Privacy Policy
Darr Mahmood LLC · Last updated September 9, 2026
We are a permit filing service. We collect what we need to prepare and file your paperwork, and not much else. We do not sell your information. We use Google Analytics on our public pages to see which of them people find useful; it does not run on your account, your jobs or your permits.
Who we are
Darr Mahmood LLC is a New Jersey limited liability company that prepares and files construction permit applications for contractors, acting as the authorized agent of the owner in fee. You can reach us at sendthepermit@gmail.com or (201) 912-1778.
What we collect
If you send us a permit job
- Your name, business name, email address and phone number
- Any contractor registration or licence number you tell us
- The job address, municipality, trade and description of the work
- Documents and photographs you upload for the filing
If you create an account
- Your email address, name and a password, which is stored only as a one-way hash — we cannot read it, and neither can anyone who obtains our database
- Your filing history, saved permit templates, and any contractor profile you choose to publish
- A signature and authorized seal, only if you choose to save them for reuse
If you are a homeowner asking for work to be done
- Your name, contact details, town and a description of the job you want done
If your contractor business appears in our prospecting records
We may retain business contact details and permit activity from authorized municipal records and public business websites, together with source references, verification notes, marketing permission records and outreach history. We use this to identify businesses that could benefit from permit preparation and to manage relevant outreach. These records are restricted to staff. You can ask us to stop contacting you; marketing email also contains an unsubscribe link, and marketing texts include STOP instructions.
Automatically
- Your IP address and basic request details, recorded in our server logs and used to apply rate limits and investigate abuse
What we do not collect
We never see your card number. Payments are taken on Stripe's own checkout pages. Your card details go from your browser to Stripe and never pass through our servers. We receive only the amount, the currency, the email address you paid with, and an identifier for the transaction.
We do not sell your information and we do not use session recording. Nobody is buying a list of you from us.
Analytics and advertising
Our public pages — the home page, services, pricing, this one — load Google Analytics
(measurement id G-K5YQ6H1LTV). It tells us how many people arrived, which page they landed on, roughly
where in the world they were, and what kind of device they used. We look at it to decide which towns to research
next and whether an advert was worth paying for.
Our public pages also carry the Meta (Facebook) advertising pixel, id 2094045184557506. When we pay
for an advert on Facebook or Instagram, it is what tells us whether anyone who saw it actually arrived. It records
that a page was viewed, and Meta may use that to show you our advert again.
We have deliberately turned off the part of the Meta pixel that Meta enables by default. It is called Automatic Advanced Matching, and left alone it reads the form fields on the page — the name and phone number you type into the permit checker, the contact form at the bottom of the home page — and sends them to Meta as a way of identifying you. We switch it off in the page itself, so the pixel can report that a page was seen and never who saw it.
Neither of them goes anywhere near your account. There is no Google tag and no Meta pixel on the pages where you log in, manage your jobs, or work with the permit assistant, and none at all on the desk we run the business from.
What analytics never see
Neither of them ever receives anything about your work. Not a job address, not an owner's name, not a block or lot, not a licence or registration number, not the contents of a permit checker query, not a file you uploaded, not a photograph of a tax bill or a licence card. Those live behind your login, and the page addresses inside your account do not carry them either.
If you would rather not be counted at all, every major browser has a setting for it, and any of the usual blockers will stop both scripts; the site works exactly the same either way. You can also ask us to stop — write to sendthepermit@gmail.com and say so.
Who your information is shared with
Only the companies we need to run the service, and only for that purpose. None of them are permitted to use your information for their own marketing.
| Who | What they receive | Why |
|---|---|---|
| Stripe | Your card details (directly from you), name, email, billing address | To take payment. Their privacy policy. |
| OpenAI | The job details and answers you give the permit-form assistant, document photos you ask it to read, and limited business names and observed permit activity used to select outreach benefits | To draft application fields, identify missing information, transcribe document photos and select relevant outreach benefits through the OpenAI API. The assistant requests no stored API response. Their privacy policy. |
| Anthropic | Questions and job details submitted to the public AI guide and permit checker, and information used in the existing research tools | To answer public questions and support municipal research through the existing Anthropic integration. Their privacy policy. |
| Resend | The signed application and documents you ask us to send to a town, the town's email address, and your email address as the reply-to; also business email addresses and marketing content for contacts with recorded email opt-in | To deliver permit emails when you press "Send to the township", with a copy to our mailbox, and eligible marketing emails through our outreach settings. Outreach does not include permit documents. Their privacy policy. |
| Firecrawl | Contractor business search queries, public municipal source URLs and business website URLs, and the public page contents it retrieves | To search public contractor websites, read supported public permit pages and identify published business contact candidates. Uploaded customer documents are not sent to this integration. |
| Vonage | Business phone numbers, SMS content, and reply and delivery events | To deliver marketing texts to verified contacts with recorded SMS permission and process replies and opt-outs. |
| MongoDB Atlas | Account data and staff-only prospecting records | It is the database this service runs on. |
| Vercel | Requests to this site, including IP addresses, in server logs | It is the hosting provider. |
| Municipalities | Whatever the permit application itself requires | Filing the application is the service. Permit records are generally public in New Jersey. |
Contractors, if you are a homeowner
When you request an introduction, staff review the project before contractors covering the work can search a preview of its town, trade, selected budget and timing. We privately invite one contractor at a time. Your name, phone, email and full project description are encrypted before database storage. Staff reviewing your request can access those fields. A contractor confirming interest receives no customer contact details. Only after you approve that named contractor can they access your name, description and chosen email or phone field. Recognizable phone and email patterns are removed from the contractor’s description view. Keep personal details in the separate contact fields; pattern removal cannot recognize every identifier. Our server decrypts authorized views; this is not end-to-end encryption.
We retain contractor availability preferences, invitation history, recorded responses and customer approval choices to operate the matching process. Availability expires after 14 days unless renewed. No plan price increases a match score. A private request link gives its holder control of the request; keep it private. Staff can prepare that link for an imported request and share it with its requester through an authorized contact channel.
Authorized partner leads remain restricted to the contractor account entitled to receive them. Public procurement opportunities are labeled separately and may include the professional contact details the agency published for that solicitation. Property ownership and permit records are not used to build homeowner contact lists.
If you use the project AI chat, we send your recent conversation, project fields and authorized match context to OpenAI. Recognizable phone and email patterns are removed from chat and project text. Do not enter names, addresses or other personal details in chat. The chat is held in your browser’s memory, not saved as a conversation in our database; applying a suggested description and submitting it saves it with your request. Provider processing follows the OpenAI arrangements described above. Staff AI assessments are saved with the request for review. AI cannot send an introduction, share your contact fields or make your approval decision.
Homeowner requests normally expire after 30 days. Opportunity records are scheduled for deletion 90 days after expiry. Use your private link to pause an introduction or withdraw: pausing stops contractor portal access, while withdrawal also removes the saved contact details and description. A contractor who already received details may have retained a copy. You can contact us to request help. Historical backups may retain records until normal expiry.
Saved signatures and seals
You can choose to save a signature and an authorized seal in your account. The file contents are encrypted before database storage. New job attachments receive the same encryption. Names, file types and dates remain available to show you what is saved; job details are stored separately.
Your signed-in account controls access to the saved originals. When you ask to reuse one, we attach a separate encrypted copy to your selected job. Our server can decrypt files for authorized downloads and requested filing. This is encryption at rest, not end-to-end encryption. Saving a file does not send it to an AI provider, and reusing it does not sign, seal or certify a new application.
You can replace or remove the saved original in your account. Copies already attached to jobs remain with those jobs, and removing a file cannot recall a filing or email already sent. Older uploads are handled through a separate encryption migration; historical backups may retain their earlier storage format.
Cookies
Two, both strictly necessary, both set only after you log in:
- permit_session — keeps you logged in. It is HttpOnly, so scripts on the page cannot read it.
- permit_csrf — protects your account against requests forged by other websites.
Logging out clears both.
Google Analytics and the Meta pixel set their own cookies on our public pages, to tell a returning visitor from a new one and to connect an advert to a visit. They carry a random identifier and nothing you typed. None are set on the pages behind your login.
How long we keep things
- Permit jobs and filings — kept while your account is open, so you and we can show what was filed and when. Permit paperwork is worth having years later, when a town asks.
- Payment records — kept for seven years, which is what tax and accounting rules require.
- Saved signatures and seals — kept until you replace or remove them, or delete your account. Existing job copies follow the job retention described above.
- Login sessions — expire automatically and are deleted.
- Rate-limit records and server logs — short-lived, days rather than months.
Your choices
Email sendthepermit@gmail.com and we will, without charge:
- Tell you what we hold about you
- Send you a copy of it
- Correct anything that is wrong
- Delete your account and its contents
We may need to keep payment records to satisfy tax rules even after an account is deleted, and we cannot retrieve or unfile an application a municipality has already received.
Security
The site is served only over HTTPS. Passwords are stored as one-way hashes. Administrative pages require a logged-in staff account rather than a shared password, and every administrative action is written to an audit log. No system is perfect, and we will tell you promptly if we ever learn that your information has been exposed.
Children
This is a service for construction businesses. It is not directed at children, and we do not knowingly collect information from anyone under 18.
Changes
If we change this policy we will update the date at the top. If a change materially affects what we do with information we already hold, we will email account holders rather than relying on you to notice.
Contact
Darr Mahmood LLC
sendthepermit@gmail.com
(201) 912-1778