Privacy Policy

1. Who We Are

ParcelScore is a product of Coverso CC SL, a company registered in Spain (CIF: B19725985). Our registered office is located in Spain.

ParcelScore provides property risk intelligence reports for the United States market, currently covering 28 states with over 143 million property records. All invoicing is conducted in US Dollars (USD).

For privacy-related inquiries, contact us at: privacy@parcelscore.io

2. Data We Collect

2.1 Account & Subscription Data

• Email address and name (when you create an API account)
• Phone number (when you interact via WhatsApp, iMessage, or create an account)
• API keys issued to your account
• Payment information processed through Stripe (we do not store card numbers)
• Billing address and invoicing details
• Account credentials (PIN, stored securely)

2.2 Usage Data

• Addresses searched and reports generated
• API request logs (endpoint, timestamp, response status)
• Browser type, IP address, and general location data
• Feature usage patterns on the website
• Credits balance and usage history

2.3 Messaging Data (WhatsApp, iMessage & Web Chat)

• Phone numbers used to interact with our messaging services, for subscriber management and report delivery
• WhatsApp or iMessage profile names (as provided by the messaging platform)
• Address queries and other messages sent via our messaging channels
• Conversation history, including your messages and our AI assistant's responses, retained for up to 90 days to provide contextual follow-up support and improve service quality
• Media files you send (e.g. property photos for analysis), processed and stored temporarily

2.4 AI Processing

ParcelScore uses artificial intelligence (Anthropic Claude) to understand your queries, generate property risk reports, and provide conversational support. Your messages are sent to Anthropic's API for processing. Anthropic does not use your data to train its models. For details, see Anthropic's Privacy Policy.

3. Data We Do NOT Collect

4. How We Use Your Data & Legal Basis

Under GDPR Article 6, we process your personal data on the following lawful bases:

• Contract performance (Art. 6(1)(b)): To generate and deliver property risk reports, manage your subscription, process payments, and authenticate API requests
• Legitimate interest (Art. 6(1)(f)): To retain conversation history for up to 90 days to provide contextual follow-up support; to improve our service, data accuracy, and user experience; to detect and prevent abuse, fraud, or unauthorized access
• Legal obligation (Art. 6(1)(c)): To retain payment and invoicing records as required by Spanish tax law
• Consent (Art. 6(1)(a)): For optional analytics cookies (PostHog), which you may decline at any time

You may object to processing based on legitimate interest at any time by contacting privacy@parcelscore.io.

5. Third-Party Services

We use the following third-party services to operate ParcelScore:

6. US Property Data from Public Sources

The property data in our reports is sourced from publicly available United States government databases. This includes, but is not limited to:

• FEMA National Flood Hazard Layer (NFHL)
• USGS 3D Elevation Program (3DEP)
• EPA Envirofacts / Toxics Release Inventory (TRI)
• Florida Department of Revenue (FDOR) parcel data
• FDLE Uniform Crime Reports
• Florida Department of Education school grades
• OpenFEMA National Flood Insurance Program claims
• HIFLD fire station locations
• County property appraisers and building departments

This data is public record under US law. We aggregate, normalize, and score this data but do not alter the underlying records. For details on each source, see our Data Sources & Processing page.

7. Cookies & Tracking

ParcelScore uses minimal cookies strictly for session management and authentication. We do not use advertising cookies, social media tracking pixels, or cross-site tracking technologies.

We use PostHog for basic product analytics (page views, feature usage). PostHog is configured to respect Do Not Track headers and does not use third-party cookies.

8. Data Retention

• Conversation messages: Retained for 90 days from creation, then automatically deleted. This includes your messages and our AI assistant's responses across WhatsApp, iMessage, and web chat
• Generated reports: Stored indefinitely for subscriber access and historical comparison. Reports contain addresses and risk data but no personal information beyond the requesting subscriber's ID
• Usage logs: Retained for 90 days, then automatically deleted
• API request logs: Retained for 90 days for debugging and rate-limit enforcement
• Account data: Retained for the duration of your subscription, plus 30 days after cancellation. Upon account deletion, all associated conversation messages and team member data are permanently removed
• Payment records: Retained as required by Spanish tax law (minimum 5 years)
• Media files: Property photos and documents submitted for analysis are retained for 30 days, then deleted

9. International Data Transfers

As a Spanish company serving the US market, data is processed in multiple jurisdictions:

• EU (Frankfurt): Primary database (Supabase), account data, subscription data, analytics (PostHog)
• United States: Application hosting (Vercel), AI processing (Anthropic), government data source APIs, WhatsApp delivery (Twilio), iMessage delivery (Sendblue), error monitoring (Sentry)

Transfers between EU and US are conducted in accordance with applicable data protection frameworks, including Standard Contractual Clauses (SCCs) where required. We maintain Data Processing Agreements (DPAs) with all sub-processors in accordance with GDPR Article 28.

10. Your Rights (GDPR)

As Coverso CC SL is registered in Spain, the EU General Data Protection Regulation (GDPR) applies. Regardless of your location, you have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your personal data (“right to be forgotten”)
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Restrict Processing: Request limitation of data processing
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Where processing is based on consent, withdraw it at any time

To exercise any of these rights, email privacy@parcelscore.io. We will respond within 30 days. You also have the right to lodge a complaint with the Spanish Data Protection Authority (AEPD).

11. Children's Privacy

ParcelScore is not directed at children under 13 years of age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected data from a child, please contact us at privacy@parcelscore.io and we will promptly delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to registered users and posted on this page. Your continued use of ParcelScore after such changes constitutes acceptance of the updated policy.