Version 1.3 · effective 2026-10-01

BlockLot — Privacy Policy

Version 1.3 · effective 2026-10-01

This policy is published by BLOCKLOT LLC (Florida), 12955 Biscayne Blvd Ste 200 PMB 770, Miami, FL 33181, legal@blocklot.ai. It covers two different things, because BlockLot handles two different kinds of information:

1. Information about you — the person visiting the site or holding an account (§ 1–7).
2. Information about properties, their owners, and the businesses and other occupants that the Service publishes from government public records (§ 8). If you are here because BlockLot displays information about you, your business or your property, go to § 8.

1. What we collect about you

Account data (account holders only): name, e-mail address, company, and optionally a phone number — provided at account creation. Passwords are stored only as salted, peppered cryptographic hashes; we cannot read them. Phone numbers are encrypted at rest.

Usage data: the Reports you open and your metered searches are recorded against your account with timestamps — this is both how your plan's allowance is counted and the Service's audit log; your Report history is visible to you on your account page. We record the network (IP) address your requests come from alongside these usage records, for security, abuse detection and enforcement of the limits in your plan, and we keep it for 13 months — the same period as the usage record it belongs to (§ 5). Records used for sign-in throttling, and the record of which devices are signed in, identify the network origin by a keyed hash rather than the raw address; the throttling records are kept for 24 hours. Separately, our web server keeps standard access logs, which include IP addresses, for security and abuse response; they are retained for no longer than 90 days and may be deleted earlier through rotation.

Agreement records: when you set up your account and whenever we ask again, we record what you tell us you will use BlockLot for, in your own words, together with the versions of these documents you accepted, the date and time, and a keyed hash of the network address the acceptance came from. The Terms require this statement (§ 9) and require us to ask again each year. We keep it as the record that we asked and what you answered.

Cookies: one strictly-necessary session cookie for signed-in users; the sign-in, account-setup, and password-reset forms set a short-lived security (anti-forgery) cookie. No advertising cookies, no third-party analytics, no trackers. Ordinary anonymous browsing — searching and viewing pages without signing in — sets no cookies.

2. What we use it for

To provide and secure the Service: authentication, allowance metering, abuse and extraction detection, support, and — for account holders — service communications (setup and password links, notices about the Service or these terms). We do not use your data for advertising, and we do not send marketing to account e-mail addresses without separate consent.

3. What we share — and what we never do

We do not sell or rent your personal information, and we do not share it for advertising. This promise concerns information about you as a visitor or account holder (§ 1). Public-record information about properties and their owners is the product itself — the Service publishes it and sells access to it; § 8 describes its sources and the rights of the people it concerns. We share it only with: service providers acting for us (server hosting; encrypted off-site backup storage, which receives only ciphertext; a payment processor once billing exists); professional advisors under confidentiality; authorities when legally required, and then no more than required; and a successor in a merger, acquisition, or asset sale, under this policy.

4. Security

Passwords hashed with a modern memory-hard algorithm plus a separately stored server secret; phone numbers and second-factor secrets encrypted at rest; second-factor verification on operator sign-in, and administrative surfaces are not exposed to the public internet; access to production restricted by key-based SSH; application logging designed to minimize account and record content (usage records and web-server access logs include IP addresses as described in § 1); administrative access to those records limited to the operator and recorded; encrypted off-site backups. No system is perfectly secure; if a breach affects your unencrypted personal information, we will notify you as required by applicable law (including NY GBL § 899-aa).

5. Retention

We keep different records for different periods:

• Account data: for the life of the account and briefly afterwards for wind-down.
• Sign-in throttling records: 24 hours (§ 1).
• Usage and audit records (Report views, metered searches), including the network address they were made from: 13 months in identifiable form, then reduced to per-account monthly counts, with the record of which properties were viewed, when, and from where deleted.
• Agreement records (§ 1): for the life of the account. After deletion, what survives is described in § 6.
• Administrative and security event records: 13 months, or longer where required for a specific investigation or by law. After that they are reduced to counts by event type, and system journals are deleted on the same schedule.
• Web-server access logs: no longer than 90 days (§ 1).
• Administrative and legal records: as law requires.
• Backups: encrypted; pruned under our retention procedure, which may retain snapshots containing the above for a further limited period.

6. Your choices and rights

Write to legal@blocklot.ai from your account e-mail to access, correct, or delete your account data. Deletion removes your profile, your credentials and your second-factor settings, cancels any outstanding sign-in link, and replaces your e-mail address with a non-reversible placeholder; your usage records are kept in anonymized form — the network addresses on them are erased, and they are no longer linked to any identity. We keep the record of the agreement itself: which versions of these documents you accepted, when, and at which step of the Service; and the date of each intended-use statement, and whether you gave it at account setup, in the Service, or to us when your account was created. What you wrote in those statements is erased, and so are the keyed network hashes recorded with them and with your acceptance. Anything else is retained only where the law or a live dispute requires. We honor these requests regardless of your state of residence. The Service is directed to users in the United States and is not intended for children under 18.

7. Changes

We will post changes with a new effective date and give account holders notice in the Service at least 14 days before material changes take effect.

8. Information about property owners, businesses and other occupants — sources, corrections, removal

The Service republishes and analyzes public records about New York City real property — ownership, deeds and mortgages, permits, violations, tax assessments, and similar — published by government agencies. It also shows businesses and other organizations that public records place at an address: licences, registrations, inspections and similar filings by City agencies, listed with their dates and sources. Such a listing is a dated public record, not a statement that the business is at the address today. Individuals who appear in those records (for example, a licence held in a person's own name) are shown as counts, not by name. Each displayed fact identifies its source; a date shown may represent the source's own event date, the time our stored record last materially changed, the time an indicator was computed, or the time a source was last checked, as labeled.

Corrections. If information we display differs from the current government record, tell us at corrections@blocklot.ai (or /corrections) with the property and the discrepancy; we will check the source and correct our copy promptly. Sources are refreshed on differing schedules; we update our copy after the agency's correction is captured by a refresh or independently verified. If the underlying government record is itself wrong, it must be corrected with the agency that maintains it — we cannot alter it, but once the agency does, our copy will follow.

Removal. We generally do not remove accurate public records — they remain public at the source regardless of us. We will, however, review and act on requests involving: participants in address-confidentiality programs (including NY's); credible safety concerns (e.g., protection orders, documented stalking or domestic-violence risk); judges, law-enforcement, and other categories protected by specific statutes; and records displayed by our error. A business, organization or person listed at an address may also ask us to remove that listing or to withhold its name. When we act on a removal, it applies to our copy and stays in effect when the source is next refreshed; the record remains public at the agency. Requests: corrections@blocklot.ai (or /corrections), with enough information to verify the requester's connection to the record; we respond within 10 business days.

Your request. When you submit a request through /corrections we keep your name, your e-mail address, what you wrote, and a keyed hash of your network address while we handle it. Thirteen months after we resolve or decline the request we erase those; we keep the record that a request was made about the property, its type, its dates and its outcome. Where we remove or withhold a listing, we keep a record of that action (which record, when, and why) for as long as the removal is in effect, because it is what keeps the listing from returning.

Derived Indicators (scores, groupings) are our inferences from the stated records, are labeled as such, and are covered by the same corrections process.