Privacy Policy

1. Introduction

Apaluma, Inc. ("the Company," "we," "us," or "our") operates the website apaiuma.com (the "Service"). Apaluma provides an AI-driven document-processing pipeline that ingests county and municipal government document archives (scanned permit files, code violation records, inspection reports, and similar public-record materials in PDF and legacy formats) and converts them into searchable, structured, GIS-joinable data for use by county planning departments, permit expediters, and local-government data teams.

This Privacy Policy explains what information we collect, how we use it, and the choices you have. It applies to information we collect through the Service and through direct communications with you. It also describes how personal information present in customer-supplied document archives is handled when Apaluma processes those archives on behalf of government agency customers.

We are based at 125 Lincoln Avenue, Suite 220, Santa Fe, NM 87501 and can be reached at [email protected].

2. Two Distinct Data Flows

Apaluma's service involves two structurally distinct categories of data collection, and this policy addresses them separately:

2.1 Site Visitor Data

When individuals visit apaiuma.com, fill out a contact form, or subscribe to updates, we collect information they provide directly. This is conventional website data collection described in Sections 3 and 4 below.

2.2 Customer Document Archive Data

When a government agency customer uploads or transmits document archives to Apaluma for processing, those archives typically contain personal information incidentally. County permit files, for example, include property-owner names, applicant contact details, addresses, and sometimes signatures on scanned forms. This personal information was collected by the government agency in its official capacity; Apaluma receives it solely because it is embedded in the archive the agency has submitted for processing.

In this context, the government agency is the data controller and Apaluma acts as a data processor operating under the agency's instructions. We do not use archive contents for any purpose beyond delivering the contracted processing service to that agency. We do not use document archive contents to train machine learning models without explicit written consent from the relevant agency customer. Source document archives are deleted from our processing infrastructure after output delivery; derived structured records are retained according to the terms of the applicable service agreement.

Individuals who believe their personal information appears in a government agency's document archive should direct privacy inquiries to that agency, which controls the underlying records. Apaluma can assist agencies in identifying and, where technically feasible, suppressing specific records at the agency's written instruction.

3. Information We Collect from Site Visitors

3.1 Information You Provide

We collect information you submit directly, including:

• Contact details (name, email, phone) when you fill out a form, request a pilot evaluation, or subscribe to updates;
• Organization information you choose to share (employer, role, county or department name, rough document volume);
• The content of any messages you send us.

3.2 Information Collected Automatically

When you visit apaiuma.com, we automatically collect limited technical information:

• IP address and approximate location (city/region level);
• Browser type, operating system, device class;
• Pages visited, referring URLs, time on page;
• Cookie and similar identifiers (see Section 6).

3.3 We Do Not Knowingly Collect Children's Data

apaiuma.com is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact [email protected] and we will delete it.

4. How We Use Site Visitor Information

We use the information we collect from site visitors to:

• Respond to inquiries and provide information about Apaluma's services;
• Operate, maintain, and improve the Service;
• Evaluate and configure pilot programs for prospective agency customers;
• Send service updates and (with your consent where required) communications about our services;
• Detect, investigate, and prevent fraud or abuse;
• Comply with legal obligations.

We do not sell personal information for monetary value. Where applicable state law treats certain advertising arrangements as a "sale" or "share," see your state's section below.

5. Sharing of Information

We share personal information only with:

• Service providers acting on our behalf (cloud hosting, model inference infrastructure, email delivery) under contractual confidentiality terms. We do not name specific vendors because our sub-processor list may change; current categories are cloud hosting and AI processing infrastructure;
• Authorities, when required by law or to protect rights, safety, or property;
• A successor entity in the event of a merger, acquisition, or asset sale, subject to this Policy.

We do not sell personal information to third parties. Document archive contents submitted by agency customers are not shared with any party other than the processing infrastructure necessary to deliver the contracted output.

6. Cookies and Tracking

We use cookies and similar technologies to operate the site, remember preferences, and measure usage. For details and choices, see our Cookie Policy.

7. Data Retention

For site visitor data: we retain personal information only as long as needed for the purposes described, to comply with legal or accounting obligations, and to resolve disputes. Inactive marketing-list contacts are purged after 24 months. Server access logs are retained 90 days, then aggregated.

For customer document archive data: source archives submitted for processing are deleted from our infrastructure after output delivery, typically within 72 hours of job completion. Derived structured records (the extracted, structured output we deliver to the agency) are retained according to the terms of the applicable service agreement, and in any event for no longer than 36 months from delivery unless the agency instructs otherwise.

We do not use document archive contents to train machine learning models. This position is firm and consistent with our role as a processor acting on agency instructions.

8. Security

We use administrative, technical, and physical safeguards designed to protect personal information, including TLS encryption in transit, restricted-access databases, and least-privilege access controls. Document archives submitted for processing are handled in isolated processing environments. No system is perfectly secure; we cannot guarantee absolute security.

9. Your General Rights

Depending on your jurisdiction, you may have rights including access, correction, deletion, and the ability to limit certain processing. To make a request, email [email protected]. We will respond within the timeframe required by applicable law.

10. New Mexico Residents

New Mexico does not currently have a comprehensive consumer privacy statute. As a matter of policy, we extend the following baseline rights to all U.S. residents regardless of state of residence.

10.1 Baseline Rights

• Right to Know: request the categories of personal information we have collected about you.
• Right to Delete: request deletion of personal information you have provided.
• Right to Correct: request correction of inaccurate personal information.
• Right to Opt Out of Marketing: unsubscribe from marketing emails or opt out via the link in each marketing message.

10.2 How to Exercise

Email [email protected] with a description of your request and enough detail for us to verify your identity. We respond within 45 days.

10.3 Sector-Specific Rights

If you are protected by federal sector laws (e.g., HIPAA, GLBA, FERPA), those laws may give you additional rights with respect to data covered by them. County planning departments and government agencies handling land records operate under additional public-records obligations; Apaluma's role as a processor does not alter those obligations.

10.4 California Visitors

If you are a California resident, you may also exercise the rights granted under the California Consumer Privacy Act ("CCPA") and California Privacy Rights Act ("CPRA"), including the right to know, the right to delete, the right to correct, and the right to opt out of sale or sharing. We do not sell personal information and do not "share" personal information for cross-context behavioral advertising.

To submit a CCPA / CPRA request, email [email protected] with the subject line "California Privacy Request."

11. Changes to This Policy

We may update this Policy from time to time. Material changes will be reflected by a new "Last updated" date and, where appropriate, a notice on the Service.

12. Contact

Questions, requests, or complaints can be sent to: