This Privacy Policy explains how Cividian ("Cividian," "we," "us," or "our") collects, uses, shares, and protects information when you visit our website, create an account, or use the Cividian platform (the "Service"). By using the Service, you agree to the practices described here.
Brokerage applications and professional license profiles are stored with your existing Cividian organization. Draft listings and publication submissions are visible to authorized organization members and the verified platform owner; approved, current listings display brokerage names, legal names, license jurisdictions and numbers, listing agent names and license details, office contact information, property facts, and supplied photographs publicly. Listing and photo changes return inventory to draft. Suspension, withdrawal, expiration, or loss of an approved listing-agent membership removes public visibility.
Property photographs are resized, JPEG metadata is stripped, and production photographs are stored in the operator-configured S3-compatible media service. Private photographs require organization access or platform review access. An inquiry shares your name, verified account email, optional phone number, and message with the listing brokerage only after explicit inquiry consent. Saved properties and saved searches remain with your account. Public page opens are aggregate activity counts, not unique visitor profiles. These records are not submitted for AI training by this feature.
Commercial organization records remain until the organization is deleted or the operator handles an authorized removal request. The brokerage inbox displays up to 500 recent inquiry records; review and search windows are bounded as described in the feature documentation. Account erasure removes a sole-owner brokerage's listings and associated media and inquiry records. An owner with other members must transfer ownership before deleting an account. Shared records may remain with the organization; an erased agent's assigned listings are withdrawn and the cached agent attribution is removed. Third-party copies and downloads follow their recipients' policies. Read the Commercial Listing Agreement for submission and contact-use terms.
Cividian is operated by Owen Crabbe, doing business as Cividian, based in the State of Indiana, which is responsible for the personal information described in this policy.
Cividian operates a city intelligence platform that aggregates property, demographic, economic, and public-investment data to help real estate developers, businesses, and public officials evaluate American cities. Cividian is based in the State of Indiana, United States. The Service is intended for business and professional users located in the United States. It is not directed to, and we do not knowingly offer it to, individuals in the European Union or European Economic Area. For any privacy question, contact us at contact@cividian.com.
When you create an account, request full access, or contact us, we collect the information you submit, which may include your name, email address, phone number, company or organization, your stated role (for example developer, business, or public official), and the contents of messages you send us, including questions you ask the in-platform assistant.
If you join through joincividian.com and verify your phone, that Cividian signup service sends your name, email, stated role, city of interest, verified phone, age confirmation and separate verification and marketing SMS consent evidence to our account service at app.cividian.com. We keep the account record and enrollment receipt in our account stores. Phone verification does not verify your email or sign you in; you still verify your inbox through Cividian's sign-in flow. The signup service's privacy notice also describes its Google Sheets lead register.
If you request a Cividian walkthrough, we keep your name, work email, role, optional company and question, your permission to be contacted about that request, and registered campaign labels. The verified operator uses these details to arrange and track a response. Please do not include confidential property documents or sensitive details in the form. This request does not create an account or enroll you in marketing email.
If you publish a member concept, the concept text, its studio render, and the first name on your account are visible to other signed-in members, along with community activity on it (ratings, reviews, download and remix counts). That sharing happens only at your direction and is reversible at any time from where you published it. Reviews and ratings you leave on other members' concepts are shown with your first name.
Beta marketplace features collect what you enter to run them: listings you post (property address, terms, description, and an optional photo, which become visible to other users when you publish them; your email address is never shown on a listing, and buyer and seller contact is routed through the platform), saved search criteria and trade-area watches (used server-side to match new listings and send the notifications you chose, at the frequency you chose), and your onboarding answers (your selected role and tour progress, used to arrange your default view). If you create a listing API token, we store it to authenticate pushes from your systems; treat it like a password and rotate it in the app if it leaks.
If you use the in-app CRM board, we store what you enter there on your account record: the cities you are tracking and their pipeline stage, the contacts you record for each city (name, role, organization, and the contact details you choose to enter) with their outreach status and your notes on them, the parcels you flag with their acquisition status, and your ledger entries. This CRM store is your private workspace. It is not shared with other members, it is not published, and it is not used to score or enrich anything Cividian sells. Section 8 states its retention.
In cities that have enrolled to receive them, you can file a civic report: a problem you saw, such as a pothole, a dark streetlight, or a blocked storefront. A report holds the category you chose, your description, the location (coordinates and, if you add it, a street address or landmark), the time you saw the problem, and the web address of one photo if you attach one. Reports are public. Anyone can read a city's reports and their status history, and the enrolled city's staff can read and export them. What is never published is who filed a report: we collect no name, email address, or phone number with a report, and the link between a report and your account is stored only as a salted one-way hash. City staff exports carry that hash and nothing else about you. Reports are what a person said they saw; they are labelled as user content wherever they appear and they are never used to score a city. For native uploads, your device creates a resized JPEG and removes source metadata. The server strips JPEG metadata again and stores the photo in the operator-configured object store. The report holds an unguessable public photo address. Remove personal detail visible in the image before attaching it: metadata removal does not blur faces or text.
This table lists each category of personal information the Service holds today, why it is collected, where it lives, how long it is kept, and which providers receive it. It describes the features in this release; features requiring an operator-configured service share data only after that service is enabled. Where a provider is marked "if enabled", the sharing happens only when the operator has configured that provider.
| What | Why | Where it is stored | Retention | Who receives it |
|---|---|---|---|---|
| Name, email address, phone number, organization, stated role, city of interest, SMS consent and email preference | Create and operate your account; contact you as Section 4 describes | Your account record and the signup list in our data store | Until deleted on request (Section 8) | Resend (sign-in and transactional email); an operator notification webhook, if enabled, which receives a copy of the signup record |
| Walkthrough request: name, work email, role, optional company and question, campaign labels, inquiry stage and response history | Respond to and manage the walkthrough request | A private first-party lead record, separate from account signup | 24 months after the last request, or sooner when the operator deletes it on request. A one-way email hash used for do-not-contact suppression remains until deletion is requested. | The verified operator; Resend receives the confirmation and owner alert when configured. No ad platform receives the question or contact details. |
| IP address and browser user agent at signup | Abuse prevention and attribution | The signup record | Until deleted on request | Cloudflare Turnstile, if enabled, which receives the IP address to verify the signup is not automated; the operator webhook, if enabled |
| Session token | Keep you signed in | An HttpOnly cookie on your device and a session registry in our data store | 30 days, or until you sign out or revoke it from account settings | Nobody |
| API keys you create | Let your own software or an AI agent call the Service as you | Only a one-way hash of the key, with its label, scopes and creation date | Until revoked; the raw key is shown once and never stored | Nobody |
| Saved projects, saved searches, trade-area watches, onboarding answers, view preferences, last city viewed | Run the features you use | Your account record | Until deleted on request | Nobody, except that saved project notes are sent to the assistant provider with your questions when you use the assistant |
| CRM board: the cities, contacts, parcels, contact log and ledger you enter, including other people's names and contact details | Your private pipeline workspace | Your account record | Until deleted on request | Nobody |
| Concepts, listings and reviews you choose to publish | Sharing at your direction | Community and marketplace records | Until you remove them | Other signed-in members, as Section 2 describes |
| Questions you ask the assistant, and saved notes or assumptions sent with them | Answer your question and maintain the current conversation | For a signed-in account, Cividian AI keeps the account-scoped conversation store described below. A guest's questions and answers are not stored by Cividian | Account conversation context expires after one day; the model provider's retention also applies, including to guest questions | The model provider that answers. Cividian AI in the app uses NVIDIA Nemotron models on Nebius Token Factory; other assistants may use Anthropic, OpenAI, Google, or xAI as Section 6 describes |
| Civic reports: category, description, coordinates, optional address, time observed, optional photo address, and a salted hash of your account | Route a problem to the enrolled city and show its status publicly | Report records in our data store | Until removed on request or at the end of the city's pilot; no automatic deletion schedule is implemented | The public, as the report; enrolled city staff, as the report plus the hash |
| Usage events (page and city viewed, feature used, no IP address, no user agent) | Understand which cities and features are valued | An anonymized event list and aggregate counters | Bounded list; counters kept 90 days by day | The operator webhook, if enabled |
| Campaign page actions and registered campaign labels, with no full URL, IP address, user agent, contact details, or property search text | Measure the developer campaign funnel and connect a product action to a campaign visit | A separate first-party event list and a first-party attribution cookie containing only registered campaign labels | Latest 20,000 actions for at most 90 days; attribution cookie expires after 30 minutes | Only the verified operator; no ad platform receives this list |
| Approximate US state and area of the request, from our hosting provider's IP lookup | Suggest nearby starting cities on the homepage | Not stored; used for that one response | None | Vercel |
| Page views | Visitor and device counts | Vercel Web Analytics, cookieless | Vercel's retention | Vercel |
| Unique username and salted password hash | Sign in and prevent duplicate username claims | Credential and username records in the account data store | Until account deletion; single-use verification records expire after 15 minutes | No raw password is stored or sent to analytics. Resend delivers the verification link. |
| Saved preferences and up to 40 city research selections from the last 30 days | Explain and tailor city suggestions | Private account personalization record | Selections are excluded after 30 days; turning personalization off clears recorded selections | Cividian account storage only; no advertising profile |
| Device registration token and opaque account hash | Optional civic status notifications | Account store | 90 days without renewal; removed by account erasure | Apple APNs or Google FCM when enabled; report ID and status only |
| Business name, address, verification method and public responses | Verify a business's relationship to nearby reports | Business and civic records | Claims removed and responses anonymized on account erasure | Operator for verification; public after verification or response publication |
| Erasure confirmation and encrypted work record | Confirm identity and finish deletion reliably | Account store | Section 8 describes code, receipt, failure and deletion-block retention | Resend delivers the code; Apple receives a revocation request for Apple-linked accounts |
| Saved and imported property lists: property addresses, parcel numbers and match notes, and whatever a file you import carries, which can include owner names, mailing addresses, phone numbers and email addresses of other people; saved lead searches (the list, area and window you chose, and for searches outside Indiana a short fingerprint of each matching parcel's owner, last sale and mailing fields plus the changes found since your last alert) | Your private deal workspace, matching rows to parcels, and the saved-search alerts you turn on | Workspace records keyed by a hash of your email | Until you delete the list or search, or your account | Property street addresses (never owner names or contacts) go to the US Census Bureau geocoder and the State of Indiana parcel layer to place and match rows. Nobody else. |
| Parcel searches outside Indiana: the address or drawn area you search, and the parcels, owners of record and tax mailing addresses the state roll returns for it | Show comps and lead lists for that area | Not stored unless you save the list; parcel reads are cached without any account link for up to one day | Cache: one day. Saved lists: until you delete them or your account | The state parcel service receives only the map coordinates of the area |
| Skip tracing (Pro, when switched on): the property address you ask to trace; the names, mailing addresses, phone numbers with Do Not Call and TCPA litigator flags, and email addresses returned for it; your trace balance, monthly cap and charge history; your National Do Not Call Registry Subscription Account Number, or your statement that you will not make marketing calls or texts, recorded with your acceptance of the skip tracing terms. Dates of birth and ages returned by the vendor are discarded. | Provide contact data you purchase for a property | Your private workspace, on the list row you traced, or a lookup history of your latest 200 single lookups | Until you delete the list or your account; bulk job records are cleared of results when the job finishes | Tracerfy receives the property street address, city, state and ZIP code. Results are never shown to any other account or on any public page. |
| Operator actions: actor email, action, time, organization ID and action details such as organization name changes | Review administrative access and changes | Shared operator audit in the account store | Latest 200 events; events authored by an account are removed on account erasure | Verified configured owner through the private operator console |
These internal namespace labels make collection changes reviewable. The data collection map above explains their user-facing purposes.
| Record family | Collection and retention |
|---|---|
civic | Civic records, media references, device registrations, delivery and daily KPI records. Public report retention and account erasure are described in Section 8. |
pago:acct | Private account, credential or shared workspace records; retained and erased as Section 8 describes. |
pago:assistant | The daily Cividian AI allowance is a count of answers for the current UTC day plus the random request identifiers of that day's questions, each marked as held (an answer is being prepared) or delivered (an answer started to reach you). It holds no question or answer text. For an account it is keyed by a one-way hash of the account; for a guest it is keyed by a keyed hash (HMAC) of the network address, so everyone sharing that address shares one guest allowance, a different address starts a new one, and a new guest session does not reset it. These records expire after two days, and the allowance resets at midnight UTC. Raw IP addresses are not saved in this family. Guests get 3 answers a day unless the operator sets a different number, including zero to turn guest answers off. Conversations, for signed-in accounts only, include recent questions and answers, resolved places, a building program, the latest user financial assumptions with supporting quotes, and source rows. They are scoped to the account hash and expire after one day. Guest questions and answers are not saved in any Cividian conversation, history or project store. Saved chats from the app home (your questions and the answer cards exactly as they were shown) are stored separately under the same account hash so you can reopen them from any device; reopening a saved chat sends nothing to a model, and the chats stay until you remove them or delete the account. Each account can keep up to 200 saved chats and each chat up to 60 turns; Cividian never deletes an older chat to make room, and tells you on screen when a limit stops a chat from being saved. Guest sessions have no saved chats. Aggregated repair and figure-removal counters hold no conversation text. Research context is sent to the Nemotron models on Nebius Token Factory to produce an answer, for guests and accounts alike. |
pago:allen | Public source caches, generated geographic readings, aggregate usage or scheduled job counters. Their expiry varies by cache; no password or private account workspace belongs in this family. |
pago:apikey | Private account, credential or shared workspace records; retained and erased as Section 8 describes. |
pago:apikeys | Private account, credential or shared workspace records; retained and erased as Section 8 describes. |
pago:authlimit | Security, confirmation, deletion workflow or operator configuration. Section 8 distinguishes short-lived codes from the opaque deletion block. |
pago:beta | Security, confirmation, deletion workflow or operator configuration. Section 8 distinguishes short-lived codes from the opaque deletion block. |
pago:city | Public source caches, generated geographic readings, aggregate usage or scheduled job counters. Their expiry varies by cache; no password or private account workspace belongs in this family. |
pago:citypage | Public source caches, generated geographic readings, aggregate usage or scheduled job counters. Their expiry varies by cache; no password or private account workspace belongs in this family. |
pago:community | Private account, credential or shared workspace records; retained and erased as Section 8 describes. |
pago:concept | Private account, credential or shared workspace records; retained and erased as Section 8 describes. |
pago:diligence | Site Diligence Agent briefs and their index: the site identity you entered, the evidence records the agent read, your labeled assumptions, deterministic scenario outputs, and any validated model interpretation. In Cividian, site briefs need an account. In the separate standalone Site Diligence edition, guest briefs expire with its 24 hour guest session and cannot be exported. Account briefs are private to the account and are erased with it as Section 8 describes. The same family also holds the agent's global daily spend counters, which contain no personal data. |
pago:concepts | Private account, credential or shared workspace records; retained and erased as Section 8 describes. |
pago:credential | Private account, credential or shared workspace records; retained and erased as Section 8 describes. |
pago:criteria | Private account, credential or shared workspace records; retained and erased as Section 8 describes. |
pago:dec | Private account, credential or shared workspace records; retained and erased as Section 8 describes. |
pago:delete-code | Security, confirmation, deletion workflow or operator configuration. Section 8 distinguishes short-lived codes from the opaque deletion block. |
pago:delete-job | Security, confirmation, deletion workflow or operator configuration. Section 8 distinguishes short-lived codes from the opaque deletion block. |
pago:delete-pending | Security, confirmation, deletion workflow or operator configuration. Section 8 distinguishes short-lived codes from the opaque deletion block. |
pago:plan | Your plan record (plan name, who granted it, when, and any end date) keyed by a hash of your email, and plan requests you send (email, requested plan, optional note). Erased with your account. |
pago:billing | Card billing: the Stripe customer and subscription identifiers for your account, the subscription status, its current period end and whether it is set to cancel, keyed by a hash of your email; plus a 30-day record of each Stripe event identifier we processed (event type only, no personal data). Card numbers are entered on Stripe and never reach Cividian. Erased with your account; Stripe keeps its own records as our payment processor. |
pago:ws | Your saved and imported property lists, saved lead searches, their alert marks, and the list of accounts with alerts turned on (email addresses only). Keyed by a hash of your email and erased with your account. |
pago:skip | Skip tracing: your trace balance, monthly cap and charge history, single-lookup history, bulk job records, and the queue of unfinished jobs (email address and job id). The same family holds service-wide daily vendor credit counters, which contain no personal data. Erased with your account. |
pago:quota | Monthly site-brief counters for the Free plan, keyed by a hash of your email or, for guests, a hash of the network address. Counts only; erased with your account. |
pago:digest | Private account, credential or shared workspace records; retained and erased as Section 8 describes. |
pago:erasure-block | Security, confirmation, deletion workflow or operator configuration. Section 8 distinguishes short-lived codes from the opaque deletion block. |
pago:events | Public source caches, generated geographic readings, aggregate usage or scheduled job counters. Their expiry varies by cache; no password or private account workspace belongs in this family. |
pago:gallery | Private account, credential or shared workspace records; retained and erased as Section 8 describes. |
pago:fmr | Public source caches, generated geographic readings, aggregate usage or scheduled job counters. Their expiry varies by cache; no password or private account workspace belongs in this family. |
pago:geo | Public source caches, generated geographic readings, aggregate usage or scheduled job counters. Their expiry varies by cache; no password or private account workspace belongs in this family. |
pago:geocode | Public source caches, generated geographic readings, aggregate usage or scheduled job counters. Their expiry varies by cache; no password or private account workspace belongs in this family. |
pago:inbox | Private account, credential or shared workspace records; retained and erased as Section 8 describes. |
pago:intelbrief | Public source caches, generated geographic readings, aggregate usage or scheduled job counters. Their expiry varies by cache; no password or private account workspace belongs in this family. |
pago:layer | Public source caches, generated geographic readings, aggregate usage or scheduled job counters. Their expiry varies by cache; no password or private account workspace belongs in this family. |
pago:listing | Private account, credential or shared workspace records; retained and erased as Section 8 describes. |
pago:listings | Private account, credential or shared workspace records; retained and erased as Section 8 describes. |
pago:oauth | Opaque OAuth handshake state, nonce and PKCE verifier; no account identity. Expires after ten minutes and is consumed once. |
pago:magic | Private account, credential or shared workspace records; retained and erased as Section 8 describes. |
pago:marketing | Private walkthrough leads, do-not-contact hashes, and separate aggregate campaign events. Lead records expire 24 months after the last request; suppression hashes remain until deletion; campaign events expire after at most 90 days. |
pago:metrics | Public source caches, generated geographic readings, aggregate usage or scheduled job counters. Their expiry varies by cache; no password or private account workspace belongs in this family. |
pago:news | Public source caches, generated geographic readings, aggregate usage or scheduled job counters. Their expiry varies by cache; no password or private account workspace belongs in this family. |
pago:grade | Public source caches, generated geographic readings, aggregate usage or scheduled job counters. Their expiry varies by cache; no password or private account workspace belongs in this family. |
pago:obs | Public source caches, generated geographic readings, aggregate usage or scheduled job counters. Their expiry varies by cache; no password or private account workspace belongs in this family. |
pago:operator | Shared administrative audit, bounded to the latest 200 events. Account erasure removes that actor's events and their details, preserving other actors' events as Section 8 describes. |
pago:org | Private account, credential or shared workspace records; retained and erased as Section 8 describes. |
pago:orginvite | Private account, credential or shared workspace records; retained and erased as Section 8 describes. |
pago:parcels | Public source caches, generated geographic readings, aggregate usage or scheduled job counters. Their expiry varies by cache; no password or private account workspace belongs in this family. |
pago:personalization | Private account, credential or shared workspace records; retained and erased as Section 8 describes. |
pago:phoneidx | Private account, credential or shared workspace records; retained and erased as Section 8 describes. |
pago:pulse | Public source caches, generated geographic readings, aggregate usage or scheduled job counters. Their expiry varies by cache; no password or private account workspace belongs in this family. |
pago:render | Photoreal render jobs and their images: the massing you queued, the account that queued it, and the resulting picture. Each job and image expires seven days after it is made, and both are erased with the account as Section 8 describes. The queue and the worker heartbeat in this family carry no personal data. |
pago:reports | Public source caches, generated geographic readings, aggregate usage or scheduled job counters. Their expiry varies by cache; no password or private account workspace belongs in this family. |
pago:rl | Security, confirmation, deletion workflow or operator configuration. Section 8 distinguishes short-lived codes from the opaque deletion block. |
pago:sessreg | Private account, credential or shared workspace records; retained and erased as Section 8 describes. |
pago:signups | Private account, credential or shared workspace records; retained and erased as Section 8 describes. |
pago:st | Public source caches, generated geographic readings, aggregate usage or scheduled job counters. Their expiry varies by cache; no password or private account workspace belongs in this family. |
pago:suggest | Public source caches, generated geographic readings, aggregate usage or scheduled job counters. Their expiry varies by cache; no password or private account workspace belongs in this family. |
pago:uk | Public source caches, generated geographic readings, aggregate usage or scheduled job counters. Their expiry varies by cache; no password or private account workspace belongs in this family. |
pago:username | Private account, credential or shared workspace records; retained and erased as Section 8 describes. |
pago:webhook | Private account, credential or shared workspace records; retained and erased as Section 8 describes. |
pago:wizard | Public source caches, generated geographic readings, aggregate usage or scheduled job counters. Their expiry varies by cache; no password or private account workspace belongs in this family. |
user | Private account, credential or shared workspace records; retained and erased as Section 8 describes. |
When you use the Service, we and our providers automatically collect certain technical and usage data, which may include your IP address, device and browser type, pages and cities viewed, search queries entered, referring pages, and the dates and times of your visits. We use this to operate, secure, and improve the Service.
The property, parcel, demographic, and economic information displayed in the Service is sourced from third parties and public records (described in Section 7). This is information about places and properties, not personal information you provide to us.
When you create an account, we send the messages needed to run it, such as sign-in links and codes, security notices, billing receipts, and changes to our terms or this policy. We may also email you occasional product updates and other marketing messages, which you can stop at any time.
You may opt out of marketing emails at any time by using the unsubscribe link in any such email or by emailing us. We may still send you non-marketing messages necessary to operate your account.
Cividian does not currently send text messages. A phone number you give us is used only for the account purposes described in this policy. Before Cividian sends any text message you did not request, we will ask for your separate, express consent where you enter your number, tell you the expected message frequency and that message and data rates may apply, and let you stop at any time by replying STOP. Consent to texts will never be a condition of using the Service.
We use cookies, local storage, and similar technologies to keep you signed in, remember your preferences, understand how the Service is used, and improve performance. Some are necessary for the Service to function; others support analytics. You can control cookies through your browser settings, though disabling some may affect functionality. Where required, we honor recognized opt-out signals such as the Global Privacy Control (GPC).
We do not sell your personal information for money. We share information only as described below:
Property, parcel, demographic, and economic data shown in the Service is compiled from public records and licensed third-party providers, and is subject to their terms. Sources include:
| Provider | Data |
|---|---|
| U.S. Census Bureau (American Community Survey, County Business Patterns, Building Permits Survey) | Population, income, housing, demographic, business establishment, and construction permit estimates (public domain) |
| ReportAll USA | Parcel boundaries, ownership, land use, and assessment data (licensed). Queried first for parcel records. |
| Regrid | Parcel boundaries, ownership, land use, and assessment data (licensed). Queried when ReportAll returns no coverage. |
| State of Indiana (IndianaMap) | Statewide parcel boundaries and parcel identifiers (public record). Publishes no owner or assessed value. |
| STATS Indiana (Indiana Business Research Center for the Department of Local Government Finance) | Indiana sales disclosure records: recorded transfers, prices, parcel numbers, and buyer and seller names as filed (public record). Email addresses and phone numbers in the filings are discarded when the file is read. |
| Statewide parcel services outside Indiana (AK, AR, CT, DC, FL, MA, MD, MN, MS, NC, NE, NH, NY, OH, TX, VT, WI, WV, WY) and county parcel services (Jefferson County AL, Kent County DE, Fulton County GA, East Baton Rouge Parish LA, City of Detroit MI, Oklahoma and Tulsa counties OK) | Parcel id, situs address, land use, assessed value, the last recorded sale where the roll publishes one, and the owner name and tax mailing address the state publishes (public record). Read live for the radius or drawn area a paying user searches; owner names and mailing addresses are shown only inside that user's private workspace. Each state's source, terms and vintage are listed on the coverage page. |
| Tracerfy | Skip tracing contact data sold to Pro accounts, with Do Not Call and litigator flags (licensed) |
| Mapbox | Maps and geocoding |
| OpenStreetMap | Geocoding fallback, and infrastructure features behind the access layer (open data) |
| Federal Communications Commission (Area API) | Resolving a coordinate to its county (public domain) |
| GDELT | Public news signals behind the city pulse read |
| Nebius Token Factory | Cividian AI research and Cividian Build interpretation using NVIDIA Nemotron models |
| Anthropic | Other assistant features when configured |
| Stripe | Card payments for paid plans: your email address, the plan chosen, and the card details you enter on Stripe's checkout and billing portal pages. Cividian stores only Stripe's customer and subscription identifiers and the subscription status. Stripe privacy policy. |
| Vercel Web Analytics | Cookieless page-view and visitor counts (a hashed, daily-rotating visitor identifier; no cross-site tracking). Used only to understand how the Service is used. |
| Ordnance Survey (OS Open UPRN, OS Open USRN, OS Open Linked Identifiers) | Property and street reference numbers and their coordinates, England, Scotland and Wales (Open Government Licence). Contains OS data, Crown copyright and database right 2026. |
| Office for National Statistics (via postcodes.io) | UK postcode centroids and the census and administrative geographies a postcode falls in (Open Government Licence) |
| MHCLG Planning Data Platform (planning.data.gov.uk) | Planning designations published by English local planning authorities: conservation areas, listed building outlines, Article 4 directions, tree preservation zones, brownfield land, flood risk zones, and HM Land Registry title boundaries (Open Government Licence) |
| Historic England | The National Heritage List for England, the Heritage at Risk register, and heritage funding areas (Open Government Licence) |
| HM Land Registry | Price Paid Data and INSPIRE Index Polygons, England and Wales (Open Government Licence). Contains HM Land Registry data, Crown copyright and database right 2026, and Ordnance Survey data under licence number AC0000851063. An INSPIRE polygon carries the fixed caveat the Service renders wherever the geometry appears: Indicative extent only. Legal boundaries can only be established from the title plan. |
| MHCLG, Get energy performance of buildings data | Energy Performance Certificates for England and Wales. This dataset contains personal data. See the UK note below. |
| Food Standards Agency | Food hygiene ratings, used as a signal of active trading at an address (Open Government Licence) |
| Companies House | The public register of UK companies, used to resolve a corporate property owner to its registered office, incorporation date and filing history |
This data is provided for informational purposes and may be inaccurate, incomplete, or out of date. See our Terms of Use for the full data disclaimer and use restrictions.
Parcel records may include the name associated with a property owner of record, drawn from public records. If you are an individual and wish to request suppression or removal of owner information associated with you from the Service, contact us at contact@cividian.com and we will review the request and act as required by applicable law and our data providers' terms.
This reviewable inventory includes optional adapters and source links. Operator-configured webhooks, Redis, PostgreSQL, error monitoring and S3-compatible photo storage use deployment-specific hosts. The operator must name and review any enabled destination before activation; static checks cannot determine these hostnames. Vendor terms pages linked from operator status views (ai.google.dev, openai.com, fal.ai) are documentation links and are never called by the service.
| Service | Endpoints | Use |
|---|---|---|
| Accounts and security | accounts.google.com, oauth2.googleapis.com, www.googleapis.com, appleid.apple.com, challenges.cloudflare.com | OAuth identity, token revocation and optional signup verification. |
| Email and notifications | api.resend.com, api.push.apple.com, api.sandbox.push.apple.com, fcm.googleapis.com | Transactional email or optional notification delivery. |
| Skip tracing | tracerfy.com, www.tracerfy.com, mock.tracerfy.com | Pro accounts only, once switched on: the property street address, city, state and ZIP to trace. mock.tracerfy.com is the vendor's test server; only the operator's own test lookups go there, never a customer's. |
| Assistant and generated media | api.anthropic.com, api.openai.com, generativelanguage.googleapis.com, api.x.ai, integrate.api.nvidia.com, api.tokenfactory.nebius.com, api.tokenfactory.us-central1.nebius.com, api.higgsfield.ai, docs.higgsfield.ai, queue.fal.run, fal.media (and its subdomains, result files only) | Only the provider selected for a request receives its prompt and supplied context. Generated images and videos remain labeled as concepts. Render enhancement sends a rendered concept image and its depth pass with a prompt assembled from the design record, never text a person typed, to the one image provider configured for it. |
| Mapping and geocoding | api.mapbox.com, tigerweb.geo.census.gov, nominatim.openstreetmap.org (throttled fallback only), overpass-api.de, overpass.private.coffee, overpass.kumi.systems, www.openstreetmap.org, services2.arcgis.com (USA Structures building footprints), gis-fema.hub.arcgis.com, maps.mail.ru, services-eu1.arcgis.com, gisdata.in.gov, gis.acimap.us, app.regrid.com, reportallusa.com, geo.fcc.gov | Location queries, map features and licensed parcel records; Aerial imagery comes from basemap.nationalmap.gov (USGS, public domain); street basemaps come from basemaps.cartocdn.com (CARTO, OpenStreetMap data). |
| US public signals | api.census.gov, data.census.gov, www.census.gov, www2.census.gov, www.huduser.gov (HUD USPS vacancy counts and Fair Market Rents), www.stats.indiana.edu (Indiana sales disclosure files, downloaded at deploy time), geocoding.geo.census.gov, api.gdeltproject.org, aca-prod.accela.com, bsd.sos.in.gov | Geographic queries and public records, without account credentials. |
| Zoning ordinance discovery | api.tavily.com, library.municode.com, codelibrary.amlegal.com, ecode360.com, codepublishing.com, in.gov and verified city or county government domains, including delawarecounty.in.gov and storage.googleapis.com (Delaware County's published ordinance files) | When a signed-in or permitted guest asks for a zoning read, the jurisdiction name and a zoning query go to Tavily, which searches only official code hosts. No personal information is sent. A PDF ordinance is fetched once from its official host so its bytes can be hashed. |
| UK public sources | api.company-information.service.gov.uk, api.get-energy-performance-data.communities.gov.uk, get-energy-performance-data.communities.gov.uk, api.postcodes.io, api.ratings.food.gov.uk, historicengland.org.uk, landregistry.data.gov.uk, use-land-property-data.service.gov.uk, www.planning.data.gov.uk | Geographic and property queries described above. |
| State parcel rolls | enterprise.gisdata.mn.gov, feature.geographic.texas.gov, gis.arkansas.gov, gis.kentcountyde.gov, gis.mississippi.edu, gis.ne.gov, gisservices.its.ny.gov, jccgis.jccal.org, map11.incog.org, maps.brla.gov, maps2.dcgis.dc.gov, mdgeodata.md.gov, services.nconemap.gov, services.wvgis.wvu.edu, services1.arcgis.com, services2.arcgis.com, services3.arcgis.com, services8.arcgis.com, services9.arcgis.com, geo.fcc.gov | Map-box parcel queries to statewide and county parcel services for an area a paying user searches outside Indiana, for matching an imported row, or for re-checking a saved search, and the FCC Area API to find the state and county at a point. Only coordinates and field names are sent; nothing identifies the user. |
| State parcel source references | api.tnris.org, app.leg.wa.gov, arcgis.water.nv.gov, archive.legmt.gov, atlas.geoportalmaps.com, bz1uwwpkuinzbk94.svcs5.arcgis.com, comptroller.tn.gov, countydataharvest.in.gov, dat.maryland.gov, data.ct.gov, data.ny.gov, data.wprdc.org, datacatalog.cookcountyil.gov, enterprise.firstmap.delaware.gov, eoc.iowa.gov, experience.arcgis.com, floridarevenue.com, geo.sandag.org, geodata.ct.gov, geodata.hawaii.gov, geodata.iowa.gov, geographic.texas.gov, geoportal2.watech.wa.gov, gis.cobbcounty.gov, gis.colorado.gov, gis.crookcountyor.gov, gis.lojic.org, gis.mcassessor.maricopa.gov, gis.mo.gov, gis.nola.gov, gis.ny.gov, gis.rcgov.org, gisccapps.charlestoncounty.org, gisdata.fultoncountyga.gov, gisdata.in.gov, gisdata.mn.gov, isv.kcsgis.com, it.nc.gov, law.lis.virginia.gov, legislature.idaho.gov, map.sussexcountyde.gov, maps.clarkcountynv.gov, maps.las-cruces.org, mapwv.gov, maris.mississippi.edu, nhgeodata.unh.edu, ohioparcels-geohio.hub.arcgis.com, ok-county-gis-hub-ok-co.hub.arcgis.com, okmaps.org, opendata.maryland.gov, orkahub.kansasgis.org, pdsmaps.bernco.gov, phl.carto.com, portal.ct.gov, public.gis.lacounty.gov, revenue.ky.gov, risegis.ri.gov, services.arcgis.com, services.kansasgis.org, services7.arcgis.com, smpesri.scdot.org, statecodesfiles.justia.com, tiles.arcgis.com, utility.arcgis.com, vcgi.vermont.gov, vginmaps.vdem.virginia.gov, webserver.rilegislature.gov, wvgis.wvu.edu, www.arcgis.com, www.azleg.gov, www.ctas.tennessee.edu, www.gcgis.org, www.indianamap.org, www.leg.state.nv.us, www.mass.gov, www.michigan.gov, www.msdis.missouri.edu, www.ncleg.gov, www.nconemap.gov, www.nj.gov, www.revenue.alabama.gov, www.revenue.state.mn.us, www.revenue.wi.gov, www.rigis.org, www.sco.wisc.edu, www.scstatehouse.gov, www.stats.indiana.edu, www.tax.ny.gov | Links to each state's parcel program, license and public records statute shown on the coverage page. The Service does not send data to these hosts. |
| Source references and first-party links | telemarketing.donotcall.gov, api.github.com, github.com, schema.org, cividian.com, www.indianamap.org, cv.iptc.org (the IPTC digital source type vocabulary named in render metadata) | Source metadata, documentation or first-party URLs. A literal reference is not evidence that personal information is sent there. |
Cividian's United Kingdom coverage is England only. Scotland, Wales and Northern Ireland use separate land registers, energy certificate registers and planning systems that the Service does not read, and it says so rather than returning an empty English result for an address in those countries.
Energy Performance Certificate records obtained from the MHCLG Get energy performance of buildings data service contain personal data relating to identifiable properties and, through them, to identifiable people. In processing that data Cividian acts as a data controller under the UK General Data Protection Regulation and the Data Protection Act 2018. Our lawful basis is legitimate interests under Article 6(1)(f): providing property and regeneration professionals with accurate building information that is already published on a public register, which we consider proportionate because the data is public, is used only to describe buildings rather than to profile individuals, and is not used for marketing. Address-level certificate data is available only to signed-in accounts and is withheld from anonymous visitors by the server, not hidden in the browser.
We do not display the home address of any company officer or person with significant control. The Service does not read the Companies House officer or persons-with-significant-control endpoints at all, and the registered office records it does read are reduced to a locality, region, postcode and country before they are stored.
Cividian derives an "absentee owner" signal only for corporate owners, from a registered office on a public register, and never for a named individual. It never states that a person is an absentee landlord, that a property is vacant, or that a VAT relief applies. Those outputs are presented as signals, confidence bands and evidence requirements, with the basis shown.
If you are in the United Kingdom you have rights of access, rectification, erasure, restriction, objection and portability in respect of personal data we hold about you, and a right to object to processing carried out on the basis of legitimate interests. Contact us at contact@cividian.com. You also have the right to lodge a complaint with the Information Commissioner's Office at ico.org.uk.
Deletion is on request. Open Account security, sign in again if requested, and request an email confirmation code. Confirming the code disables account access immediately and queues erasure after a two-minute grace period for active requests. Keep the receipt until the page confirms completion. If an external service or a concurrent write prevents completion, the receipt reports that erasure needs a retry; it does not claim success. You may also contact contact@cividian.com in Section 14.
No inactivity-based account deletion schedule is implemented. Account details, the private CRM store (including contacts, parcels you flag and ledger entries), preferences, saved workspace data and credentials remain until deletion is requested. Erasure scans account-linked records in both account stores, removes credentials and uploaded report photos, and removes the account's relational records. Shared organization records retain other members' work; an owner must transfer ownership before deletion if other members remain. Apple-linked accounts must have a revocable Apple token, which may require signing in with Apple again.
Walkthrough requests are separate from account records. Their private lead records expire 24 months after the last request. The operator can export or delete a lead record for a privacy request; deleting it also removes its do-not-contact hash. Until then, an opt-out hash prevents later walkthrough confirmations and alerts for that address.
The shared operator audit keeps at most 200 recent administrative events. Account erasure removes events authored by the deleted account, including their action details, and redacts known account identifiers from remaining events. Other actors' events remain. Concurrent audit writes cause erasure to retry instead of overwriting those events.
Civic reports remain public with a deletion tombstone. The reporter link and attached photo link are removed. Known account identifiers in that account's report text are redacted. Account deletion cannot identify every piece of personal information typed into free text. To request removal of a report or additional text, contact us with its report ID. Public source records, aggregate counters, previously downloaded copies, provider logs and records retained under a legal obligation are outside automated account erasure.
Sign-in links and enrollment records expire after 15 minutes; deletion codes after 10 minutes. Completed erasure receipts expire after one day. An opaque, one-way hash remains to prevent deleted credentials from regaining access. Failed erasure jobs retain an encrypted identity anchor until erasure is completed by retry or support. Personalization uses at most 40 city selections from the last 30 days; older selections are excluded, and switching it off clears them. Device registrations become ineligible for delivery after 90 days without renewal and are pruned when used or updated. Your device keeps its offline report queue until you remove the app; account erasure does not reach device files. Hosting and third-party providers apply their own retention settings.
We use reasonable administrative, technical, and physical safeguards designed to protect your information. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.
Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, and to opt out of certain processing. To exercise any right, email us at contact@cividian.com. We will verify your request and respond as required by applicable law. We will not discriminate against you for exercising these rights.
Residents of states with comprehensive consumer privacy laws, including California, Colorado, Connecticut, Indiana, Oregon, Texas, and Virginia, can use the same process to exercise the rights their state law provides. We respond within 45 days, and we will tell you if we need up to 45 more.
If we decline to act on your request, we will explain why. You may appeal by replying to our decision with the subject “Privacy appeal” within 45 days. We will answer the appeal in writing within 60 days and explain the result. If we deny your appeal, you may contact the attorney general of your state.
If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), gives you the right to know what personal information we collect and how we use and share it, to request deletion or correction, and to opt out of the "sale" or "sharing" of personal information for cross-context behavioral advertising. We do not sell personal information for money. We have collected the categories of information described in Section 2 (identifiers, commercial information, and internet activity) for the purposes described in Section 3. To exercise your rights, contact us using the details in Section 14. You may use an authorized agent to submit a request on your behalf.
The Service is intended for business and professional use by adults and is not directed to children. We do not knowingly collect personal information from anyone under 18, and you must be at least 18 to use the Service. If you believe a minor has provided us information, contact us and we will delete it.
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above, and material changes may be communicated through the Service. Your continued use after an update means you accept the revised policy.
The native app lets you research city and housing fundamentals without creating an account. City searches, city-centre coordinates and basic request information reach Cividian and our hosting provider to retrieve readings and protect the service. Rate-limit records include the requesting IP address and expire with their short rate-limit window; hosting and operational logs are subject to the provider retention settings. City observations are stored as public geographic readings, without an app account.
Apple Maps supplies maps and place search. If you choose “Find my city,” the app requests location only while in use and asks Apple to resolve the city. Cividian receives the resolved city and its centre, not a background location trail. You may deny location and search by name instead. When filing a civic report, the exact pin or searched street address you select is sent to Cividian and published with the report; that report location is distinct from a city-centre research request. Apple processes its services under its own privacy policy.
Up to 12 recent places are stored on your device. Clear them in Settings → Clear recent places. City readings are fetched on demand and are not saved for offline use. Reports awaiting submission and their prepared photos are saved in a protected file on your device and retried when connected. An API credential you add is held in Keychain. Notification permission is requested after a report is confirmed; if you consent, Cividian stores your APNs token against an opaque account hash and sends only a report ID and status through Apple. This app version includes no purchases, advertising SDK, cross-app tracking or generative AI requests. The optional connected-parcel client is disabled in the App Store configuration; if enabled in a future version, its data use and permissions will be disclosed before distribution.
For native-app support or privacy requests, email contact@cividian.com. Include the app version and a description of the problem, and do not send passwords or API keys.
For privacy questions, requests, or notices, contact Cividian at contact@cividian.com.
Back to top