Privacy policy

• ·We do not sell your personal information. Our analytics tools may count as sharing under California law, so you can turn them off in one click and we honour Global Privacy Control automatically.
• ·We use Google Analytics and Microsoft Clarity on our public pages to understand how the site is used. You can turn them off, and turning them off changes nothing about the service you get.
• ·Nothing third-party runs once you sign in. Your dashboard, your usage and your API keys are never sent to an analytics vendor or recorded by a session replay tool.
• ·We do not use your API queries to build a profile of you, and we do not sell them.
• ·We do not train models on your queries.
• ·Property measurements are produced from public data sources. They are never derived from what our customers look up.

Each of those is checkable rather than merely asserted, which is why they are phrased the way they are. The full detail is below.

OKLocate is a product of Safe Rate Inc., a Delaware C corporation with its office in Chicago, IL. Safe Rate Inc. is the data controller for everything described here.

It applies to oklocate.com, to the API at api.oklocate.com, and to the email we send you. It does not apply to other Safe Rate Inc. products, which publish their own policies.

Everything in this table corresponds to real columns in our database. We list the tables so that this page can be checked against the schema rather than taken on trust.

Our property measurements are computed from public sources — aerial imagery, LiDAR surveys, county assessor records and federal datasets. All 11 of them are listed with their licences on the data page.

They describe structures, not people. No field in our catalog names an owner, an occupant, a telephone number or an email address, and the census figures we carry are tract-level aggregates rather than individual responses.

We never derive property measurements from what our customers look up. The pipeline reads public sources and nothing else.

One strictly necessary cookie: the session token that keeps you signed in. It is set when you sign in, cleared when you sign out, and it does nothing else.

On our public pages we also use the tools below to understand how the site is used. You can turn them off at any time. Either way, refusing them changes nothing about the service you receive.

Your privacy choices shows what is running for your browser right now, and turns it off.

If your browser sends a Global Privacy Control signal, we treat that as turning them off and you do not have to tell us again.

Our servers keep ordinary request logs — IP address, user agent, URL, status, timing — as any web server does. We use them to operate the service and to investigate abuse.

We do not sell your personal information. The vendors below process data on our behalf, under contract.

All but the analytics vendors process it for no purpose of their own. The analytics vendors are the exception, and it is the reason section 10 treats their cookies as sharing under California law: their terms permit them to use what they collect for themselves. That is exactly why they are confined to public pages and can be turned off.

Beyond those, we disclose personal information only when the law requires it — a valid subpoena, court order or lawful demand — or to establish or defend a legal claim. If we are compelled to hand over your data we will tell you, unless we are legally prohibited from doing so.

If Safe Rate Inc. is acquired or merged, your data would transfer with the business. This policy, or one at least as protective, would continue to govern it.

Retention is stated per category in section 3. Two periods are worth repeating because they are the ones that outlive your account.

Billing records and API usage records are kept for 7 years. We keep them because tax rules require it and because a disputed invoice has to be reconcilable against the requests that produced it. After your account is deleted we use them for nothing else.

The administrator audit log is append-only and retained indefinitely. A log that can be edited to remove an entry is not an audit log.

API keys are never stored. We keep a SHA-256 hash and a short non-secret prefix, which is enough to authenticate a request and to let you recognise which key is which. A key is displayed in full exactly once, when you create it. If you lose it, rotate it — we cannot recover it for you, and that is the point.

Everything travels over TLS. Access to production data is limited to the people who need it and administrator actions against a customer account are logged.

No system is perfectly secure, and we would rather say that plainly than imply otherwise. If we discover a breach affecting your personal information we will notify you and the relevant regulators as the law requires.

Email team@oklocate.com. We respond within 30 days. We will not charge you for a request, and we will not treat you differently for making one.

Deleting your account removes it within 30 days, except for the billing and usage records described in section 7.

If you are a California resident, the CCPA as amended by the CPRA gives you the rights to know, delete, correct, and to opt out of sale or sharing, plus the right to limit the use of sensitive personal information.

We do not sell personal information for money, and never have. Our analytics tools set cookies that their vendors may use for their own purposes, and California treats that as sharing for cross-context behavioural advertising. Rather than argue about whether it qualifies, we treat it as though it does: you can turn the tools off from our privacy choices control, and we honour Global Privacy Control signals automatically. We do not ask which state you live in before honouring either. We collect no sensitive personal information as that term is defined, so there is nothing to limit.

The categories we collect, and our purposes for each, are in section 3. Every category is collected from you directly, except usage records which are generated by your own API requests. You may exercise these rights through the address in section 9, and you may designate an authorised agent to do so on your behalf.

California also treats information about a household as personal information. Section 4 explains how that reaches our property records and what you can ask us to do about a specific address.

We sell to US businesses, price in US dollars, and our coverage is US property. We do not target the EEA, the UK or Switzerland, and we run no marketing there.

So we do not treat the GDPR or the UK GDPR as applying to us, and that is why the analytics described in section 5 work on an opt-out basis rather than waiting for a consent banner.

None of that is a reason to hold your data differently, so we do not. The lawful basis for each category is named in section 3 because it is useful information whether or not a regulation compels it, and the rights in section 9 — access, correction, deletion, portability, objection — are open to you wherever you live. We do not ask where you are before honouring a request.

Processing takes place in the United States, and edge compute executes at whichever provider location is nearest the request. We do not offer regional data residency. If you need European data residency, a GDPR-backed data processing agreement or Standard Contractual Clauses, say so before you sign rather than after — today the honest answer is that we are not set up for it, and we would rather tell you that early than discover it in a security review.

This is a business product. It is not directed at children, and you must be at least 18 to hold an account. We do not knowingly collect personal information from anyone under 18; if we learn that we have, we delete it.

When we change this policy we update the effective date at the top. If a change materially reduces your rights or materially expands what we collect, we will email account holders before it takes effect rather than relying on you to notice.

The vendor list in section 6 is part of that commitment. A new subprocessor is a change we announce, not one you discover.