Tradeforce Pros — Privacy Policy

DRAFT — PENDING ATTORNEY REVIEW. NOT LEGAL ADVICE. Drafted by an AI legal researcher under founder rulings R-251 item 10 and R-252 items 3 and 6. Every statement about what the software does was checked against the code on 2026-10-17 (see the data map at the end). Bracketed items [LIKE THIS] must be completed, and the drafting notes removed, before publication. Under R-252 item 6 (J7), this policy must never promise anything the software does not do — re-check the data map against the code before each new version.

Version: 0.3-draft · Effective date: [EFFECTIVE DATE] · Last updated: 2026-10-25

1. Who we are and what this policy covers

[Tradeforce Pros, LLC] ("Tradeforce Pros," "we," "us") provides Tradeforce Pros, a customer-relationship and proposal software service for commercial HVAC and other trade contractors (the "Service"). Contact: [privacy@tradeforcepros.com], [MAILING ADDRESS].

This policy covers personal information we handle for our own purposes:

people who use the Service on behalf of one of our customers ("Users") — owners, managers, sales reps and other staff of a contractor;
our customers' billing contacts;
people who contact us or visit our legal and sign-in pages.

This policy does not cover the data our customers put into the Service about their own customers — the accounts, sites, contacts, proposals and documents a contractor creates ("Customer Data"). For that data, the contractor decides what is collected and why, and we process it only on the contractor's behalf, under our Terms of Service and Data Processing Addendum. If you are a customer or contact of one of our customers and have a question about your information, please contact that contractor directly. If you contact us, we will forward your request to the contractor (Section 9.4).

The Service is for businesses. It is not directed to consumers or to children (Section 12).

2. Summary

We collect what we need to run a secure business application: your name, work email, optional phone and job title, your login and security records (including IP address and browser), and your company's billing status.
We do not sell personal information, do not share it for targeted advertising, and use no advertising or analytics cookies or trackers.
We never receive or store card numbers. Stripe handles payments.
By design, records are archived rather than deleted so your company keeps a complete history. Some security records are cleaned up on a schedule; personal information can be erased on request through the process in Section 8.
Data is stored in the United States.

3. Information we collect

3.1 Account and profile information (from you or your company)

When your company's Owner sets up the account, or you accept an invitation: first and last name, work email address, and — if provided — phone number, job title and time zone; your role in your company (for example Owner, Manager or Rep), whether you have administrator rights, who your manager is, and settings your company assigns to you (for example approval limits and commission percentage); and your personal display preferences in the app (for example list views, sort order and sidebar state).

To keep accounts secure we record:

Password — stored only as a one-way argon2id hash; we cannot read your password.
Two-factor authentication (2FA) — if you use 2FA (mandatory for administrators), the authenticator secret is stored encrypted, your recovery codes are stored only as one-way hashes, and we record the last code step used (to stop a code being replayed). We do not use SMS for 2FA.
Sessions — for each signed-in session: the IP address, the browser user-agent string (from which we show you, for example, "Chrome on macOS"), when it was created and last active, when it expires or was signed out, and a hash of its refresh token. You can see your own active sessions on your Security page.
Sign-in attempts — the email address entered, the IP address, the time, and whether it succeeded. These records also serve as our rate-limit counters (for example to lock out repeated failed sign-ins and to limit address lookups), and some counters contain internal user or company identifiers.
Password-reset and invitation links — the email address, a hash of the one-time link, and when it expires and was used.
Breached-password check — when you choose a password, we check it against a public list of breached passwords using a privacy-preserving method: only the first five characters of a one-way hash of the password leave our servers. Your password, its full hash and your email are never sent (Section 6.2).

We do not use device fingerprinting and do not collect precise location. We derive nothing from your IP address beyond showing it to you and using it for security.

3.3 Activity within the Service (audit trail)

The Service keeps an edit log of changes to your company's records — who (by user identifier) changed which field, from what value to what value, and when — plus notifications about activity relevant to you (for example an approval request), and approval comments. The edit log does not record IP addresses or browser information. Because it records before-and-after values, it can contain any information that was edited, including personal information.

3.4 Company and billing information

Your company's name, address, phone, email, website, logo and brand colors; its subscription plan, billing interval, price and status; and the identifiers Stripe gives us for your company's customer record, subscription and checkout session, plus the status of recent payments. Card numbers, expiry dates and security codes are entered directly with Stripe and never reach our systems. Stripe's handling of payment information is governed by its own privacy policy (https://stripe.com/privacy). We keep only a record that a Stripe event was processed (its identifier and time), not the event's contents.

3.5 Address lookups

When you start typing an address, the Service sends the typed text to Google's Places service from our server, to suggest matching addresses, and then requests the selected place's address details. We do not send your name, email, IP address or cookies to Google with these requests. We count lookups to enforce usage limits but do not keep a log of what was typed.

3.6 Emails we send

We send account and security emails — invitations, sign-up links, password resets, subscription checkout links and security alerts — through our email provider. The provider receives the recipient's name and email address and the message (which contains a one-time link; we never email passwords). Messages waiting to be sent sit briefly in our job queue, which holds the recipient's email address. Our email provider keeps its own delivery logs under its policies.

3.7 Error and diagnostic information

When our servers or background jobs fail, we may send an error report to our error-monitoring provider. Reports are filtered by an allow-list before they leave our servers: request bodies, headers, cookies, email addresses, tokens, user details and database values are removed. A report may include a company identifier for a failed background job. We do not record your screen or sessions ("session replay") and do not run performance tracing in your browser.

3.8 Information imported on your company's behalf

If your company asks us to, our staff may import your company's users, accounts, sites and contacts from a spreadsheet your company provides. Our system reads the spreadsheet in memory to create the records and does not store it.

We may use an AI tool to format that data. If your company agrees to it on its Order Form, our staff may use an AI tool, Anthropic's Claude, to put the data your company gives us for onboarding (lists of its customers, sites, contacts and users) into our import template. The data is sent to Anthropic for that purpose only. We have switched off the use of this data to train Anthropic's models, and Anthropic keeps it under its own retention terms. Anthropic is listed on our Subprocessor List. A person at Tradeforce checks the result before anything is imported.

The product itself does not use artificial intelligence on your data. If we add an AI-assisted feature, we will update this policy and our Subprocessor List first, and will not let any AI provider train its models on your data (Terms §3.9).

3.9 When you contact us

If you email us, we keep the message and our reply, and any information you include.

When you visit our sign-in or legal pages, our hosting provider processes standard request information (IP address, browser, the page requested, and time) to deliver the page and protect against abuse, and may keep it in short-term server logs. Our separate marketing website at tradeforcepros.com is [FOUNDER TO CONFIRM: describe any forms or analytics on the GoDaddy-hosted site, or state that it collects nothing].

3.11 What we do not collect

We do not knowingly collect Social Security numbers, driver's-license or other government ID numbers, financial-account or card numbers, health information, biometric information, or precise geolocation, and the Service is not designed to hold them (see our Acceptable Use Policy).

4. How we use information

We use personal information to:

Provide the Service — create and manage accounts, sign you in, apply your company's roles and permissions, show your activity and notifications, and generate documents.
Keep it secure — authenticate you, enforce 2FA, detect and block suspicious sign-ins and abuse, rate-limit requests, let you see and end your own sessions, alert our administrator to administrator sign-ins, and investigate incidents.
Bill — set up and manage your company's subscription through Stripe.
Communicate — send the account and security emails described in Section 3.6, and respond to you.
Maintain and improve — diagnose errors, and understand usage in aggregated form.
Comply with law and protect rights — meet legal obligations, respond to valid legal process, enforce our terms, and defend claims.

We do not use personal information for advertising, do not sell it, do not use it for automated decisions that produce legal or similarly significant effects, and do not use Customer Data for our own marketing.

We send only service and account emails. If we ever send marketing email, it will identify itself, include our postal address, and include a working unsubscribe link that we honor within ten business days, as the CAN-SPAM Act requires. You cannot opt out of essential account and security emails while you have an account.

5. Cookies and browser storage

We use only strictly necessary cookies to keep you signed in securely, plus one short-lived technical marker. We use no analytics, advertising or tracking cookies, pixels or third-party scripts. See the full list in our Cookie Notice.

Do Not Track and Global Privacy Control. Because we do not track you across websites or allow third parties to do so, and do not sell or share personal information for advertising, there is nothing for a Do Not Track or Global Privacy Control signal to switch off. We do not change our practices in response to those signals.

6.1 Service providers (subprocessors)

We share personal information with the providers that host and operate the Service for us, under contracts that limit their use of it to providing services to us. They are listed, with what each does and where, on our Subprocessor List: database hosting (Neon), application hosting (Vercel), background-job hosting (Railway), file storage (Amazon Web Services), payments (Stripe), email (Resend), address suggestions (Google) and error monitoring (Sentry).

Our staff also use Anthropic's Claude, an AI tool, to format the onboarding data your company provides (section 3.8). Model training on that data is switched off. Anthropic is also listed on our Subprocessor List.

6.2 Other recipients

Breached-password check (Have I Been Pwned's Pwned Passwords service) receives only five characters of a password hash and our server's IP address — no personal information.
Within your company. Information you enter, and your activity in the edit log, is visible to other Users in your company according to the roles and permissions your company configures. Your company's Owners and administrators can see your profile and manage your account.
Our administrator. Tradeforce Pros' system administrator can access accounts to provide support, run imports, manage billing status and investigate problems. Such access is limited to that purpose.

6.3 Legal requests

We disclose information if we believe in good faith that the law, a subpoena, court order or other valid legal process requires it, or to protect the safety of any person. For requests about a customer's data, we will refer the requester to the customer where we can, notify the customer before disclosing unless the law or a court order forbids it or there is an emergency, may challenge requests we believe are invalid or overbroad, and disclose only what is required. We do not voluntarily give data to law enforcement without valid legal process, except in an emergency involving danger of death or serious physical injury.

6.4 Business transfers

If Tradeforce Pros is involved in a merger, acquisition, financing, reorganization or sale of assets, personal information may be transferred as part of that transaction, subject to this policy's protections. We will notify customers before their information becomes subject to a different privacy policy.

6.5 With your permission

We share information in other ways only with your direction or consent.

We do not sell personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined in California law. We have not done so in the past twelve months.

7. Retention — how long we keep information

Our design principle is archive, never delete: what your company creates is kept so that its history and audit trail stay complete. The table below states what the software actually does today.

Information	How long we keep it
Your user account and profile	For as long as your company's account exists. When your company deactivates you, your account is disabled and you can no longer sign in, but the record is kept so your company's history (who created or changed what) stays accurate. It can be erased on request (Section 8).
Your company's records, proposals, generated documents, approval comments and the edit log	For as long as your company's account exists and afterwards as described in our Terms §12.7 — archived, not deleted, until erased on request. If your company asks us to delete its account, we hold the request for 30 days, during which your company keeps working normally and the request can be cancelled; after that, our founder permanently removes your company's data. We send your company an export of its data on request.
Records of sign-in attempts and rate-limit counters	Kept until our scheduled cleanup is switched on, which will delete them after 365 days; we will update this policy when it is.
Spent refresh-token records; records of processed payment events	Kept until our scheduled cleanup is switched on, which will delete them after 30 days.
In-app notifications	Kept until our scheduled cleanup is switched on, which will delete them 365 days after the last activity.
Session records (including IP address and browser)	Kept for as long as your account exists; ended sessions are marked ended, not removed.
Password-reset and invitation link records	Kept for as long as your account exists; each link expires and cannot be reused.
Emails waiting in our job queue	Kept in our database's job queue after sending for the queue software's default archive period. `[FOUNDER/ENGINEER TO CONFIRM the pg-boss retention defaults, or configure an explicit window, before publication.]`
Error reports	Kept by our error-monitoring provider for its retention period `[CONFIRM plan retention, typically 30–90 days]`.
Billing and tax records about your company	At least seven years, to meet tax and accounting obligations.
Records of acceptance of our Terms and policies	For the life of your company's account and as long afterwards as needed as legal evidence.
Backups	Our database provider keeps point-in-time recovery copies that roll off automatically after its recovery window `[CONFIRM the Neon history window]`. We do not restore erased data from backups except to recover from a disaster, and then re-apply erasures.
Server request logs at our hosting provider	For the provider's short log-retention period `[CONFIRM Vercel plan log retention]`.

8. Erasure

You may ask us to erase personal information about you (Section 9). Because of our archive design, erasure is done by our system administrator by hand, on a verified request, and every erasure is logged. When we erase your information we will delete or permanently de-identify it in our live database (for example replacing your name and email in the edit log with a neutral placeholder so your company's history remains consistent) [FOUNDER/ENGINEER TO CONFIRM the procedure in the erasure runbook — plan slice L5 / ruling J11 — before publication]. Some information may remain:

in backups, until they roll off (Section 7);
in generated documents stored for your company (for example a proposal PDF naming you as the sales rep), which are your company's business records — we will erase them at your company's direction [FOUNDER/ENGINEER TO CONFIRM: the app has no S3 delete path today; the runbook must cover removing stored documents, or this sentence must say documents are not erased];
where we must keep it to comply with law, resolve disputes, prevent fraud, or enforce our agreements, or as a record of your acceptance of our terms.

If you leave your company, your company — not you — controls the business records you created. Your company should deactivate your account. You may still ask us to erase or correct your personal profile information; where erasure would remove information your company needs as a business record, we will tell your company and, where the law allows, follow its instructions about its records.

9. Your choices and rights

9.1 What you can do yourself

You can view and update your profile, change your password, set up 2FA, and see and end your own active sessions in the app.

9.2 Requests to us

Wherever you live, you may ask us to:

tell you what personal information we hold about you and give you a copy;
correct inaccurate information;
erase your information (Section 8);
tell you how we have used and shared it.

We will respond within 45 days and will tell you if we need more time (up to a further 45 days) and why. We do not charge for requests and will not treat you differently for making one.

9.3 Verification

To protect you, we verify requests — normally by asking you to confirm the request from the email address on your account and, for administrators, by 2FA. We may refuse a request we cannot verify, that is manifestly unfounded or excessive, or where the law allows or requires us to refuse (for example information we must keep). An authorized agent may make a request with your signed permission, and we may verify your identity directly with you.

9.4 Requests about Customer Data

If you are a customer or contact of one of our customers, your information is controlled by that contractor. Please contact the contractor. If you contact us, we will forward your request to the contractor (if we can identify it) within ten business days and assist the contractor as our agreement with it requires; we will not act on Customer Data without the contractor's instruction except where the law requires.

9.5 State privacy laws

Several U.S. states (including California, Virginia, Colorado, Connecticut, Texas and Oregon) give residents privacy rights against businesses that meet their size or data thresholds. Based on our size and the business nature of our Service, we believe we do not currently meet those thresholds, and most of those laws do not apply to information about people acting in a business or employment role. We nonetheless offer the rights in Section 9.2 to everyone. If a law applies to us in the future, we will honor it and update this policy. California residents: we do not sell or share personal information, do not use or disclose sensitive personal information for purposes that would require a right to limit, and do not offer financial incentives for personal information. If you disagree with our response to a request, you may contact us to appeal, and we will respond within 60 days; you may also contact your state attorney general.

10. Security

We protect information with measures including: encryption in transit (HTTPS) for every connection; isolation of each company's data enforced in the database itself, not only in our application [CONFIRM: true in production only after the NOBYPASSRLS role cutover, CF-5 / CF-12 — do not publish this phrase before then]; passwords stored only as argon2id hashes; encrypted 2FA secrets; mandatory 2FA for administrators; short-lived sign-in tokens that are replaced on every use, with reuse of an old token treated as a compromise and the session ended; automatic sign-out after inactivity (your company sets the period, 5 to 60 minutes); lockouts after repeated failed sign-ins; private document storage reachable only through short-lived signed links; and a complete edit log. Our providers encrypt stored data at rest [CONFIRM for Neon and S3 — both encrypt at rest by default (U)].

No method of transmission or storage is completely secure, and we cannot guarantee that information will never be accessed, used or disclosed without authorization. If we learn of a security breach affecting your personal information, we will notify you and, where required, regulators, as the law requires — and, for Customer Data, we will notify the affected customer as our Data Processing Addendum provides so that it can notify its own customers.

You help by keeping your password private, using 2FA, signing out on shared computers, and telling us at [security@tradeforcepros.com] if you suspect a problem.

11. Where we process information

We are based in the United States, and our Service is hosted and our providers store data in the United States. The Service is intended for businesses in the United States and is not directed to people in the European Union, the United Kingdom or elsewhere outside the U.S.

12. Children

The Service is for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, contact us and we will delete it.

13. Changes to this policy

We will post any change here with a new version number and effective date, and keep past versions available on our legal page. If a change materially expands how we use or share personal information already collected, we will notify account Owners by email at least 30 days before it takes effect, and show a notice in the app.

14. Contact

[Tradeforce Pros, LLC] · [MAILING ADDRESS] · Privacy questions and requests: [privacy@tradeforcepros.com] · Security concerns: [security@tradeforcepros.com]