Privacy Policy

2. Information We Collect

2.1 Information You Provide

We collect information you voluntarily provide to us, including:

• Account Registration: Name, email address, password, organization name, job title, and professional contact information.
• Project Data: Property addresses, building types, project specifications, financial details, construction timelines, and other information about real estate development projects you submit for incentive matching.
• Payment Information: When you subscribe to paid services, payment information is collected and processed by our payment processor, Stripe. We do not store complete credit card numbers on our servers.
• Communications: Information you provide when contacting our support team, responding to surveys, or participating in promotional activities.

2.2 Information Collected Automatically

When you access or use our Service, we automatically collect:

• Usage Data: Pages visited, features used, search queries, incentive programs viewed, reports generated, and interaction patterns within the platform.
• Device Information: Browser type and version, operating system, device type, screen resolution, and device identifiers.
• Log Data: IP address, access times, referring URLs, and pages viewed before and after using our Service.
• Location Information: Approximate geographic location based on IP address (city/region level, not precise location).
• Cookies and Similar Technologies: As described in Section 11 below.

2.3 Information from Third Parties

We may receive information from other sources, including:

• OAuth Providers: If you choose to sign in using Google or LinkedIn, we receive basic profile information (name, email) from those services.
• Public Records: We access publicly available information about incentive programs, tax credits, grants, and regulatory requirements from government sources to provide our matching services.
• Business Partners: We may receive information from partners who refer users to our Service or integrate with our platform.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Provide and Improve the Service: To operate our platform, process incentive matching requests, generate reports, and continuously improve our algorithms and user experience.
• Process Transactions: To manage subscriptions, process payments, and maintain billing records.
• Communications: To send transactional emails (account confirmations, password resets), service notifications (new incentive matches, deadline reminders), and marketing communications (with your consent).
• Analytics and Research: To analyze usage patterns, measure performance, identify trends, and conduct research to improve our services.
• Security and Fraud Prevention: To detect, prevent, and respond to security incidents, fraudulent activity, and violations of our terms of service.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, and governmental requests.
• AI Model Improvement: We may use anonymized and aggregated data to train and improve our AI models. Individual project data is not used for model training without explicit consent.

4. How We Share Your Information

We may share your information in the following circumstances:

4.1 Service Providers

We share information with third-party service providers who perform services on our behalf:

• Railway: Website, application, and database hosting
• Anthropic: AI processing for incentive matching and analysis, and to answer questions in Ask IncentEdge (Section 13)
• Stripe: Payment processing
• Resend: Transactional email delivery
• Analytics providers: Usage analytics and performance monitoring

These providers are contractually obligated to protect your information and use it only for the services they provide to us.

4.2 With Your Consent

We may share your information with third parties when you explicitly consent or direct us to do so, such as when sharing project data with application assistance partners.

4.3 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., court orders, subpoenas, government investigations).

4.4 Business Transfers

If IncentEdge is involved in a merger, acquisition, asset sale, or bankruptcy, your information may be transferred as part of that transaction. We will provide notice before your information is subject to a different privacy policy.

5. Data Retention

We retain your information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

• Account Data: Retained for the duration of your account plus 30 days after account deletion to allow for account recovery.
• Project Data: User-controlled. You may delete individual projects at any time. Deleted project data is removed within 30 days.
• Usage Analytics: Retained for up to 2 years in anonymized and aggregated form for research and improvement purposes.
• Payment Records: Retained for 7 years as required by financial regulations and tax laws.
• Legal Holds: If we are involved in litigation or government investigation, relevant data may be retained beyond normal retention periods.

6. Your Rights and Choices

6.1 All Users

Regardless of your location, you have the right to:

• Access Your Data: Request a copy of the personal information we hold about you.
• Correct Inaccurate Data: Update or correct information that is inaccurate or incomplete.
• Delete Your Account: Request deletion of your account and associated personal information.
• Export Your Data: Request your data in a portable, machine-readable format.
• Opt Out of Marketing: Unsubscribe from marketing communications at any time using the link in our emails or through account settings.

6.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You may request information about the categories and specific pieces of personal information we have collected, the sources of collection, the purposes of collection, and the categories of third parties with whom we share personal information.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: We do not sell or share your personal information for cross-context behavioral advertising. Therefore, no opt-out is necessary.
• Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information for purposes beyond those permitted under CCPA/CPRA.
• Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise these rights, please contact us at info@incentedge.com. We will respond to verifiable consumer requests within 45 days.

6.3 EU/UK Residents (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, you have rights under the General Data Protection Regulation (GDPR):

• Legal Basis for Processing: We process your personal data based on: (a) your consent, (b) performance of a contract with you, (c) our legitimate business interests, or (d) compliance with legal obligations.
• Right of Access: Request access to your personal data.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your personal data ("right to be forgotten").
• Right to Data Portability: Receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: Object to processing based on legitimate interests or for direct marketing purposes.
• Right to Restrict Processing: Request restriction of processing in certain circumstances.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time.
• Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority in your country of residence.

To exercise these rights, please contact our Data Protection Officer at info@incentedge.com.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction:

• Encryption in Transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher.
• Access Controls: We implement strict role-based access controls, ensuring only authorized personnel can access personal data, and only to the extent necessary for their job functions.
• Infrastructure Security: Our application and database are hosted on Railway.
• Security Reviews: We periodically review our application code for security issues and scan our software dependencies for known vulnerabilities.
• Incident Response: We maintain incident response procedures to promptly address any security breaches and notify affected users as required by law.

While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

8. International Data Transfers

IncentEdge is based in the United States. If you access our Service from outside the United States, your information will be transferred to, stored, and processed in the United States where our servers are located.

For users in the EEA, UK, or other jurisdictions with data protection laws, we rely on the following mechanisms to ensure adequate protection of your personal data:

• Standard Contractual Clauses (SCCs): We use EU-approved Standard Contractual Clauses with our service providers and data processors.
• Data Processing Agreements: We maintain data processing agreements with all third-party processors that include appropriate safeguards.
• Privacy Shield Successor Mechanisms: We monitor and implement applicable data transfer frameworks as they become available.

9. Children's Privacy

Our Service is designed for business professionals and is not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18.

If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly. If you believe we may have collected information from a child under 18, please contact us at info@incentedge.com.

10. Third-Party Links

Our Service may contain links to third-party websites, including government incentive program portals, regulatory agencies, and partner organizations. We are not responsible for the privacy practices or content of these third-party sites.

When you click on a link to a third-party website, you are leaving our Service, and any information you provide to those sites will be governed by their privacy policies. We encourage you to review the privacy policies of any third-party sites you visit.

11. Cookies and Tracking

We use cookies and similar tracking technologies to collect and track information about your use of our Service.

Types of Cookies We Use

• Essential Cookies: Required for the Service to function properly. These cookies enable core functionality such as authentication, session management, and security features. You cannot opt out of these cookies.
• Analytics Cookies: Help us understand how users interact with our Service by collecting information about pages visited, features used, and performance metrics. This data is used to improve our Service.
• Preference Cookies: Remember your settings and preferences (such as language or display preferences) to provide a personalized experience.

Managing Cookies

Most web browsers allow you to control cookies through their settings. You can typically:

• View and delete cookies stored on your device
• Block all cookies or only third-party cookies
• Configure cookie preferences per website

Note that blocking certain cookies may impact the functionality of our Service. For more information about cookies and how to manage them, visit www.allaboutcookies.org.

12. AI Assistants and the MCP Endpoint

IncentEdge runs a free Model Context Protocol (MCP) endpoint at https://www.incentedge.com/api/mcp. It lets AI assistants, such as Claude, look up incentive programs in our catalog while you talk to them. Its public tools are read-only, and you do not need an IncentEdge account to use them. Signing in is optional, happens only through a separate address, https://www.incentedge.com/api/mcp/account, and is covered in Section 12.7. Sections 12.1 to 12.6 apply to both addresses. This section explains what the endpoint receives when an assistant uses it and what we do with that information. How to connect an assistant is explained on our AI assistant setup page.

12.1 What the Endpoint Receives

• The tool request: the name of the tool the assistant calls and the arguments it sends with it. Depending on the question, these can include a building's floor area, total project cost, number of units, year built, building type, retrofit tier, electric utility, region, whether the building is affordable housing, whether prevailing wages will be paid, a program id, or search filters such as state, building type, utility and technology.
• Request metadata: the IP address the request comes from, the user agent, and the name and version that the assistant's software reports about itself. When you use IncentEdge through Claude on the web, desktop or mobile, the request is made by Anthropic's servers, so the IP address we see belongs to Anthropic rather than to you. Other assistants that call from their own servers work the same way. Software running on your own computer, such as Claude Code, Cursor or VS Code, or an assistant that calls the endpoint directly from your web browser, connects from your own network's IP address.

12.2 What the Endpoint Does Not Receive

The endpoint does not receive your name, your email address, your IncentEdge account or your conversation with the assistant. It receives only what the assistant puts into each tool call. https://www.incentedge.com/api/mcp never asks for a token, and never reads or stores one that is sent to it. The one exception is an app you connect to your account through the separate address https://www.incentedge.com/api/mcp/account (Section 12.7): its requests to that address carry a token that identifies your account and organization. Even then, the endpoint never receives your conversation.

12.3 Why We Use It

• To answer the request.
• To prevent abuse and to enforce the endpoint's fair-use limits.
• To count usage, such as how often each tool is called and by which assistants, so that we can run and improve the endpoint.

12.4 What We Log

For each message an assistant sends, our server writes one log line recording the request type and the tool that was called, the retrofit tier, utility and region values if the request included them, the names (but not the values) of any other arguments, the size of the response, how long it took, whether it returned an error, the protocol version, the user agent, the name and version of the assistant's software, and a truncated IP address (the first three parts of an IPv4 address, or the first three groups of an IPv6 address). The values of other arguments are not written to that line. That includes every numeric value, such as floor area, project cost, number of units and year built, and every free-text value, such as a building type or a program id. Refused requests, such as those over a fair-use limit, are logged separately with the reason, the response status, the user agent and the truncated IP address; during a burst, only one such line is written every few seconds, with a count of the others.

Like every request to incentedge.com, MCP requests also pass through the request logs of our hosting provider, Railway, which record details such as the IP address, time, path, response status and response time. Server logs are kept by our hosting provider for a limited period for operations and security.

12.5 Sharing

We do not sell MCP request data. We share it only as described in Section 4: with the service providers that host and run IncentEdge (Section 4.1), where the law requires it (Section 4.3), or as part of a business transfer (Section 4.4).

12.6 Your AI Assistant's Own Policy

Your conversation, and anything else you tell the assistant, is handled by the company that provides it, for example Anthropic for Claude or OpenAI for ChatGPT, under that company's own privacy policy. Its policy, not this one, governs what it does with your conversation. This section covers only what reaches IncentEdge.

12.7 Optional Sign-In for Apps

The public tools work without an account: https://www.incentedge.com/api/mcp never asks for a token, and never reads or stores one that is sent to it. Sign-in happens only through a separate address, https://www.incentedge.com/api/mcp/account, which you add to an app as its own connection. If you choose to connect an app, such as Claude or Claude Code, to your IncentEdge account that way, you sign in on incentedge.com as usual and approve the app on a consent screen that names it. A connected app can then list the projects in your organization and save a building and its estimate there. To save one, it sends us a project name or the project to add it to, the details listed in Section 12.1, and optionally the building's street address, city and ZIP code.

We store:

• A record of the connection: your user id, your organization, the app's identifying web address and the name it gives itself, the permissions you approved, the address the app asked us to return you to, and when the connection was created, last used and revoked.
• The app's public registration details, which we fetch from the app's own web address: its name, the addresses it may return you to, the kinds of access (grant types) it declares that we support, and a one-way SHA-256 fingerprint of the document they came from. For Claude and Claude Code only, if that fetch fails, we use the newest copy of their published document that we have: the one we last fetched, or one we keep for that purpose.
• One-way SHA-256 hashes of the short-lived authorization codes and the refresh tokens we issue.
• The projects and estimates the app saves, in your organization like any other project, with the details the app sent and the app's host name.

We never store an access token, or the original authorization code or refresh token. Authorization codes expire after 60 seconds, access tokens after 15 minutes, refresh tokens after 30 days, and a connection after 90 days. You can disconnect an app at any time in your account settings, under Settings, then Connected apps; it loses access within about a minute.

When a connected app calls https://www.incentedge.com/api/mcp/account, the log line described in Section 12.4 also records the app's host name and your organization's internal id. Our sign-in log lines record what happened and at most the app's host name and, when a code or refresh token is used twice, the truncated IP address. None of these log lines records a token, a code, your email address or your user id.

12.8 Questions

For questions about the MCP endpoint or this section, email info@incentedge.com.

13. Ask IncentEdge (the Question Box on Our Website)

Ask IncentEdge, at https://www.incentedge.com/ask, lets you ask questions about building energy incentives and get answers from our incentive catalog. You do not need an account. Ask IncentEdge is an AI assistant: your questions are answered by Claude, an AI model made by Anthropic, which looks up programs in our catalog. This section explains what happens to what you type.

13.1 What We Receive

• Your questions and the conversation so far. Each time you ask, your browser sends us your new question together with the earlier questions and answers in the same chat, so that the answer can take them into account.
• Request metadata. The IP address your request comes from, and the time of the request.

Please do not include personal information, such as names, phone numbers, account numbers or tax details, in your questions. Ask IncentEdge does not need them.

13.2 How Your Questions Are Answered

We send your question, the earlier turns of the chat and the results of our catalog lookups to Anthropic, which processes them on our behalf to produce the answer. Under Anthropic's commercial terms, Anthropic does not use this content to train its models, and it deletes it from its systems within 30 days, except where it keeps it longer to enforce its usage policy or to comply with the law. Anthropic's own policies explain these practices.

13.3 What We Do Not Store

We do not store your questions or our answers. The chat exists only in your browser tab and is gone when you close or reload the page. We do not write your questions, our answers, or the details you give about a building (such as its size, cost or utility) to our logs or our database.

13.4 What We Log and Count

For each question, our server writes one log line recording: the outcome (for example, answered or stopped at a limit), the AI model used, which catalog lookups were made and how many, how many AI tokens were used and what they cost, how long the answer took, the results of our automatic checks on the answer's figures and links, which question in the chat it was, and a truncated IP address (the first three parts of an IPv4 address, or the first three groups of an IPv6 address). Requests we refuse, for example over a usage limit, are logged with the reason and a truncated IP address. We also keep daily totals of questions answered, tokens used and cost, with no questions, answers or IP addresses in them.

Like every request to incentedge.com, requests to Ask IncentEdge also pass through the request logs of our hosting provider, Railway, which record details such as the IP address, time, path, response status and response time. Server logs are kept by our hosting provider for a limited period for operations and security.

13.5 Usage Limits and the Session Cookie

To keep Ask IncentEdge free and available, we limit how many questions can be asked in a period of time, from one address and from the wider network it belongs to. To apply these limits, our server holds your IP address in memory, never in our database, until the daily limits reset at midnight UTC (or until a deploy restarts the server).

When you open Ask IncentEdge, our server sets a cookie that shows your questions are coming from our page. It expires after 30 minutes. It holds only the time it was issued and a code our server computes from that time and the network range your IP address belongs to. It does not contain your IP address, and we do not use it to recognize you across visits or to track you. It is an essential cookie (see Section 11): Ask IncentEdge cannot answer questions without it.

13.6 If You Contact Us From Ask IncentEdge

If you choose to send your questions to our team using the form under an answer, we receive your email address, your name if you give it, and the questions from that chat. We store and use them as described for other inquiries in this policy, to reply to you. The AI's answers are not included.

13.7 Answers Are Estimates

Answers are estimates based on published program documents. They are not eligibility determinations, and they are not tax, legal or financial advice. See our Terms of Service.

13.8 Questions

For questions about Ask IncentEdge or this section, email info@incentedge.com.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons.

When we make material changes, we will:

• Update the "Last Updated" date at the top of this policy
• Notify you by email (for registered users) if the changes are significant
• Display a prominent notice on our Service

Your continued use of the Service after any changes to this Privacy Policy constitutes your acceptance of such changes. We encourage you to review this Privacy Policy periodically.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

For CCPA requests, please include "CCPA Request" in the subject line. For GDPR requests, please include "GDPR Request" in the subject line. We will respond to your request within the timeframes required by applicable law.