Privacy Policy
Last updated: September 23, 2026
TradeProof provides contractor license information and tools for managing contractor compliance. This notice explains personal information used by our website, accounts, API, and connected services. Our launch market is the United States.
Make a privacy request or email [email protected]. You do not need a TradeProof account.
Information we use
| Information | Where it comes from | Why we use it |
|---|---|---|
| Account and organization details | You, your organization, and our sign-in provider: name, email, account identifiers, organization membership, role, and notification choices. | Sign-in, access control, organization administration, and requested communications. |
| Billing and subscription records | You and Stripe: customer and subscription identifiers, plan, payment status, invoices, and billing contact details. | Take payment, manage subscriptions, resolve billing issues, and keep accounting records. Payment card entry takes place on Stripe's hosted pages. |
| Work and support information | You and authorized organization members: watchlists, contacts, insurance documents, claims, training assignments and progress, notes, support messages, and other submitted content. | Provide the features you use, collaborate within an organization, and respond to requests. |
| Contractor and license records | Government licensing sources and information supplied by customers or contractors: business and professional details, license identifiers, status, source dates, insurance information, and associated records. | Search, display source information, monitor selected records, and prepare compliance summaries. Availability varies by source; see Coverage. |
| Service, security, and usage records | Your browser, API requests, and our systems: network and request information, timestamps, authentication and audit events, usage counters, and optional product events where enabled. | Operate and secure the service, investigate failures and abuse, enforce usage limits, and understand feature use. |
Please provide only information needed for the feature or request. Do not put passwords, sign-in links, payment card details, Social Security numbers, or unrelated sensitive information in notes, searches, support messages, or uploaded documents.
Public records and derived information
Some information lawfully available from government records is excluded from personal information under particular privacy laws. That does not make account details, private uploads, or every derived result public information. We assess a request against the information involved and the applicable law.
Search match indicators and compliance summaries organize source information. They are not a government determination or a guarantee of a contractor's qualifications. You can ask about a result or report an error even if you are not a customer. We can review information held by TradeProof; we cannot change the originating government record. We will explain when a correction also needs to be made with the source agency.
Who receives information
- Your organization: authorized members and administrators can access shared work information according to their permissions. Information published in a public profile can be viewed by its audience.
- Service providers: providers for hosting, storage, sign-in, network protection, payments, email delivery, and support receive information needed for their services. These include Google Cloud, Cloudflare, Stripe, and Resend. Provider services may involve their own security, payment, or legal obligations.
- Connections you choose: configured webhooks and external integrations receive the information requested or routed through them. An AI platform you choose can receive your tool requests and the returned results. Its handling of prompts and results is governed by your relationship with that provider; enabling a connection does not by itself make it TradeProof's contracted processor.
- Legal and business needs: we may disclose information when required by law or reasonably necessary to address security, fraud, disputes, or a business transfer, subject to applicable restrictions.
We do not sell personal information or share it for cross-context behavioral advertising. Our paid contractor-information service and each source of information must still be assessed under the applicable definitions; a public-record label does not remove rights in other personal information.
Cookies and privacy choices
We use cookies and browser storage for sign-in and interface preferences. Our Cookie & Browser Storage Policy explains them. Optional product telemetry is off unless enabled for the deployment. The browser telemetry code stops sending when Global Privacy Control is enabled. This does not disable security, authentication, billing, or operational records needed to run the service.
We do not use the older Do Not Track browser signal as a separate switch. External sites or platforms you open, including hosted payment and connected AI services, apply their own policies and settings. For a privacy choice that is not available in your account, contact us.
Retention and deletion
Retention depends on the information and purpose:
- Account and organization information supports active access and administration. When you request deletion, we review the personal information involved and any information still needed for another authorized member's work, security, or a legal obligation.
- Work records and uploaded documents support the organization's use of the service. A request concerning another person's information or shared business records requires a review of that person's rights and the organization's instructions.
- Billing records support transactions, accounting, and disputes. Applicable legal obligations can require keeping particular records after service ends.
- Operational and security records support incident investigation, access accountability, and usage enforcement. Their purpose and ongoing need must be considered separately from account availability.
- Privacy-request records document receipt, handling, and the response. They are used for request handling and compliance, with retention based on applicable recordkeeping requirements.
Disabling an account or organization does not itself erase personal information. A deletion request receives a separate review. We will explain relevant exceptions and the treatment of retained records, backups, and information held by service providers.
Your requests and choices
Depending on the applicable law and circumstances, you may have rights to access or obtain a copy, correct or delete information, opt out of particular processing, limit certain sensitive-information uses, or appeal a response. We do not require you to create an account to contact us. You can also use an authorized agent.
Use Privacy requests or email [email protected]. Describe the request and provide a way to reply. A state of residence and a link or description of the relevant record can help us route the request. Do not send identity documents in your initial message.
Before disclosing or changing personal information, we may use existing information or request the minimum additional information appropriate to verify the request. We do not apply that verification gate to an opt-out where the applicable law forbids it. We explain a refusal or partial response and available appeal steps. Response deadlines and permitted extensions depend on the applicable law; verification does not restart the receipt date.
We will not unlawfully discriminate against you for exercising privacy rights. California residents can read the California privacy notice. Account email preferences are in My account; alert timing and channels are in Notifications. Essential sign-in, security, and billing messages are separate from optional notifications.
Security, location, and children
We use HTTPS, authenticated access, organization permissions, and restricted service access to help protect information. The GCP sign-in flow uses email links through Google Identity Platform. No security control eliminates every risk.
A United States launch does not mean every provider performs every support or processing activity exclusively in the United States. Provider terms, configurations, and the particular service determine where processing occurs.
TradeProof is intended for adult business users, not children. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.
Changes and contact
We will update this page and its date when this policy changes and provide additional notice or obtain consent when required. Reading or using the website is not consent to unrelated processing.
For questions about this policy or your personal information, email [email protected].