Privacy Policy

1. Who we are

Three companies are involved in delivering this service, and they do different things with your information. Knowing which is which is the key to the rest of this policy.

Throughout this policy, “we” means mesystems inc unless the sentence is specifically about the private provider's work. The software-as-a-service operation and the primary business are carried out from Florida, even where the computers that run the software sit somewhere else.

Postal address for mesystems inc:

2. Who this policy covers

Three different groups of people have information in this system, and they arrive by very different routes.

• Contractors and their staff — people who create an account, sign in, and prepare permit applications. They chose to be here and accepted the Terms of Use.
• Property owners — people whose home or building is the subject of a permit application. They did not sign up, and in most cases they have never visited this website. Their information reaches us because the law requires the owner to be told that a private provider, rather than the building department, will do the review. Section 4 is about them specifically.
• Anyone who writes to us — if you send us an email, we have your email address and whatever you put in the message.

3. What we collect, and why

We collect what the permit process actually needs. Each item below says why it is there, because “we collect information to improve our services” tells you nothing.

Your account

• Name, business email address, and telephone number — to identify you and to send you notices about your permits.
• A password, which is stored only as a scrambled value that cannot be turned back into your password.
• Two security questions and their answers, also stored scrambled, used only to recover an account.
• If you switch on two-factor sign-in, the secret your authenticator app uses and a set of one-time recovery codes.
• A record of failed sign-in attempts and whether the account is temporarily locked — this is how the system stops someone guessing your password.
• The date you accepted the Terms of Use, and which version you accepted.

Your license and your insurance

Florida law does not let an unlicensed or uninsured contractor pull a permit, so the system checks both before it will accept work from you.

• Your contractor license number, the qualifier's name, the business address on the license, and the expiry date. Most of this is read from the public license register published by the Florida Department of Business and Professional Regulation — we look your number up rather than take your word for it.
• The license document you upload, kept as the evidence for why access was granted or restored.
• Your certificate of insurance, and the carrier names, policy numbers and coverage dates read from it. General liability and workers' compensation are recorded separately because the rules differ for each.

The permit application itself

• The job address, the municipality, and the county parcel identification number — known in Florida as the folio number.
• The roof system, the products chosen, the measurements you enter, and the calculations the system performs from them.
• Documents you upload: roof plans, product approvals, affidavits, and anything else the submittal requires.
• Messages between you and the reviewer. These are kept as a permanent record of the review and are never edited or deleted — including who wrote each one, recorded at the time it was written.

Payment

We record what a permit was charged, when, and whether it was paid or refunded. We never receive, see, or store card numbers or security codes. Card payments are processed by Stripe, a separate payment company, under its own privacy policy. The card form on the payment page is provided by Stripe, and the card details you enter go directly to Stripe rather than to us. We receive confirmation that the payment succeeded, not the card details.

Technical records

Our servers keep ordinary operational logs — the address a request came from, what was requested, and whether it succeeded. These exist so that faults can be diagnosed and abuse can be detected. Actions taken by our administrators inside the system are recorded in a separate audit log, so that a change to your account can always be traced to whoever made it.

4. Property owners specifically

This is the part of the policy that matters most, and it is the part a general software privacy policy would get wrong.

When a contractor uses a private provider instead of the building department, Section 553.791, Florida Statutes, requires the property owner to be given a written notice saying so, and requires the owner to sign it. That notice is not optional and it is not something the owner asked for. To deliver and record it, the system holds:

• the owner's name, the property address, and — where the owner is a company — the company name and the signer's role;
• the owner's email address and, where given, telephone number, used to send the notice and a copy of what they signed;
• the owner's signature on the notice;
• and, at the moment of signing, the internet address (IP address) and browser identification (user agent) of the device used, together with the times the signing link was issued and used.

That last item deserves an explanation rather than a footnote. Florida's Uniform Electronic Transactions Act, Section 668.50, Florida Statutes, treats an electronic signature as valid only if it can be shown to be the act of the person who made it. A typed name on its own is weak evidence. The internet address, the browser identification and the timestamps are what make the owner's signature stand up later — they are collected as proof of signing and for no other purpose. They are not used to profile the owner, to advertise to them, or to track them anywhere else.

A copy of the signed notice is sent to the owner as a matter of course, so that the person whose property it is holds the same record we do.

For property owners, mesystems inc and the private provider are controllers, not processors. The owner has no account and uploads nothing; the information is collected about them, from the contractor and from public county records, because the law requires the notice to exist. If you are a property owner and want to know what is held about you, Section 15 tells you how to ask.

5. Inspection photographs

Where a contractor elects private provider inspections, an employee attends the property and records the work. This means a camera at somebody's home, so the rules are set out in full.

• Photographs are kept. One photograph is taken for each item being inspected, and each is stored with the time it was taken and the location coordinates of the device at the moment of capture. The location is recorded to prove that the employee was actually at the property — an inspection record that cannot show this is worth little.
• Video is not kept. Where an inspection is carried out as a live two-way call, the video is for watching at the time only. It is purged when the visit completes and is never retained as part of the record.
• The live call runs through our own connection service. The audio and video travel directly between the two devices wherever the network allows. Where a direct connection is not possible, they pass through an encrypted relay server that forwards them without recording or keeping them.
• Documents the contractor transmits for an inspection — affidavits and required forms — are kept with the inspection record.
• Each photograph records which employee captured it and whether the inspector accepted it or asked for more.

6. Where information goes

Information leaves this system in a small number of defined directions, listed here in full.

That is the complete list. Information is not shared with anyone else.

7. What we do not do

• We do not sell information about you. Not to data brokers, not to lead generators, not to anyone.
• We do not use your information to advertise to you, and we do not pass it to anyone who will.
• We do not run advertising or analytics trackers on this website. There are no third-party tracking scripts and no advertising cookies. The only cookies and stored values the site uses are the ones that keep you signed in and remember your place in an application, and, on the payment page only, the cookies Stripe's card form uses to prevent fraud.
• We do not store card numbers or security codes.
• We do not retain inspection video.
• We do not read the contents of your permit applications for any purpose other than performing the review, supporting you when you ask, and keeping the system working and secure.

8. How long we keep it

Retention here is not a marketing choice; a permit record is a legal record, and a private provider is required to be able to produce it.

9. Public records

We cannot recall a filed package, and we cannot cause a building department to delete one. Anyone may be able to obtain a copy of it from that department. If you want a public record restricted or exempted, that request has to be made to the government body holding it — we can tell you which department received the filing.

The same is true of the contractor license register: license numbers, qualifier names and business addresses are published by the State of Florida, and are public regardless of anything we do.

10. Your choices and requests

You can ask us to do the following, and we will do them.

• Tell you what we hold about you. Contractors and property owners alike may ask, and we will describe what is held and where it came from.
• Correct something that is wrong. If a name, address or contact detail is incorrect, tell us and we will fix it. A correction to a permit that has already been reviewed is recorded as a correction rather than by overwriting the original, because the original is the record of what was reviewed.
• Close your account and delete your account information. This removes your login, your name, your contact details, your password and your security answers from the live system.
• Stop sending you email that is not required for a permit already in progress.

Requests go to info@mepermit.com. We may need to confirm who you are before answering, particularly where the request concerns a property.

11. How we protect information

• The website and everything sent to it travels over an encrypted connection.
• Passwords and security answers are stored scrambled, in a form that cannot be reversed.
• Two-factor sign-in is available, and is required for administrative accounts.
• Accounts lock themselves after repeated failed sign-in attempts.
• Every contractor sees only their own permits; the checks that enforce this run on the server, where they cannot be bypassed from a browser.
• Administrative actions are written to an audit log that identifies who did what.
• Uploaded documents are stored with a fingerprint that allows any later alteration to be detected.

No system is beyond compromise. If a breach occurred that affected your information, we would tell you and would notify the authorities Florida law requires us to notify.

12. Where the service is offered

mEPermit serves the Florida permitting process and is intended for users in the United States. It is not offered to users in the European Union or the European Economic Area, and it is not designed to meet the requirements that apply there. If you are located in the European Union or the European Economic Area, please do not use this service or submit information to us.

Information is held on servers in the United States and is handled under United States and Florida law.

13. Children

This is a service for licensed contractors. It is not directed at children, and we do not knowingly collect information from anyone under 18. If we learn that we have, we will delete it.

14. Changes to this policy

If this policy changes, the version number and effective date at the top of the page change with it. Where a change materially affects how information about you is handled, we will tell account holders by email rather than relying on you to notice.

15. How to reach us

Questions about this policy, requests about your information, or a concern about a property:

• Email — info@mepermit.com (please put "Privacy" in the subject line)

Or by post: