Last updated: July 2, 2026 · Version 2026-07-02
RegWatch (“we,” “us”) provides property-intelligence services across NY/NJ/CT and federal coverage. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, your rights under U.S. state privacy laws and the GDPR (where applicable), and how we secure and retain your data.
The CCPA / CPRA defines twelve categories of personal information. We collect:
We do not collect Sensitive Personal Information as defined by CPRA §1798.140(ae): no SSNs, financial account numbers, biometrics, precise geolocation, racial/ethnic origin, religion, union membership, genetic data, health data, or contents of private communications. The CPRA “Limit Sensitive PI” right does not apply.
We use personal information to:
We share personal information with the following service providers (a.k.a. sub-processors), each bound by a data-processing agreement:
A current sub-processors list is also available at [email protected] on request.
Account deletion immediately removes account data, chat history, search logs, saved buildings, monitors, and email preferences from our database. Some derivative records (admin audit logs, payment metadata) are retained per regulatory requirements.
If you are a California resident you have the right to:
Submit requests to [email protected]. We respond within 45 days (extendable +45 with notice).
The following states grant residents privacy rights similar to CCPA: Colorado (CPA), Connecticut (CTDPA), Virginia (VCDPA), Texas (TDPSA), Utah (UCPA), Oregon (OCPA), Montana (MCDPA), Iowa (ICPA), Delaware (DPDPA), Indiana (ICPA-IN), Tennessee (TIPA), New Jersey (NJDPA, effective Jan 2025), New Hampshire (Effective 2025), Minnesota, Maryland. We honor access, deletion, correction, and (where granted) opt-out of targeted advertising / sale / profiling rights for residents of these states. Submit the same way as CCPA requests — to [email protected].
We do not sell personal information for monetary consideration. We do not share personal information for cross-context behavioral advertising. We do not run ad networks or third-party retargeting pixels.
A small subset of activity falls under broad readings of “sale” or “sharing” under state privacy laws — most notably, when a customer purchases a property report that includes a public-record owner-of-record name (about a person we have no direct relationship with). We honor opt-outs at /privacy/do-not-sell for this category.
We honor the Sec-GPC: 1 request header as a valid opt-out of sale/sharing under CCPA, CPA, CTDPA, and other state laws that mandate GPC honor. When GPC is detected we set a gpc=1 cookie and (for signed-in users) flag your account immediately.
The Service is operated from the United States. If you access it from the European Economic Area, the United Kingdom, or Switzerland, your personal information will be transferred to the U.S. We rely on Standard Contractual Clauses (where applicable) and the UK addendum for transfers to and from non-adequate jurisdictions. EU/UK residents have rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent — submit to [email protected]. We do not have an EU representative under GDPR Art. 27; if our offering materially expands into the EU we will appoint one. Lodge complaints with your supervisory authority if you cannot resolve issues with us.
The Service is not directed to children under 13 and we do not knowingly collect personal information from anyone under 13. If we learn that we have done so, we will delete the data and terminate the account. Contact [email protected] if you believe a child has registered.
We use the following cookie / similar-technology categories:
regwatch-session, iron-session encrypted), CSRF token, visitor-ID cookie (rw_vid), GPC opt-out flag._ga / _ga_*), set by the gtag.js script loaded from googletagmanager.com. Both measure product usage only. If your browser sends the Global Privacy Control signal, the Google Analytics script is not loaded at all; PostHog is our first-party product analytics and can be blocked or cleared through your browser’s cookie controls.googletagmanager.com (measurement only). We do not use it for ad targeting, and we do not run ad networks, retargeting pixels, or third-party ad cookies.Browser controls (block third-party cookies, clear cookies) work as expected. Logout removes the session cookie. Account deletion removes the visitor-ID mapping in our database.
Our AI chat sends your typed message and the property brief (data assembled from public records and your saved properties) to a third-party LLM inference provider. Google’s Gemini API is the primary provider; Groq is the automatic fallback when Gemini is unavailable, and also powers our nearby-search and analyst features. Prompts are processed via Google’s Gemini API and Groq under their respective API data-use terms and are not used to train their models. Before transmission we apply a regex-based PII redaction layer that scrubs phones, emails, SSNs, EINs, international phone formats, and Luhn-validated credit-card sequences; the same filter runs on output before we show responses. Both providers pass through the identical filter pipeline.
Both providers may retain prompts briefly for abuse review under their default API terms. Chat messages are stored in our database for 90 days then purged. You can delete your account to immediately purge all chat history.
For New York residents, we maintain reasonable administrative, technical, and physical safeguards as required by NY Gen Bus L §899-bb. These include: bcrypt-hashed passwords, encrypted-in-transit and (where applicable) encrypted-at-rest data, SHA-256 pseudonymization of search-log IPs, role-based access controls, audit logging of admin actions, dependency vulnerability monitoring, and an incident response plan.
If we discover an unauthorized acquisition of personal information that triggers state notification laws (NY SHIELD §899-aa, CA Civil Code §1798.82, GDPR Art. 33-34, etc.), we will notify affected users without unreasonable delay and in any case within the applicable statutory deadline. Notifications go to your registered email address and (where required) include the categories of information affected, the date range of exposure, and remediation steps.
Covered persons under New Jersey’s Daniel’s Law (judges, prosecutors, law enforcement, and analogous roles per N.J.S.A. 56:8-166.1) may submit a removal request at /privacy/removal-request. We action verified requests within 10 business days. We honor analogous requests from NY/CT covered persons under the same SLA where state law permits.
General public-record removal requests. If you are not a covered person, we generally cannot delete property facts sourced from public government records — republishing lawfully-obtained public records is protected, there is no U.S. “right to be forgotten” for them, and removing a record here would not remove it from the source agency. We do fix factual errors (submit a data correction) and review documented safety concerns case by case at [email protected]. See the removal page for the full triage.
Delete your account at any time from your account settings or by emailing [email protected]. Account deletion cascades across user-scoped tables — chat history, saved buildings, monitors, search log, email preferences, favorites, purchased reports — within seconds. Some records (payment metadata, admin audit logs) are retained per the schedule in §5.
Privacy team: [email protected]. Mailing address: 173-48 47th Ave Flushing NY 11358.
We may revise this Privacy Policy. Material changes will be (a) posted with a new “Last updated” date and version number, and (b) emailed to your registered address at least 30 days before taking effect. Continued use after the effective date constitutes acceptance. Version-controlled — current: 2026-07-02. Prior versions available on request.
This Privacy Policy is effective as of July 2, 2026 (version 2026-07-02).