Privacy notice — Inframation

1. Who is responsible

The controller of the personal data described here is Andrew Gibson.

Email: privacy@inframation.io
Postal address: 1029 E 8th Ave, Suite 806, Denver, CO 80202

2. If you are named in a record we index

This platform collects public records about energy and infrastructure projects: interconnection queues, permits, regulatory filings, procurement notices and ownership registers. Some of those records name a person, for example where a person is listed as a plant owner, a parent company, a project sponsor or a contact on a filing. We did not collect this from you; we read it from the public source, and this section is how we tell you about it.

What we hold: Your name as the register prints it, your role in the record (owner, sponsor, operator, filer), the project or asset it concerns, and, where the register states one, an ownership share. We do not keep email addresses, phone numbers or signatures: we remove them before anything is stored. Where a project’s name gives a street address and the project is sponsored by a person, we do not show the address.
Where it comes from: The public register named on each record’s page, with a link to it, for example the US Energy Information Administration’s generator survey, the US Environmental Protection Agency’s greenhouse gas reporting program, or a grid operator’s interconnection queue.
Why: To identify and follow energy projects and who holds them, which is the reason the registers are public. Our legal basis is legitimate interests: making public infrastructure records searchable in one place. We weigh that against your interests by holding only the identity fields a record needs, never your contact details.
What we do to limit it: Where a record names a person rather than a company, we keep the page out of our sitemap and ask search engines not to index it, we do not show the person’s ownership share, and we remove street addresses from project names shown next to a person’s name. We never use names from these records to contact anyone.
Who sees it: Anyone who reads the site, the API, its feeds or exports, as with the source register itself.
To have it corrected or removed: Use the privacy request form with the record’s id. An operator handles every request by hand; nothing is sent automatically. We remove or correct your details on every record that names you, not only the one you cite, and the removal holds when the source is next read. The same request can be sent by software to POST /v1/privacy/requests.

3. If you use the site

Accounts: Email address, name, and a password hash (never the password itself), plus the sessions and API keys you create (a key is stored only as a hash). Used to sign you in and to know which saved searches and alerts are yours. Legal basis: providing the service you asked for.
Alerts: Your saved searches and a log of alerts sent: recipient, saved search, matched records and send status. You choose which searches send email and can stop any of them with the unsubscribe link in every alert email or on the unsubscribe page. Legal basis: providing the service, and your choice to receive email.
Reports, feedback, submissions and privacy requests: If you report a problem, send us feedback, submit a project or send a privacy request, we keep the contact details and message you give so we can act on it and answer you. Feedback also keeps the address of the page you sent it from, without anything after a question mark, so a search you typed is not kept; giving an email address with it is optional. When a privacy request is closed, the address and message are deleted from it. Legal basis: legitimate interests in correcting the record, improving the site and answering you.
My projects beta waitlist: If you join the beta from the Deal room, we keep what you type. Your email address is required to join; everything else is optional: your name, company, role and a line on what you would use it for. We also keep whether you ticked “Email me about the beta” and when, whether and when your address was confirmed, the dates the entry was created and last updated, and the page you signed up on. We keep one entry per email address; signing up again never adds to it or changes it, except that signing up again with the box unticked withdraws your consent. We use it only to plan the beta, to match you to your account (if you have one) when we let you in, and, if you ticked the box and confirmed your address, to email you about the beta; a person writes every such email, and none is sent automatically. It is never shown on any public page and never used for matching, alerts or analytics. We do not store your IP address or browser with it; our servers’ ordinary logs and rate limits (below) apply to the request. Legal basis: our legitimate interest in running the waitlist you asked to join, and your consent for the emails, which you can withdraw at any time by replying “stop” to any such email, by signing up again with the box unticked, or by writing to us.
Our own business contacts: For our own outreach we hold business contact details (name, work email, job title, company) taken from public professional sources such as company websites, never from the records we index and never a personal email address. Every message we send says who we are, how we found you and how to stop hearing from us, and we stop at once if you object. Legal basis: legitimate interests; you can object at any time and that objection is absolute for direct marketing.
Server logs and usage counts: Our servers record each request (IP address, time, address requested) for security and rate limiting. These logs are rotated by size and not archived. Forms may use Cloudflare Turnstile to block automated abuse, which processes your IP address. Map interaction counts (layer toggles, region jumps) carry no cookie, IP address or other identifier.

We do not sell personal data, and we do not share it for advertising.

4. Who processes it for us

Service providers that process personal data on our instructions: our server and database hosts, Cloudflare (network, backups storage and form protection), Resend (sending email), Attio (our customer relationship records) and, if paid plans are offered, Stripe (payments). We are based in the United States; data may be processed there and in the countries where these providers operate.

5. How long we keep it

Accounts and alerts: while your account is active. When you ask us to delete your account, your user record is anonymised, your sessions and API keys are revoked and your alerts stop.
The My projects beta waitlist: until the beta ends or for 24 months from your sign-up, whichever comes first (we delete the list within 30 days after the beta ends), unless you ask us to delete it sooner. That removal is not yet automated; until it is, we do it by hand. To delete your entry, email privacy@inframation.io from the address you signed up with; deleting your account also deletes the entry for its address. A one-way hash of your address stays in our records so a removed address isn’t added back.
Privacy requests: the contact address and message are deleted when the request is closed; we keep the request’s id, dates, status and the record it concerned, as evidence that it was handled.
Suppression list: if you unsubscribe or have your data erased, we keep a one-way hash of your email address on a suppression list, not the address itself, so that we never write to you again. If, after deleting your account, you sign up again with the same address and confirm it from the link we send, we lift the entry your deletion left, so the new account gets the alerts you set up. An unsubscribe stays in force.
Names in indexed records: while the project record is active. Records of withdrawn or cancelled projects remain as history; our rule is to remove the names of people from them 24 months after the project ended. That removal is not yet automated; until it is, ask and we will do it on request.
Backups: an erased value can remain in database backups until they expire: up to 7 days in our database host’s point-in-time recovery, 35 days in local dumps, 14 days in daily off-site dumps and 8 weeks in weekly off-site dumps. Backups are used only to restore the service.

6. Your rights

Depending on where you live, you can ask us to:

tell you what personal data we hold about you and give you a copy (access);
correct it (rectification);
delete it (erasure);
stop or limit using it (restriction and objection; an objection to direct marketing always succeeds);
give you the data you provided to us in a reusable format (portability, for account data);
withdraw a consent you gave, such as to alert emails, at any time.

We make no decisions about you by automated means that have legal or similarly significant effects. To use a right, use the privacy request form (for records that name you) or email privacy@inframation.io (for anything else). We answer within 30 days. We may ask for enough information to confirm the request is yours, and we will not ask for more than that.

7. Complaints

Please tell us first, and we will try to put it right. You also have the right to complain to a data protection authority: in the European Union, the authority in the country where you live or work (listed by the European Data Protection Board); in the United Kingdom, the Information Commissioner’s Office; in California, the California Privacy Protection Agency.

8. California residents

This section gives the notice California law requires. In the last 12 months we have collected these categories of personal information: identifiers (name, email address, IP address); professional information (job title, company, and a person’s role in a public record); and internet activity (server logs). The sources, purposes and retention for each are in sections 2, 3 and 5. We do not sell or share personal information as California law defines those terms. The only sensitive personal information we collect is your account login with its password (stored as a hash), used only to sign you in.

You have the right to know what we collect and how we use it, to delete it, to correct it, to opt out of sale or sharing (which we do not do), and not to be treated differently for using these rights. You can use them through the privacy request form or by email at privacy@inframation.io, yourself or through an authorized agent. We honor these rights whether or not the law’s thresholds apply to us.

9. Changes

When this notice changes, the date at the top changes with it. The licenses under which the data itself may be reused are summarized separately in Reuse conditions.