Last updated: May 2026 · Version 2026-05-08
RegWatch (“we,” “us”) provides property-intelligence services across NY/NJ/CT and federal coverage. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, your rights under U.S. state privacy laws and the GDPR (where applicable), and how we secure and retain your data.
The CCPA / CPRA defines twelve categories of personal information. We collect:
We do not collect Sensitive Personal Information as defined by CPRA §1798.140(ae): no SSNs, financial account numbers, biometrics, precise geolocation, racial/ethnic origin, religion, union membership, genetic data, health data, or contents of private communications. The CPRA “Limit Sensitive PI” right does not apply.
We use personal information to:
We share personal information with the following service providers (a.k.a. sub-processors), each bound by a data-processing agreement:
api.groq.com at request time. We apply a PII-redaction filter before sending and again on output. Groq’s default policy retains prompts briefly for abuse review and does not train on customer prompts.A current sub-processors list is also available at [email protected] on request.
Account deletion immediately removes account data, chat history, search logs, saved buildings, monitors, and email preferences from our database. Some derivative records (admin audit logs, payment metadata) are retained per regulatory requirements.
If you are a California resident you have the right to:
Submit requests to [email protected]. We respond within 45 days (extendable +45 with notice).
The following states grant residents privacy rights similar to CCPA: Colorado (CPA), Connecticut (CTDPA), Virginia (VCDPA), Texas (TDPSA), Utah (UCPA), Oregon (OCPA), Montana (MCDPA), Iowa (ICPA), Delaware (DPDPA), Indiana (ICPA-IN), Tennessee (TIPA), New Jersey (NJDPA, effective Jan 2025), New Hampshire (Effective 2025), Minnesota, Maryland. We honor access, deletion, correction, and (where granted) opt-out of targeted advertising / sale / profiling rights for residents of these states. Submit the same way as CCPA requests — to [email protected].
We do not sell personal information for monetary consideration. We do not share personal information for cross-context behavioral advertising. We do not run ad networks or third-party retargeting pixels.
A small subset of activity falls under broad readings of “sale” or “sharing” under state privacy laws — most notably, when a customer purchases a property report that includes a public-record owner-of-record name (about a person we have no direct relationship with). We honor opt-outs at /privacy/do-not-sell for this category.
We honor the Sec-GPC: 1 request header as a valid opt-out of sale/sharing under CCPA, CPA, CTDPA, and other state laws that mandate GPC honor. When GPC is detected we set a gpc=1 cookie and (for signed-in users) flag your account immediately.
The Service is operated from the United States. If you access it from the European Economic Area, the United Kingdom, or Switzerland, your personal information will be transferred to the U.S. We rely on Standard Contractual Clauses (where applicable) and the UK addendum for transfers to and from non-adequate jurisdictions. EU/UK residents have rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent — submit to [email protected]. We do not have an EU representative under GDPR Art. 27; if our offering materially expands into the EU we will appoint one. Lodge complaints with your supervisory authority if you cannot resolve issues with us.
The Service is not directed to children under 13 and we do not knowingly collect personal information from anyone under 13. If we learn that we have done so, we will delete the data and terminate the account. Contact [email protected] if you believe a child has registered.
We use the following cookie / similar-technology categories:
regwatch-session, iron-session encrypted), CSRF token, visitor-ID cookie (rw_vid), GPC opt-out flag.Browser controls (block third-party cookies, clear cookies) work as expected. Logout removes the session cookie. Account deletion removes the visitor-ID mapping in our database.
Our AI chat sends your typed message and the property brief (data assembled from public records and your saved properties) to Groq, a third-party LLM inference provider. Before transmission we apply a regex-based PII redaction layer that scrubs phones, emails, SSNs, EINs, international phone formats, and Luhn-validated credit-card sequences. We apply the same filter on output before showing responses.
Groq’s default terms retain prompts briefly for abuse review and do not train on customer prompts. Chat messages are stored in our database for 90 days then purged. You can delete your account to immediately purge all chat history.
For New York residents, we maintain reasonable administrative, technical, and physical safeguards as required by NY Gen Bus L §899-bb. These include: bcrypt-hashed passwords, encrypted-in-transit and (where applicable) encrypted-at-rest data, SHA-256 pseudonymization of search-log IPs, role-based access controls, audit logging of admin actions, dependency vulnerability monitoring, and an incident response plan.
If we discover an unauthorized acquisition of personal information that triggers state notification laws (NY SHIELD §899-aa, CA Civil Code §1798.82, GDPR Art. 33-34, etc.), we will notify affected users without unreasonable delay and in any case within the applicable statutory deadline. Notifications go to your registered email address and (where required) include the categories of information affected, the date range of exposure, and remediation steps.
Covered persons under New Jersey’s Daniel’s Law (judges, prosecutors, law enforcement, and analogous roles per N.J.S.A. 56:8-166.1) may submit a removal request at /privacy/removal-request. We action verified requests within 10 business days. We honor analogous requests from NY/CT covered persons under the same SLA where state law permits.
Delete your account at any time from your account settings or by emailing [email protected]. Account deletion cascades across user-scoped tables — chat history, saved buildings, monitors, search log, email preferences, favorites, purchased reports — within seconds. Some records (payment metadata, admin audit logs) are retained per the schedule in §5.
Privacy team: [email protected]. Mailing address: see postal address in our email footers (CAN-SPAM disclosure).
We may revise this Privacy Policy. Material changes will be (a) posted with a new “Last updated” date and version number, and (b) emailed to your registered address at least 30 days before taking effect. Continued use after the effective date constitutes acceptance. Version-controlled — current: 2026-05-08. Prior versions available on request.
This Privacy Policy is effective as of May 2026 (version 2026-05-08).