Privacy Policy

When you submit a pole concern through AcreSeal, we may collect:

• Contact information (optional) — phone number, email address
• Location data — GPS coordinates captured at time of submission
• Photo evidence — photos with EXIF metadata (camera model, timestamp, GPS if embedded)
• Device information — browser type, operating system, screen size (for platform optimization)
• IP address — used automatically to limit repeated requests and to detect abuse. It is not stored with or linked to your report or your contact details.
• Abuse-prevention records — request counters keyed by IP address are deleted after 48 hours.
• Staff IP address — when a staff member records that another party was notified about a report, that staff member's IP address is stored on the notification entry and kept permanently.
• Submission content — description of the pole concern, concern category, pole asset tag

What we do not collect: the submission form does not request your name. The API enforces this — the landowner_name field is always stored empty regardless of input.

For utility dashboard users, we collect work email and role information provided during account provisioning. Notes that staff type into a report's record are kept as part of the record.

• Public complaint form at acreseal.com/report — landowner-initiated submissions
• Dashboard activity — complaint management, assignment tracking, report generation
• Automated capture — GPS coordinates, environmental conditions (weather data from the NOAA National Weather Service at time of submission)

• Complaint processing — routing your report to the responsible utility for resolution
• Record keeping — keeping a tamper-evident record of each report for the responsible utility
• Filing support — the exports a utility uses for its own HB 144 annual update and plan summary
• Status updates — sending you email notifications about your complaint (if you gave an email address). Text messages are not enabled.
• Platform improvement — aggregated, anonymized usage data to improve the platform

Your data is stored on Supabase (PostgreSQL) hosted on AWS US East infrastructure.

• Encryption at rest — AES-256-GCM for email and phone, with key material derived via HKDF from a service-role secret never exposed client-side
• Encryption in transit — TLS 1.3 for all connections
• Spatial data — GPS coordinates stored via PostGIS with Row Level Security (RLS)
• Complaint description — stored unencrypted and cannot be edited after submission. Description data is never sold, shared with advertisers, or used for analytics.
• Hash links — each status change in a report's history carries the SHA-256 hash of the one before it, so a changed or missing link shows when the chain is checked
• Access control — Row Level Security policies restrict data access by utility and role

For more details on our security architecture, see our Security page.

Automatic removal is not running yet. It will be running before any report is one year old. It will replace your name, email, phone number and street address with [REDACTED]. The location and description of the pole issue are kept as part of the record.

Your data is shared with the assigned utility responsible for the pole in your report. This is necessary for complaint resolution under HB 144.

A small number of operational vendors receive specific fields to deliver the service. Each receives only what it needs:

• NOAA National Weather Service — receives your GPS coordinates only, to fetch the weather conditions at the moment you reported the issue. NWS is a US federal agency; no personal data is transmitted.
• Anthropic (our AI vendor) — receives your complaint description and GPS to draft your confirmation message. If you include a photo, Anthropic also receives the photo, so AcreSeal can suggest how serious the damage looks; that suggestion is not used until a staff member confirms it. We do not send Anthropic your name, email address or phone number, but anything you write in your description, and any details your camera stores inside the photo, are sent as they are.
• Resend (email delivery) — receives your email address when sending you a confirmation or status update, and when alerting AcreSeal staff to your report so a person can follow up with you. Your contact details are sent to AcreSeal's own staff addresses for that purpose; they are not included in the notification sent to a utility.
• Twilio (SMS delivery) — receives your phone number only if SMS notifications are enabled and you have opted in. SMS is currently not enabled, so no phone number is transmitted to any SMS provider.
• Cloudflare Turnstile — receives a verification token to confirm you are not a bot and, as part of loading the check, your IP address. No complaint data is transmitted.
• Sentry (error monitoring) — receives technical error reports and, for serious security events, the requesting IP address. Email addresses and phone numbers are stripped before sending.

Beyond the operational vendors listed above:

• We never sell personal data to third parties
• We never share your complaint records or contact information with advertisers or data brokers. Our website does use advertising and analytics measurement tools that collect browsing data — see Section 7 below.
• Aggregated, anonymized data may be used for infrastructure insights and platform improvement
• We may disclose data if required by law, court order, or regulatory proceeding (e.g., PUCT audit)

These tools measure how our website is used and how effective our advertising is. They are separate from the complaint system: your pole report, its description, photos, GPS coordinates, and any contact information you provide are never sent to any advertising or analytics provider.

• Google Ads (gtag.js) — we run Google Ads and use Google's tag to measure which ads lead to visits and conversions. Google sets cookies in your browser and receives your IP address, the pages you view on acreseal.com, general device/browser information, and any Google click identifier (such as gclid) present when you arrive from an ad. This data is processed by Google under its own privacy policy and may be used for conversion measurement and remarketing.
• Vercel Analytics — cookieless, aggregated page-view measurement (page, referrer, country, device type). No cross-site tracking and no individual profiles.
• Vercel Speed Insights — anonymous page-performance metrics (load times, Core Web Vitals). No cookies.

Your choices. You can opt out of personalized Google advertising at myadcenter.google.com, block or delete cookies in your browser settings, or use a browser that blocks trackers. Blocking these tools does not affect your ability to submit a pole report — the reporting portal works without them.

These tools run on our public pages, including the reporting portal. When you successfully submit a pole report, we record that a report was completed as an advertising conversion event. That event transmits no part of your report — not the description, photos, GPS coordinates, contact information, or complaint reference ID. We deliberately exclude these tools entirely from the utility dashboard, the report status pages, and sign-in — so that complaint reference IDs, which appear in those page addresses, are never transmitted to Google or any analytics provider.

Product telemetry (register)

You have the right to:

• Access — request a copy of the data we hold about you
• Correction — request correction of inaccurate information
• Deletion — you can ask us to remove your name, email, phone number and street address before the year is up. We will reply within 30 days and tell you what we removed and anything we cannot remove yet. The location and description of the pole issue are kept as part of the record (see Section 5)
• Portability — request your data in a standard format (CSV or JSON)

To exercise any of these rights, contact info@acreseal.com.

For questions about this privacy policy or how we handle your data: