Privacy Policy

Effective date: January 1, 2026 · Assemblage Intelligence

1. Overview

Assemblage Intelligence ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, and your rights with respect to that information. By using Assemblage, you agree to the practices described here.

Reports produced by Assemblage are AI-generated interpretations of public data. They are not verified fact and not professional advice.

2. Information We Collect

We collect the following:

Account email address — when you sign in, your email address is stored in our authentication system so we can identify your account and send you sign-in links.
Property searches — each time a report is generated we record the property address you entered, the resolved lot identifier and borough, the persona or goal you selected, your priority selections, and the resulting score.
Saved reports — when you save a report, its full contents are stored against your account, together with the address, persona, and unit you searched.
Payment references — if you purchase, payment is processed by Stripe. We do not receive or store card numbers. We store a Stripe customer reference, subscription and price references, your plan tier and status, remaining report credits, and billing-period dates.
Waitlist and coverage submissions — the email address and area you supply on the homepage waitlist form, and the email, area, and address you supply when asking to be notified about a location outside our current coverage.
Network address — your IP address is used to enforce fair-use limits and to detect automated abuse. We store it only as a salted SHA-256 hash; the raw address is not written to our database.

3. How We Use Your Information

Information collected through the waitlist is used to:

Send you a single notification when Assemblage launches coverage in the area you specified.
Make internal decisions about geographic expansion priorities.

We will not use your waitlist email address for marketing campaigns, newsletters, product announcements, or any purpose other than the coverage notification you signed up for.

Other information described in section 2 is used to operate the Service, enforce fair-use limits and abuse protection, process purchases and maintain your entitlements, send sign-in emails, and respond to support and privacy requests.

4. Data Processors and Data Sources

We share data with the following processors, each of which receives only what is listed:

Supabase — authentication and database hosting. Receives and stores your account email address and the stored data described in section 2.
Stripe — payment processing. Receives your payment details and billing information directly; we receive only references to them.
Vercel — application and serverless hosting. Processes every request to the Service, including your network address and the contents of the request.
Resend — delivers our transactional email. Receives the recipient email address and the message.
Cloudflare — the Turnstile automated-abuse check on report generation. Receives a challenge token and your network address.
Google — address autocomplete receives the address text you type; the Street View imagery service receives the coordinates of the property shown in your report.
Mapbox — map display and geocoding. Receives the property address and its coordinates.
Anthropic — generates the report narrative. Receives the property record and your selections. The record it receives contains no owner, buyer, or seller name: buyer and seller names are not collected, and the recorded owner name is removed before transmission. Anthropic's data handling is governed by their Privacy Policy.
Formspree — processes the homepage waitlist form. Receives the email address and area you submit, in accordance with their Privacy Policy.

Data sources we query. To build your report we also query the public records services and property-data sources below. Unlike the processors listed above, they do not act as processors on our behalf; we send each only the minimum needed to retrieve the data, as listed:

NYC Planning Labs GeoSearch — address resolution. Receives the address text you enter.
NYC Open Data (Socrata) — public property and records datasets. Receives the borough, block, and lot, the building identification number (BIN), and the street number and name used to look up deed records.
FEMA — flood-hazard data. Receives the map coordinates of the property.
ATTOM — a commercial property-data provider. Receives the property address.

5. No Sale of Data

We do not sell, rent, trade, or otherwise transfer your personal information to third parties for commercial purposes. Your data is not used for advertising, profiling, or any monetisation beyond the direct provision of the Assemblage service.

6. Data Retention

Saved reports and search records are retained indefinitely unless you request their deletion. Cached report artifacts, which are keyed to a property and a set of selections rather than to any user, expire after 30 days. The device cookie described in section 8 expires after 30 days. Account, entitlement, and credit records are retained while your account exists. Waitlist and coverage submissions are retained until you request deletion or until Assemblage has fulfilled the purpose for which they were collected (i.e., notified you of coverage in your area).

7. Your Rights

You have the right to request access to, correction of, or deletion of any personal data we hold about you, including the data described in section 2. To exercise these rights, contact us at yorgos@scarpidis.com. Requests are made by email and handled individually. We will respond within 30 days.

8. Cookies and Tracking

When you generate reports without an account, we set a signed, HttpOnly cookie (assemblage_u) that records how many free reports have been generated from your device and when the first one was generated. It expires after 30 days. When you sign in, your authentication session is stored in your browser's local storage so that you stay signed in between visits.

We do not use tracking pixels, advertising cookies, or third-party analytics scripts.

9. Children's Privacy

The Service is not directed at children under 13 years of age. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with a revised effective date. Continued use of the Service after changes are posted constitutes acceptance of the updated policy.

11. Contact

For privacy-related inquiries: yorgos@scarpidis.com

← Back to Assemblage