Privacy Policy

Information We Collect

We collect information you provide when using our service:

• Facility owner name, business name, address, phone, and email
• Facility address and its precise geolocation (GPS coordinates)
• Tank and container inventory data
• Photos of tanks and containment structures
• Payment information (processed by Stripe; we never see your card number)

Precise geolocation (the facility GPS coordinates) is a category of sensitive personal information under California law (CCPA/CPRA). We collect and use it only for the purposes reasonably necessary to provide the service, namely to generate your SPCC plan and to run location-dependent compliance calculations such as NOAA design-storm rainfall lookups. We do not use it to infer characteristics about you, and we do not use or disclose it for any other purpose.

How We Use Your Information

We use collected information solely to:

• Generate your SPCC plan PDF
• Deliver your plan by email
• Send 5-year review reminders (if subscribed)
• Respond to support requests

We do not sell, rent, or share your information with third parties for marketing purposes.

We Do Not Sell Your Personal Information

We do not sell your personal information, and we have not sold personal information in the preceding 12 months. We do not share your personal information for cross-context behavioral advertising.

Data Retention

• Completed plans, generated PDFs, the facility information used to build them, and uploaded photos: Retained for 6 years from creation, then automatically deleted. This covers the 5-year SPCC review cycle under 40 CFR 112.5(b) plus a buffer, so you keep access for EPA inspections.
• Incomplete drafts: Automatically deleted 90 days after the last edit.
• Deletion on request: You may ask us to delete your data at any time; we remove your drafts, plans, PDFs, facility information, and photos within 30 days, except records we are required to retain (for example, payment records held by Stripe).

Data Security

Your data is stored on Supabase servers with encryption at rest (AES-256) and TLS encryption in transit. Generated plan PDFs are kept in a private storage bucket and are served only through short-lived signed links, not public URLs. Uploaded photos are stored in access-controlled cloud storage and are being moved to the same signed-link access. Payment data is handled by Stripe and never stored on our servers.

Breach notification: if we become aware of a security breach that affects your personal information, we will notify you and any applicable authorities without undue delay and as required by applicable law.

Your Rights

You have the following rights over the personal information we hold about you:

• Access: request a copy of the personal information we hold about you.
• Correction: ask us to correct information that is inaccurate or incomplete.
• Deletion: ask us to delete your data, subject to records we are required to retain.
• Opt out of sale or sharing: direct us not to sell or share your personal information. We do not sell or share personal information, so no action is required, but you may still exercise this right.
• Limit use of sensitive personal information: direct us to limit our use of sensitive personal information, such as precise geolocation, to what is reasonably necessary to provide the service.

To exercise any of these rights, email us at contact@athanorworks.com from the address on your account. We will verify your request and respond within the time required by applicable law. We will not discriminate against you for exercising these rights. California residents have additional rights under the CCPA.

Third-Party Services

• Stripe: Payment processing
• Supabase: Database and file storage
• Resend: Email delivery
• Vercel: Application hosting
• Anthropic: AI text generation for plan narratives

We use Anthropic as a third-party AI subprocessor to generate and review the narrative sections of your plan. To do this, plan content, which may include facility information you provide such as facility and contact names and location, is sent to Anthropic for processing. We send only what is needed to produce your plan. Data sent to Anthropic is processed under Anthropic's commercial API terms and is not used to train its models.

Contact

Privacy questions or data requests: contact@athanorworks.com