Privacy Policy

1. Who this policy covers

This policy explains how Hazard Terrain handles information about people who visit our public pages, hold a Hazard Terrain account, submit a request through Contact Us or the product inquiry form, or respond to a public survey or comment period published through the platform.

Customers decide why their planning information, survey responses and comments are collected, who on their team can see them, and how long they keep them as public records. For that information, Hazard Terrain processes data on the customer’s behalf to deliver the service. Each public survey names the sponsoring organization. You can send privacy questions about a survey to that organization, or contact us and we will help direct your request.

2. Information we collect

Account information

Name, work email address, organization, role, assigned jurisdictions, account status, and the date and version of the terms you accepted.

Customer workspace information

Plans and plan sections, uploaded documents and images, mitigation actions, hazard profiles, capability assessments, infrastructure and community details, and map or geographic data that customers enter or import. Jurisdiction boundaries and hazard map data describe places. They are not a record of your device’s precise location, and Hazard Terrain does not request browser GPS or precise device location.

Public survey and comment information

Your answers and comments, and any name, email address or phone number you choose to give. Contact details are optional. If you provide them, your response is not anonymous to the sponsoring organization.

Contact and inquiry requests

The name, work email, organization, state or territory, topic and message you submit. The product inquiry form on the sign-in page can also collect job title, phone number, jurisdiction and product interests.

Security and access records

Sign-in events, failed sign-in attempts, access errors, IP address, browser and device information (user agent), and the time of each event. We use these to protect accounts and investigate problems.

Optional analytics

Only if you accept optional analytics, we record the pages you visit while signed in and approximate city, region and country looked up from your IP address. See our Cookie Policy for how to turn this on or off.

3. How we use information

• Provide, maintain and support the platform and the features you use.
• Authenticate users and enforce each customer’s roles and permissions.
• Send service notifications, such as invitations, review requests and task updates.
• Respond to inquiries, support, privacy and security requests.
• Detect, investigate and prevent misuse, fraud and security incidents.
• Understand platform usage and improve reliability, where you have allowed optional analytics.
• Meet legal obligations and enforce our agreements.

4. How information is shared

Within your organization. Customer information is visible to authorized users, client administrators and jurisdiction users as the customer’s permission settings allow. Authorized Hazard Terrain personnel may access information to provide support, maintain the service or protect its security.

Service providers. We use providers that process information to run the service:

• Database, authentication and file storage (Supabase): account, workspace, survey, inquiry and log records.
• Application hosting and delivery: requests to our website, including IP address and technical request data.
• Mapbox: map display. Your browser requests map tiles and resources directly from Mapbox, which receives your IP address and technical request data.
• Resend: delivery of service emails, which includes the recipient’s email address and message content.
• AI gateway and model providers: text and context you choose to submit to AI drafting features (see AI-assisted drafting).
• ipapi.co: IP address lookup for approximate city, region and country, used only when optional analytics consent permits it.

Public data sources. Some features request public datasets, for example from the U.S. Census Bureau, FEMA and state agencies. Those requests contain the geographic or dataset query, not your account profile. Third-party services are governed by their own privacy policies.

Information customers publish. When a customer publishes a plan, opens a public comment period or shares results, the content they choose to publish becomes available to the intended audience.

Legal and business reasons. We may disclose information when required by law or legal process, to protect the security or integrity of the service, to protect rights and safety, to establish or defend legal claims, or as part of a merger, acquisition or transfer of the business, in each case as permitted by applicable law.

5. AI-assisted drafting

When you choose an AI drafting or research feature, we send the prompt and the planning context needed for that request. This can include jurisdiction names, hazard information and existing section text. Some features can also run web searches. AI output is a draft: review it before you use it. Avoid entering sensitive personal information into AI features. AI gateway and model providers handle submitted content under their applicable terms and agreements. Using AI features does not change the customer’s rights in its data.

6. Public surveys and comments

Public survey and comment links are opened by the sponsoring organization, which receives the responses and decides how to use and keep them. Responses can be subject to public records laws. Your optional contact details are not shown on public pages, but we cannot promise absolute confidentiality. Do not include information you would not want the sponsoring organization to have.

7. Retention

We keep information for as long as needed to provide the service, follow customer instructions and contracts, meet legal and record-keeping obligations, resolve disputes and protect security. Customer planning records can be official government records. Closing an account does not automatically delete them, and they are handled under the customer’s agreement and applicable records requirements. Security records and backups may be kept on separate schedules that the law allows. When we handle a privacy request, we keep a minimal record of the request and how we verified and answered it.

8. Security

We use reasonable administrative and technical safeguards, including role-based access controls and account authentication, to protect information. No system can be completely secure, and we cannot guarantee security. Please do not submit passwords, Social Security numbers, financial account numbers, health information or other sensitive regulated information through contact forms, surveys or comments.

9. Children

Hazard Terrain is not intended for children under 13, and we do not knowingly ask them for personal information. If you believe a child has given us personal information, please contact us so we can remove it.

10. Your privacy choices and rights

Depending on where you live and the laws that apply, you may have the right to access, correct, delete or get a copy of your personal information, and to opt out of certain processing. To make a request, use our Contact Us page and choose the topic “Privacy or data request.” You do not need an account.

• We may ask for information to verify your identity, in proportion to the request.
• If the information belongs to a customer, for example a survey response or a plan record, we may refer the request to that organization or help them answer it.
• Some information may be kept where the law requires or permits it, such as public records, security records or legal claims.
• If we decline your request, you can appeal by using Contact Us with the topic “Privacy appeal.”
• We will not discriminate against you for making a lawful privacy request.
• You can turn optional analytics on or off at any time in Cookie Settings, available in the page footer and on our Cookie Policy. The choice is saved in your browser.

11. Texas residents

Where the Texas Data Privacy and Security Act applies to a request, we will respond within 45 days of receiving it. We may extend that by another 45 days when reasonably necessary; if we do, we will tell you about the extension and the reason for it within the first 45 days. If we decline to act, we will explain why. You may appeal through Contact Us using the topic “Privacy appeal,” and we will respond to an appeal within 60 days with a written explanation of our decision and the reasons for it. If your appeal is denied, you may contact the Texas Attorney General at texasattorneygeneral.gov — Consumer Privacy Rights.

12. Changes to this policy

We may update this policy. The date at the top shows when it last changed. If we make material changes, we will give notice in the platform or by other reasonable means before the changes take effect.

13. Contact

For privacy questions or requests, use our Contact Us page.