Privacy

What we hold

• Your account. Email address, and a password held by our authentication provider — never by us in any readable form.
• Your business. Business name, DEC business registration number, and the applicators you file for: their names and certification numbers, which are already published by New York State.
• Your applications. Everything a pesticide application record contains, including the address where the application was made. Some of those addresses are homes. We treat the whole of it as confidential business data belonging to you.
• Your uploads. The spreadsheets you import, recorded by name and content hash so a re-upload can be recognised, with the rows stored as applications.
• Billing. A customer identifier and subscription status from Stripe. We never see or store your card number.

The free file check

If you check a file on the home page without an account, the file is read in memory and thrown away. We store the result only: how many rows, how many problems, and which DEC rules were broken. We do not store the rows, the addresses, the customer names or the certification numbers in that file. We do not store the name of the file either — only its type, such as CSV, and a fingerprint of its contents that nothing can be read back out of. The wording you see describing each problem is written from the rule, not from your data. That summary is deleted 24 hours later, and the link to it stops working at the same moment.

Who else sees it

Only the services needed to run the product, each doing one job:

• Supabase — the database and sign-in.
• Vercel — hosting.
• Stripe — payments. They hold your card details; we do not.
• Resend — sending email we send you.
• Upstash — rate limiting, which sees an IP address and nothing else.
• Sentry — error reports, when something breaks.

We do not sell your data, we do not share it with other customers, and we do not use it to train anything. Nobody is sent your applications for advertising.

What we send out

When you check a certification number, that number alone is sent to New York State’s public Current Certified Pesticide Applicatorsdataset on data.ny.gov. Nothing else about you or your business goes with it. The state’s answer — a name, an expiry date and the categories held — is cached so we do not have to ask again.

We never transmit your applications anywhere. The DEC files are generated and handed to you; you upload them yourself.

How long we keep it

Your applications stay until you delete them or close your account. New York requires you to keep daily use records for three years, so we default to keeping them rather than expiring them out from underneath a legal obligation of yours. Ask us to delete your account and we delete the business, its applications and its imports.

Getting your data out

Any time, in full, without asking us. That is a product feature rather than a policy commitment, which is the stronger version of the promise.

Contact

Questions, corrections or a deletion request: support@pestdocket.com.