1. Introduction
Enbrite LLC ("we," "our," or "us"), operating as Flagstone ("Flagstone," the "Service"), is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, share, and protect information when you use our website at flagstonehq.com, our property intelligence reports, and any related services.
By accessing or using Flagstone, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use our Service.
2. Information We Collect
2.1 Information You Provide
- Account Registration Data: When you create an account, we collect your name, email address, and password (stored as a cryptographic hash, never in plain text).
- Email-Only Access: If you generate a free report without creating an account, we collect your email address.
- Payment Information: If you subscribe to Address Watch (an optional paid feature), payment is processed by Stripe. We do not store your credit card number, CVV, or full payment details. We receive and store your Stripe customer ID and basic transaction metadata.
- Support Communications: If you contact us via email, we retain the content of those communications.
2.2 Information We Collect Automatically
- Usage Data: Pages visited, features used, report addresses searched, timestamps, and interaction patterns.
- Device and Browser Data: Browser type, operating system, screen resolution, and general device information.
- IP Address: Collected for security, fraud prevention, and general analytics. We do not use IP addresses to serve targeted advertising.
- Cookies and Similar Technologies: We use essential cookies for session management and analytics cookies via Google Analytics 4 to understand how visitors use our site. See Section 9 for details.
2.3 Information from Public Sources
Flagstone generates property intelligence reports by querying publicly available government databases. The data in these reports, including property assessments, violations, permits, deed transfers, tax records, crime statistics, and flood zone designations, comes from official Philadelphia city sources (via OpenDataPhilly) and federal sources (FEMA). This is public record data; we do not collect it about you personally.
3. How We Use Your Information
We use the information we collect to:
- Provide the Service: Generate property intelligence reports, deliver them to your email, and display them in your dashboard.
- Manage Your Account: Authenticate your identity, track report history, and manage Address Watch subscriptions if applicable.
- Communicate with You: Send report delivery emails, account verification emails, password reset emails, and (if you opt in) product updates. We do not send unsolicited marketing emails to free report users beyond a single follow-up.
- Improve the Service: Analyze usage patterns to improve report quality, site performance, and user experience.
- Ensure Security: Detect and prevent fraud, abuse, and unauthorized access.
- Comply with Legal Obligations: Respond to lawful requests from government authorities and comply with applicable law.
4. AI and Data Processing
Flagstone uses AI (powered by Anthropic's Claude) to generate narrative summaries and analysis within property reports. When a report is generated:
- Property data (from public government sources, not your personal data) is sent to the AI model to produce a plain-English summary.
- Your personal information (name, email) is not included in AI prompts.
- AI-generated content is analytical commentary, not legal, financial, or professional advice.
- AI outputs may contain inaccuracies. You should independently verify any information before making decisions.
5. How We Share Your Information
We do not sell your personal information. We do not share your data with third-party advertisers.
We may share information with:
- Stripe: For payment processing. Stripe's privacy policy governs their handling of your payment data. See stripe.com/privacy.
- Google Analytics: For anonymized usage analytics. See policies.google.com/privacy.
- Anthropic (Claude AI): Public property data (not your personal data) is sent for report narrative generation. See anthropic.com/privacy.
- Cloudflare: Our infrastructure provider for hosting, CDN, and security. See cloudflare.com/privacypolicy.
- Law Enforcement: We may disclose information if required by law, subpoena, court order, or government request, or if we believe disclosure is necessary to protect rights, safety, or property.
- Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.
6. Data Retention
- Account Data: Retained as long as your account is active. If you delete your account, we remove your personal data within 30 days, except as required for legal or compliance purposes.
- Reports: Reports are stored for 90 days. Signed-in users can regenerate reports at any time from their dashboard.
- Email-Only Data: If you provided only an email for a free report without creating an account, we retain your email and report association for up to 1 year.
- Payment Records: Transaction metadata is retained for up to 7 years for tax and accounting compliance.
- Analytics Data: Aggregated, anonymized analytics data may be retained indefinitely.
7. Data Security
We implement commercially reasonable security measures to protect your information:
- Passwords are hashed using industry-standard cryptographic algorithms. We never store plain-text passwords.
- All data transmission is encrypted via HTTPS/TLS.
- Database access is restricted and authenticated.
- Session tokens expire automatically.
No system is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately at hello@flagstonehq.com.
8. Your Rights and Choices
8.1 All Users
- Access and Correction: You can view and update your account information from your dashboard.
- Deletion: You can request account deletion by emailing hello@flagstonehq.com. We will process your request within 30 days.
- Opt Out of Communications: You can unsubscribe from non-essential emails at any time.
8.2 California Residents (CCPA)
If you are a California resident, you have the right to:
- Know what personal information we collect, use, and share.
- Delete your personal information, subject to certain exceptions.
- Correct inaccurate personal information.
- Non-Discrimination: We will not discriminate against you for exercising your privacy rights.
We do not sell personal information. We do not use or disclose sensitive personal information for purposes beyond what is necessary to provide the Service.
To exercise your California privacy rights, email us at hello@flagstonehq.com with the subject line "California Privacy Request."
8.3 Other State Privacy Rights
Residents of Virginia, Colorado, Connecticut, and other states with comprehensive privacy laws may have similar rights to access, delete, and correct their personal information. Contact us at hello@flagstonehq.com to exercise these rights.
9. Cookies
| Type | Purpose | Provider | Duration |
|---|
| Session Cookie | Keeps you logged in | Flagstone | Until logout or expiration |
| Analytics | Anonymized usage data | Google Analytics 4 | Up to 14 months |
We do not use advertising cookies. We do not use third-party tracking pixels. We do not participate in cross-site advertising networks.
You can disable cookies in your browser settings, but this may affect your ability to use certain features (such as staying logged in).
10. Children's Privacy
Flagstone is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children. If we discover that we have collected information from a child under 18, we will delete it promptly. If you believe a child has provided us with personal information, please contact us at hello@flagstonehq.com.
11. Third-Party Links
Our website and reports may contain links to third-party websites (such as Philadelphia city portals, FEMA, and other government resources). We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies before providing them with any information.
12. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated policy on this page and updating the effective date above. For significant changes, we may also notify you via email. Your continued use of the Service after changes are posted constitutes your acceptance of the updated policy.
13. Contact Us
If you have questions or concerns about this Privacy Policy or our data practices, contact us at:
Enbrite LLC (operating as Flagstone)
Email: hello@flagstonehq.com
Website: flagstonehq.com
This Privacy Policy was last updated on April 3, 2026.