HailScan — Privacy Policy

Effective date: October 26, 2026

HailScan is a service operated by William Addis, an individual and sole proprietor. It is not a corporation or limited liability company. In this document, "we" and "us" mean William Addis. This policy explains what hailscan.app and the HailScan app collect and how it is used.

1. What we collect

Account sign-up: email address, password (handled by our authentication provider; we do not store it in plain text), name and organization name (optional).
Access requests: name, email, company, plan interest, states of interest and your message.
Report orders: name, email, phone (optional), role, property address, date of loss, whether you want a video, and notes.
Addresses and locations you search or monitor: property addresses and dates you look up, scan, monitor or generate reports for, and the coordinates we derive from them.
Field photos and documents: photos, videos and files you upload, and the time and GPS location stored in the photo or sent by your device. We read location and time from the photo's embedded data only to fill in fields your device did not supply. We also create thumbnails and previews.
CRM data: contacts, property owners, addresses, jobs, notes and other details you or your team enter.
Billing: plan, subscription status and Stripe customer references. Card details go directly to Stripe; we never see your full card number.
Technical data: your IP address, which our servers use for rate limiting and abuse prevention, and standard server request information.
Data stored in your browser: your signed-in session, a flag recording that you finished onboarding, your last-viewed screen, and cached results. These are stored in your browser's local storage. Cloudflare Web Analytics counts page visits; Cloudflare states it does not use cookies to track visitors.

2. How we use it

We use this information to:

provide and secure the Service;
create accounts;
generate reports, videos and alerts;
geocode addresses;
process payments;
send alerts and service emails and, if you turn them on, text messages;
respond to requests;
prevent abuse.

We do not sell or share your personal information (as those terms are defined under California law), and we do not use it for cross-context behavioral advertising. We do not use facial recognition or create scans of face geometry or other biometric identifiers from photos.

3. Who we share it with

We share information only with service providers that help run the Service:

Supabase: database, authentication and file storage.
Stripe: payments and billing.
Resend: email delivery.
Twilio: SMS alerts, when SMS is enabled.
Cloudflare: network delivery and traffic protection; all traffic passes through Cloudflare.
Our hosting provider: the servers that run the Service.
Address lookup: U.S. Census Bureau Geocoder and OpenStreetMap Nominatim. Addresses you enter are sent to them to find coordinates. To check which state a map point is in, its coordinates may be sent to the U.S. Census Bureau or the FCC Area API.
Map tiles: the in-app street map loads tiles from OpenStreetMap (tile.openstreetmap.org, run by the OpenStreetMap Foundation). Your browser contacts it when it shows the map.
Map imagery: Esri/ArcGIS imagery, and some report scripts, are loaded from unpkg. Your browser may contact these services when it displays a report.
Amazon CloudFront: hosts the video shown in the app.
Others, only when required: we may also disclose information if the law requires it, to protect rights and safety, or as part of a transfer of the business.

4. Information about other people

If you upload information about customers or property owners, you are responsible for having the right to do so. We process that information on your behalf to provide the Service.

5. Retention

We keep account and CRM data while your account is active. After an account is closed, you have 14 days to export it, after which it may be deleted. Billing records are kept as long as required for accounting and legal purposes. Report-order and access-request records are kept until they are no longer needed to fulfil or follow up on the request.

6. Security

We use reasonable measures to protect information, including encrypted (HTTPS) connections. No method of transmission or storage is completely secure.

7. Your choices and rights

You can access and update account details in the app, cancel your subscription, turn off alerts, and ask us to delete your account or a copy of your data by emailing [email protected]. Depending on where you live, you may have additional rights; we will respond as the law requires.

8. Children

The Service is for people 18 and older. We do not knowingly collect data from children under 13. If you believe a child under 13 has given us personal information, contact [email protected] and we will delete it.

9. Do Not Track

We do not respond to Do Not Track signals.

10. Changes

If we change this policy we will update the effective date above.

11. Contact

[email protected]