Privacy Policy

Last Updated: April 18, 2026

Version: 2026-04-18-v3

Quick Summary

• What we are. A construction intelligence platform that aggregates public records (permits, projects, bids, appraisal data) and publicly accessible business information for the Texas market.
• Personal information we collect from you. Account info, profile info, payment info (via Stripe), inquiries, alert preferences, and Property Tax Analysis Tool inputs.
• Public/business information we display. Permits, project filings, licensing, contractor and developer directories, appraisal records, procurement notices, and related government and publicly available data.
• We don’t sell your personal information. See your CCPA and Texas TDPSA rights below.
• Removals. Government public records generally cannot be removed; non-government information may be reviewed on request — see Section 7.
• Contact. privacy@zabalist.com

1. Scope and Definitions

This Privacy Policy applies to information collected through the Services. It does not apply to third-party websites, services, or sources that we link to or aggregate from. “Personal information” means information that identifies, relates to, or could reasonably be linked with you, as defined under applicable law (including the California Consumer Privacy Act, as amended (“CCPA/CPRA”) and the Texas Data Privacy and Security Act (“TDPSA”)). Capitalized terms not defined here have the meanings given in our Terms of Service.

2. Information We Collect

2.1 Information You Provide Directly

• Account Information: email address, name, company, job title, phone number, city, industry role, and password (or magic-link authentication identifier).
• Profile and Claim Information: business name, description, logos, photos, certifications, license numbers, service areas, hours, and other listing details when you claim or manage a business profile.
• Payment Information: billing address and a reference to your payment method. Payments are processed by Stripe. We do not store full credit card numbers; Stripe stores them under PCI-DSS controls.
• Saved Searches and Alerts: filters, geographies, trades, and frequency preferences for daily or weekly email alerts.
• Lead and Inquiry Submissions: contact information, project details, and messages you send via business profile contact forms or other inquiry forms.
• Team and Referral Information: names and email addresses you supply when inviting teammates or referring colleagues.
• Property Tax Analysis Tool Inputs: email (required), name, optional phone, the property address (and any TCAD Geo ID inferred from it), and any optional notes you supply.
• Communications: messages, support inquiries, feedback, removal/correction requests, and related content.

2.2 Property Tax Analysis Tool Data

When you use the Property Tax Analysis Tool, in addition to the inputs above, we collect and store:

• Property Information returned from public sources: property address, TCAD Geo ID, owner name, assessed value, comparable property addresses and values, and other appraisal-district fields.
• Analysis Output: comparable selections, valuation estimates, adjustment calculations, and recommendations generated by our analysis algorithms.
• Report Activity: whether the report PDF was generated, viewed, or downloaded, and at what time.
• Technical Data: IP address, user agent, and timestamp of the analysis request.

Purpose: to deliver your analysis report, prevent abuse, improve our analysis algorithms, provide support, and (with your consent and opt-out controls) send you communications about property-tax matters and the Services.

2.3 Information Collected Automatically

• Device and Browser Data: IP address, browser type and version, operating system, device identifiers, referrer URL, language, and screen size.
• Usage Data: pages viewed, searches performed, filters used, click events, time on page, navigation paths, exports generated, and feature interactions.
• Approximate Location: general geographic location inferred from IP address. We do not collect precise GPS location.
• Cookies and Similar Technologies: see Section 8 and our Cookie Policy.
• Email Engagement: opens, clicks, delivery status, and bounces for emails we send (via Resend), used for deliverability, analytics, and engagement-based segmentation.
• Bot-Mitigation Signals: we use Cloudflare Turnstile and similar tools, which receive and process certain network and device signals to distinguish humans from automated traffic.
• Embed/Widget Telemetry: when our widgets are embedded on third-party sites, we collect the host page URL, referring domain, widget interactions, and the same automatic device data described above for the visitor of the embedding site.

2.4 Information from Third Parties and Public Sources

We aggregate and display information from a variety of third-party and publicly accessible sources, including:

• Government and Public Records: Texas Department of Licensing and Regulation (TDLR), Texas Comptroller, Texas Electronic State Business Daily (ESBD), City of Austin, Travis County, Williamson County, Hays County, and other Texas municipal and state agencies.
• Appraisal District Records: Travis Central Appraisal District (TCAD), Williamson Central Appraisal District (WCAD), Hays Central Appraisal District (HCAD), and similar appraisal districts; county GIS systems; and parcel/ownership records.
• Federal Databases: SAM.gov, Small Business Administration (SBA) certifications, IRS public information, and federal contracting/grant systems.
• Federal Reserve Economic Data (FRED): macroeconomic and regional economic series provided by the Federal Reserve Bank of St. Louis.
• Google Places: business names, addresses, phone numbers, and related business attributes returned by Google’s Places API; cached and refreshed periodically.
• Trade Associations and Industry Directories: Home Builders Association (HBA), Texas Association of Builders (TAB), Associated Builders and Contractors (ABC), and similar publicly accessible industry directories.
• Analytics Providers: Google Analytics, Mixpanel, and Ahrefs (for SEO analytics).
• Payment Processor: Stripe, for transaction status and risk signals.
• Other Third-Party Data Providers: licensed business databases and information aggregators.

3. How We Use Information

We use information we collect to:

• Provide, operate, maintain, secure, and improve the Services;
• Aggregate, normalize, classify, deduplicate, and present public-record and publicly accessible information;
• Generate Property Tax Analysis reports and similar derived products;
• Process subscriptions, manage billing, and prevent fraud;
• Authenticate users, manage accounts, and verify business profile claims;
• Send transactional and service-related emails (account verification, magic links, billing receipts, alert digests, claim approvals, security notices);
• Send product, marketing, and promotional communications subject to your consent and opt-out preferences;
• Personalize your experience, content recommendations, and saved-search results;
• Analyze usage to optimize performance and improve features;
• Train, evaluate, and tune our internal AI-assisted entity-matching, classification, and content-generation models on aggregated and de-identified data and on data we are otherwise authorized to use; we do not sell your personal information to third parties for use in their AI training;
• Detect, prevent, investigate, and address security incidents, abuse, fraud, and violations of our Terms;
• Enforce our Terms and any applicable agreements; and
• Comply with legal obligations and respond to lawful requests.

4. Legal Bases (where applicable)

Where required by law, we rely on the following legal bases for processing personal information: (a) performance of a contract with you (e.g., providing the Services you requested); (b) legitimate interests (e.g., maintaining and securing the Services, preventing fraud, marketing our own services, aggregating publicly accessible information); (c) consent (e.g., marketing emails, certain cookies); and (d) compliance with legal obligations.

5. How We Share Information

5.1 Service Providers

We share information with third-party service providers that perform functions on our behalf, including:

• Stripe — payment processing and fraud prevention
• Supabase — primary database, authentication, and storage
• Vercel — application hosting, edge runtime, and deployment
• Cloudflare — CDN, DDoS protection, and Turnstile bot mitigation
• Resend — transactional and marketing email delivery
• Cloudinary — image and asset storage and transformation
• Google Analytics, Mixpanel — product and traffic analytics
• Google (Places API) — business data lookups
• Federal Reserve Bank of St. Louis (FRED) — economic data
• Ahrefs — SEO analytics

These providers are contractually required to protect your information and to use it only for the services they provide to us.

5.2 Publicly Displayed Profile Information

If you claim a business profile, the information you provide for the listing (such as business name, description, contact information, photos, and service areas) will be publicly displayed on the Services as part of that profile.

5.3 Lead Recipients

If you submit a lead or inquiry through a business profile or RFP form, your contact information and message will be transmitted to the recipient business and may be retained by us for quality, deliverability, and abuse-monitoring purposes.

5.4 Embedded Widgets

When you interact with a Zabalist widget embedded on a third-party site, both we and the embedding site may receive information about that interaction. The embedding site’s own privacy policy applies to its collection of your information independent of ours.

5.5 Legal Requirements and Safety

We may disclose information if we believe in good faith that disclosure is required by law, legal process, or governmental request, or is necessary to protect our rights, property, safety, or the safety of users or the public, or to investigate suspected violations of our Terms.

5.6 Business Transfers

In connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred to the acquiring entity or successor, subject to commitments consistent with this Privacy Policy.

5.7 With Your Consent

We may share information with third parties when you direct us to or otherwise expressly consent.

5.8 No Sale of Personal Information

We do not sell personal information for monetary consideration. Some uses of cookies and analytics may be considered “sharing” or “targeted advertising” under certain laws (e.g., CCPA/CPRA, TDPSA). You may opt out of such activity as described in Section 11.

6. Publicly Available Business and Property Data

6.1 Nature of the Data We Display

Much of the content on the Services consists of information aggregated from government public records, federal and state databases, third-party business APIs (such as Google Places), trade association directories, and other publicly accessible sources. This information includes business names, addresses, phone numbers, license and certification status, project filings, permit history, ownership and appraisal records, and similar data.

Our role is to aggregate, organize, normalize, classify, and present information that is already publicly accessible — similar in function to a search engine indexing publicly available web content or a directory compiling business listings.

6.2 Aggregation Methodology and Accuracy

We use automated and manual processes — including AI-assisted entity resolution and classification — to aggregate, deduplicate, and enrich data. We apply data-quality processes but do not independently verify all third-party information, and AI-assisted output may contain errors. Information accuracy depends on the accuracy of source data; corrections to government data must generally be made at the originating agency.

For a complete explanation of the legal authorities (TPIA, TDPSA “publicly available information” exception, First Amendment, copyright) under which we publish public-record information, see our Legal Basis & Data Sources page.

7. Removal, Correction, and Profile Control

• Claim Your Profile. The most direct way to control how a business is represented is to claim its profile, which lets you add, edit, and enhance the listing.
• Correction at the Source. If information sourced from a government agency is inaccurate, the correction generally must be made at the originating agency; once the upstream source is updated, we will reflect the correction on our next refresh.
• Removal Requests for Non-Government Sources. We will consider in good faith requests to remove information drawn from non-governmental publicly accessible sources. Submit requests via our contact removal page or to privacy@zabalist.com.
• Public-Record Limits. Information derived from official government records (permits, licenses, registrations, appraisal records, procurement notices) generally cannot be removed because it serves the public interest in government transparency.

8. Cookies and Tracking Technologies

We use cookies, pixels, and similar technologies for authentication, security, preferences, analytics, and (in some cases) marketing. Cookie categories and your choices are described in our Cookie Policy. You can manage cookies through your browser, our cookie banner, or, where supported, opt-out signals such as Global Privacy Control (GPC).

9. Data Security

We implement reasonable technical, administrative, and physical safeguards designed to protect information, including encryption in transit (TLS) and at rest, scoped access controls, audit logging, secure authentication, bot mitigation (Cloudflare Turnstile), and standard hosting-provider isolation. No security measures are perfect, and we cannot guarantee absolute security. Report suspected vulnerabilities to security@zabalist.com.

10. Data Retention

We retain information for as long as necessary to provide the Services, comply with legal obligations, resolve disputes, and enforce agreements. Indicative retention periods:

• Account Information: for the life of your account and for a reasonable period thereafter for legal and business records;
• Property Tax Analysis Reports and Inputs: up to seven (7) years for analytical reference, model improvement, and to respond to user inquiries about prior reports;
• Lead and Inquiry Records: for the duration of the recipient business’s account and for a reasonable retention window thereafter for abuse monitoring;
• Aggregated/De-identified Usage Data: indefinitely;
• Public-Record Aggregations: indefinitely, subject to refresh cycles and removal-request review under Section 7.

11. Your Privacy Rights

11.1 General Choices

• Access and Update: view and update account information through your account settings.
• Marketing Opt-Out: click “unsubscribe” in any marketing email or update notification preferences. Transactional and service-related emails (e.g., billing, security, account, ordered reports) are part of the Services and may not be disabled while you maintain an active account.
• Cookies: manage via your browser, our cookie banner, or GPC where supported.
• Account Deletion: request deletion at privacy@zabalist.com; deletion is subject to legal retention obligations and the public-record limits noted above.

11.2 California Residents (CCPA/CPRA)

California residents have the right to:

• Know what personal information we have collected, used, disclosed, and (if applicable) shared;
• Request deletion of personal information, subject to exceptions;
• Request correction of inaccurate personal information;
• Opt out of “sale” or “sharing” of personal information for cross-context behavioral advertising. We do not sell personal information. To the extent any cookie-based analytics are deemed “sharing,” you may opt out via our cookie banner or GPC;
• Limit use of sensitive personal information (we do not use sensitive personal information for inferring characteristics);
• Non-discrimination for exercising your rights.

See our CCPA Notice for details, including how to submit a verifiable consumer request.

11.3 Texas Residents (TDPSA)

Under the Texas Data Privacy and Security Act, Texas residents have the right to:

• Confirm whether we process your personal data and access that data;
• Correct inaccuracies in your personal data;
• Delete personal data we have collected from you, subject to legal exceptions;
• Obtain a copy of your personal data in a portable format where technically feasible;
• Opt out of (i) targeted advertising, (ii) the sale of personal data, and (iii) certain profiling that produces legal or similarly significant effects.

To exercise TDPSA rights, contact privacy@zabalist.com. You may appeal a denied request by replying to our response with “TDPSA Appeal” in the subject line.

11.4 Other U.S. State Residents

Residents of other states with applicable comprehensive privacy laws may have similar rights. We honor verified requests to the extent required by applicable law.

11.5 Authorized Agents

You may use an authorized agent to submit a request, subject to our verification of authority.

12. Children’s Privacy

The Services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If you believe a child has provided personal information to us, contact privacy@zabalist.com and we will take reasonable steps to delete it.

13. International Users

The Services are operated in the United States and intended for users in the United States, with a focus on the Texas market. If you access the Services from outside the United States, your information will be transferred to, stored, and processed in the United States, where data-protection laws may differ from those in your country.

14. Do Not Track and Global Privacy Control

We do not currently respond to Do Not Track (DNT) browser signals. Where required by applicable law, we honor Global Privacy Control (GPC) signals as an opt-out of “sale” or “sharing” of personal information.

15. Third-Party Links and Integrations

The Services contain links to third-party websites and may integrate with third-party services. This Privacy Policy does not apply to those third parties, and we are not responsible for their content or practices. Review their policies before providing information.

16. AI-Assisted Processing

We use machine learning and AI for entity resolution, deduplication, classification, address normalization, and content summarization. AI-assisted output may be incorrect or incomplete. We do not use your account information to train third-party generative AI models, and we do not sell personal information to third parties for AI training. See our Terms of Service for related disclaimers.

17. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to your account address or by prominent in-product notice. The “Last Updated” date at the top reflects the latest revision. Continued use of the Services after the effective date constitutes acceptance of the updated policy.

18. Contact Us

For questions about this Privacy Policy or to exercise your privacy rights, contact: