Add monetization-readiness checklist (viewer/MONETIZATION-READINESS.md)

02a2dc37dbbe369d3304d2d27a1e4397a6397f91 · 2026-08-11 14:02:32 -0700 · steve
Files touched

A viewer/MONETIZATION-READINESS.md
Diff

commit 02a2dc37dbbe369d3304d2d27a1e4397a6397f91
Author: steve <steve@designerwallcoverings.com>
Date:   Tue Aug 11 14:02:32 2026 -0700

    Add monetization-readiness checklist (viewer/MONETIZATION-READINESS.md)
---
 viewer/MONETIZATION-READINESS.md | 72 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 72 insertions(+)

diff --git a/viewer/MONETIZATION-READINESS.md b/viewer/MONETIZATION-READINESS.md
new file mode 100644
index 0000000..2ef60fb
--- /dev/null
+++ b/viewer/MONETIZATION-READINESS.md
@@ -0,0 +1,72 @@
+# Monetization-Readiness Checklist — buildingpermits.agentabrams.com
+
+Status: **free public viewer, launch-cleared.** This is the gate list to cross
+*before* charging, gating access, exporting leads, or running ads. Grounded in the
+vp-compliance-policy review (2026-08-11). Nothing here is required for the free viewer.
+
+**The governing principle:** sell **your value-add** (the `lead_score`, the UI, entity
+resolution, enrichment joins), NOT the **raw government feed**. Re-displaying public
+records for free is clean; reselling the raw County/CSLB dataset as "a licensed data
+source" is the specific thing that trips redistribution terms. Keep that line bright.
+
+---
+
+## A. Legal / compliance gates — do BEFORE any paid tier
+
+- [ ] **LA County Assessor eGIS Terms of Use** — read line-by-line for a
+      *commercial-resale / redistribution* restriction on parcel + assessed-value data.
+      This is the real constraint (assessed value/year/sqft is the highest-sensitivity
+      County-sourced field on the site). Terms: https://egis-lacounty.hub.arcgis.com/pages/terms-of-use
+      → If it prohibits resale of derived County data: don't sell the raw feed; sell value-add only.
+- [ ] **LA City Open Data terms** — confirm the commercial-use allowance (generally permits
+      commercial reuse "as is"; verify current version).
+- [ ] **CSLB data** — only if contractor data enters the *product*. The free portal Master
+      file is public but CSLB has redistribution terms; the paid Full File ($235) is the
+      commercial-cleared path. Contractor names/phones in a paid product = re-check terms.
+- [ ] **Terms of Use page** — upgrade `/terms.html` from informational to commercial:
+      add subscription terms, refund policy, SLA/uptime disclaimer, acceptable-use for paid API.
+- [ ] **Privacy Policy** — upgrade `/privacy.html`: the moment you add accounts, forms,
+      email capture, analytics, or ads you are "collecting"/"selling-or-sharing" under CCPA/CPRA.
+      Add a **"Do Not Sell or Share My Personal Information"** link + a real data-inventory section.
+- [ ] **CA data-broker registration** — evaluate if the product does owner-targeting /
+      lead-gen (assembling public records into a targeted-marketing product about identifiable
+      owners is the data-broker fact pattern; CA requires registration + DELETE Act compliance).
+- [ ] **`board.html`** — currently pulled to `viewer/private/`. If it becomes a public sales
+      page, scrub the "resell the raw feed / geo-target owners" language (it's the exact
+      commercial-intent admission a County/CCPA reviewer would cite). Sell the value-add framing.
+
+## B. Product / infrastructure gates
+
+- [ ] **Keyed map tiles** — replace OSM public tiles (light-use only) with MapTiler / Stadia /
+      Mapbox (free tier, needs a key). Required before real traffic *and* before monetizing.
+      One-line swap in `index.html` once the key exists.
+- [ ] **Cloudflare rate-limit** — apply `scripts/apply-ratelimit.sh` with a WAF-scoped token
+      (120 req/min per IP on `/api/`). Protects the DB and keeps tile fan-out sane.
+- [ ] **Accounts / auth** — if tiered access, add real auth (not the shared Basic-auth default).
+      Set `VIEWER_USER`/`VIEWER_PASS` via env; never ship `admin/DW2024!` on a paid instance.
+- [ ] **Payments** — Stripe in **TEST mode first**; live keys + real charges stay gated to Steve.
+- [ ] **API productization** — if selling API access: keys, per-key quotas, usage metering,
+      documented endpoints, and the ToU/DPA that governs redistribution by *your* customers.
+- [ ] **robots.txt posture** — decide crawl policy for a paid product (currently disallows
+      `/api/`, the deck, and `/private/`).
+
+## C. Data-source monetization matrix
+
+| Source | Free viewer | Paid / resale |
+|---|---|---|
+| LA City building permits | ✅ clean | ✅ likely OK (verify LA City commercial clause) |
+| LA County parcels / assessed value | ✅ clean | ⚠️ **gate on eGIS ToU** (resale/redistribution) |
+| CSLB contractors | not on public site | ⚠️ re-check terms; paid Full File is the cleared path |
+| Business registrations | not on public site | ✅ LA City open data |
+| OSM map tiles | ✅ (light use) | ⚠️ keyed provider required |
+| Google Maps deep-links | ✅ clean | ✅ clean (plain links, not the API) |
+| Our `lead_score` / UI / enrichment | ✅ ours | ✅ **this is the thing to sell** |
+
+## D. Suggested first paid shape (lowest-risk)
+Sell **access to the enriched, ranked, filterable interface + exports of OUR value-add
+fields** (lead_score, enrichment joins, saved searches, alerts) — priced as a SaaS
+subscription. Avoid, until ToU-cleared: selling the **raw County/CSLB datasets** as a
+downloadable/licensable feed. This keeps you on your own IP, not the government's data-license.
+
+---
+Owner: vp-dw-commerce / Steve. Revisit the eGIS ToU line at the top before anything ships paid.
← 3ff3d2f Add one-step rate-limit apply script (needs WAF-scoped token · back to La Socrata Ingester · yoloforever c1: LA-data freshness+rowcount canary (baseline- 9a4905f →