cookies: Required for the Service to function properly. These cookies enable core functionality such as authentication, session management, and security features. You cannot opt out of these cookies.
• Analytics Cookies: Help us understand how users interact with our Service by collecting information about pages visited, features used, and performance metrics. This data is used to improve our Service.
• Preference Cookies: Remember your settings and preferences (such as language or display preferences) to provide a personalized experience.

Managing Cookies

Most web browsers allow you to control cookies through their settings. You can typically:

• View and delete cookies stored on your device
• Block all cookies or only third-party cookies
• Configure cookie preferences per website

Note that blocking certain cookies may impact the functionality of our Service. For more information about cookies and how to manage them, visit www.allaboutcookies.org.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons.

When we make material changes, we will:

• Update the "Last Updated" date at the top of this policy
• Notify you by email (for registered users) if the changes are significant
• Display a prominent notice on our Service

Your continued use of the Service after any changes to this Privacy Policy constitutes your acceptance of such changes. We encourage you to review this Privacy Policy periodically.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

For CCPA requests, please include "CCPA Request" in the subject line. For GDPR requests, please include "GDPR Request" in the subject line. We will respond to your request within the timeframes required by applicable law.