LEGAL

Privacy policy

Last updated November 5, 2026

OldPermits ("we") sells a postcard service to HVAC, plumbing and roofing contractors. This policy explains what we collect, why, and who helps us run the service. Questions: hello@oldpermits.com.

Contractor accounts

When you sign up and use the contractor app, we hold:

• your account email address;
• the business details you enter: business name, phone, license number, website, business mailing address, logo, offer text, trade and chosen ZIP codes;
• your postcard approvals, mailing history and the QR scan counts for your cards;
• a Stripe customer ID for your subscription.

We use this only to run your account: to design, approve and mail your postcards, to show your scan report, and to contact you about the service.

Sign in with Google

If you choose "Continue with Google", we request only the basic openid, email and profile scopes. We use the verified email address Google returns to find your existing OldPermits account. We do not store your Google name, photo or any Google access token, we do not access other Google data such as Gmail, Drive or Contacts, and we never create an account from a Google sign-in. Our use of information from Google follows the Google API Services User Data Policy, including its Limited Use requirements.

Sign-in security records

For security we keep a sign-in log: the time, the sign-in method, the result, the IP address, and a one-way hash (not the readable address) of the email that was used. Sessions use cookies that are only set on the contractor and admin apps and are needed to keep you signed in. The marketing site sets no tracking cookies.

Public permit records and homeowners

We choose which homes receive a contractor's postcard using public city building-permit records: the property address, the permit type and the permit date. Postcards are addressed to "Current Resident". We do not collect homeowner names, phone numbers or emails. A permit date reflects only what the public record shows, not the age or condition of any equipment.

When someone scans a postcard's QR code, we record the time, a broad device type (such as mobile or desktop) and the city and ZIP of the mailed home, so the contractor can see a scan count. We do not store the scanner's IP address with the scan.

If you live at an address that received our mail and want it to stop, email hello@oldpermits.com with the address and we will stop sending OldPermits postcards there.

Service providers

• Stripe processes subscription payments. Card details go directly to Stripe; we never see or store card numbers.
• Lob prints and mails postcards. Lob receives the mailing address and the postcard design.
• Resend sends sign-in links and account emails.
• Cloudflare hosts the site, the apps and our database.
• Google provides the optional sign-in described above.

We do not sell personal information, and we do not share it except with these providers to run the service, or when required by law.

Retention and your choices

We keep contractor account data while your account is open and for as long as needed for billing, tax and legal records afterwards. You can ask us to see, correct or delete your account data by emailing hello@oldpermits.com. California residents have these rights under the CCPA, and we will not treat you differently for using them.

Changes

If we change this policy, we will update the date above and, for material changes, tell contractor customers by email.

Contact

OldPermits, 785 Oak Grove Rd, Ste E2 #1264, Concord, CA 94518 · hello@oldpermits.com