Privacy Policy

1. Introduction

TradeSite LLC, a Wyoming limited liability company (“TradeSite,” “we,” “us,” or “our”), operates an AI-powered software-as-a-service (“SaaS”) platform that generates professional websites for contractors, tradespeople, and small businesses. Payments are collected through Stripe by Nected, our Netherlands-based billing affiliate, on behalf of TradeSite LLC. Our services are available at tradesite.ai (the “Websites” or “Platform”).

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our Websites, use our services, or interact with us in any way. Please read this Privacy Policy carefully. By accessing or using any part of our Platform, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please discontinue use of the Platform immediately.

2. Information We Collect

We collect information in several ways depending on how you interact with our Platform. Below is a comprehensive description of each category of data we collect.

2.1 Information You Provide Directly (Quiz & Onboarding Data)

When you use our website-building quiz funnel, you voluntarily provide us with the following information:

• Business Information: business name, trade or niche (e.g., roofing, plumbing, concrete), services offered, target customer description/avatar, main city, additional service locations, and service radius.
• Branding & Style Preferences: branding status (e.g., have a logo, need a logo), style or vibe preferences (e.g., modern, bold, clean), custom color selections, and brand style notes.
• Marketing Preferences: preferred call-to-actions, financing preference information.
• Contact Information: your full name, email address, and phone number.
• Owner Photo: if you choose to upload a photo of yourself, we collect that image. Photos are processed on your device and transmitted to our servers.
• Existing Website URL: if you provide the URL of your existing website, we use it during our research phase (see Section 2.2 below).

2.2 Information We Collect Through Automated Research

With your consent (confirmed through our Verification UI), our systems automatically gather publicly available information about your business from the following sources:

• Website Scraping: if you provide an existing website URL, we scrape its publicly accessible content (text, images, metadata) to inform website generation.
• Google Business Profile (GBP): we may collect publicly available data from your Google Business Profile, including business photos, customer reviews, business hours, business description, and other publicly listed information.
• Scraped Images: images found on your existing website and Google Business Profile are downloaded, stored, and analyzed to select appropriate visual content for your generated website.

2.3 Account & Authentication Information

• OTP Verification: when you log in to your client portal, we send a one-time password (OTP) to your phone number (via SMS) or email address. We store your phone number and email address for authentication purposes.
• Portal User Data: if you create or access a client portal account, we store your user profile, linked generated websites, and portal activity.

2.4 Payment Information

When you purchase a paid plan, your payment is processed by Stripe. We do not directly collect, store, or process your credit card number, debit card number, or bank account details. Stripe handles all payment card data in compliance with PCI-DSS standards. We receive from Stripe a confirmation of payment, your billing name, email, and a tokenized payment reference.

2.5 Automatically Collected Information

When you access our Platform, we automatically collect certain information, including:

• Device & Browser Information: IP address, browser type and version, operating system, device type, screen resolution, and language preferences.
• Usage Data: pages visited, time spent on pages, referring URL, click patterns, quiz completion progress, and other interaction data.
• Cookies & Similar Technologies: we use cookies, web beacons, and pixel tags to collect browsing information. See Section 6 (Cookies & Tracking Technologies) for full details.

2.6 AI-Generated and AI-Processed Data

• AI-Generated Website Content: based on the data you provide and our research, our AI systems generate website copy, page structures, and design configurations. This generated content is stored as part of your build job.
• AI Image Analysis Results: our AI analyzes scraped and uploaded images to determine quality, suitability, and optimal placement. The analysis metadata (scores, labels, descriptions) is stored alongside the images.
• AI-Generated Images: when insufficient images are available from scraping, our AI generates fallback images. These AI-generated images are stored in our systems and deployed with your website.

2.7 Phone Interview & Call Data

If you request a website preview through one of our interview-based signup forms, you may consent to receive a short phone interview conducted by our AI assistant. When you participate in such a call, we collect:

• Call Recordings: with your prior consent, the interview call is recorded. Recording is disclosed at the start of every call. Recordings are kept only temporarily and are automatically deleted within 30 days of the call (see Section 10).
• Call Transcripts: a text transcript of the conversation is generated and stored.
• Interview Content: the information you share during the interview about your business, such as your business history, services, work processes, licenses, certifications, and how you prefer to work with customers.
• Call Metadata: the phone number called, call time and duration, and call outcome (e.g., answered, voicemail, no answer).
• AI-Derived Summaries: automated summaries and categorizations derived from the transcript (for example, how you currently find customers and how soon you want your website live), used to build your website and to tailor our follow-up with you.

Participation in a phone interview is always based on a form you submit that requests the call. Where available, we may offer you the option to complete the interview by text message instead of by phone, and you can decline further calls at any time (see Section 7.5).

2.8 Google Account Connection (Google Ads)

If you purchase our managed Google Ads service, we ask you to connect your own Google Ads account by signing in with Google. This connection is optional, you always start it yourself from your setup page, and you can skip it by giving us your Google Ads customer ID instead.

• What we ask for: the Google Ads permission only (https://www.googleapis.com/auth/adwords). We request no other Google permissions during this sign-in.
• What we read: the list of Google Ads accounts your Google login can reach, and for the account you choose, its name, currency, status, whether our manager account is linked to it, and whether Google has a valid payment method on it. We do not read your Gmail, Drive, contacts, or any other Google service.
• What we change: with your consent we accept the manager-account link invitation we send to your Google Ads account, so that you do not have to accept it yourself, and we switch on auto-tagging so clicks on your ads can be matched to the leads they produce. After that we create and manage the advertising campaigns you are paying us to run. Campaigns are always created paused and are only switched on after a review.
• What we store: an encrypted Google refresh token, the ID of the Google Ads account you chose, and the times at which each step happened. Tokens are encrypted at rest in our database and are never written to logs.
• What we never do: we do not sell, rent, or share your Google account data with third parties, we do not use it to advertise to you, and we do not use it to train AI models.
• How you disconnect: you can withdraw our access at any time at myaccount.google.com/permissions, and you can remove our manager account from inside Google Ads. When you withdraw access, the stored token is deleted from our systems. Your Google Ads account, its billing, and its campaigns are yours and stay with you.
• Retention: the encrypted token is kept only while your Google Ads service is active. It is deleted when you withdraw access, when the service ends, or when you ask us to delete your account (see Section 10).

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

2.9 Facebook Page Connection (Lead Ads)

If you run Facebook or Instagram lead ads and want those leads to reach you through TradeSite, we ask you to connect your Facebook Page by signing in with Facebook. This connection is optional, you always start it yourself from a link we send you, and it covers one Page.

• What we ask for: the list of Pages you manage, so you can pick yours; the ability to subscribe that Page to lead notifications; and reading the Page's lead forms and the leads submitted through them. We request no other Facebook permissions. We never create, change, pause or run ads, and we never post to your Page.
• What we read: your Page and lead form names and ids, and for each lead the name, phone number, email address and answers the person typed into your form, with the form it came from and the time it was submitted.
• What we change: one setting on your Page, subscribing it to lead notifications for TradeSite. Nothing else on your Page or your ad account.
• What we store: an encrypted access token for the Page you chose, your Page and form names and ids, and each lead as a lead record in your account, handled like a lead from your website (Section 4), including the call we place to you and connect to the person who submitted the form. Tokens are encrypted at rest in our database and are never written to logs.
• What we never do: we do not sell, rent, or share your Facebook data with third parties, we do not use it to advertise to you, and we do not use it to train AI models. Leads are used only on your behalf, to deliver them to you.
• How you disconnect: tap Disconnect on your connect page, or remove TradeSite under Facebook Settings, Business Integrations. Either way the stored token is deleted from our systems at once. Your Page, your ads and your ad account are yours and stay with you.
• Retention: the encrypted token is kept only while your Page is connected and your service is active. It is deleted when you disconnect, when the service ends, or when you ask us to delete your account (see Section 10). Lead records follow Section 10.

How to have this data deleted, whether you connected a Page or filled in a lead form, is on our data deletion page.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Website Generation: to research your business, generate AI-written copy, select and process images, build your website configuration, perform quality checks, and deploy your finished website.
• Phone Interviews: to conduct the AI-assisted interview call you requested, and to use the recording, transcript, and interview content to write your website copy in your own words, populate pages such as your About and service pages, and tailor our follow-up communications with you.
• Service Delivery: to provide, operate, maintain, and improve our Platform and services.
• Authentication & Security: to verify your identity via OTP (SMS or email), protect against unauthorized access, and maintain account security.
• Payment Processing: to process transactions, manage subscriptions, and send payment confirmations.
• Communications: to send you transactional messages (OTP codes, build status updates, deployment notifications), respond to your inquiries, and provide customer support.
• Marketing Communications: with your consent, to send promotional emails or SMS messages about new features, upgrades, or related services. You can opt out of marketing communications at any time.
• Analytics & Improvement: to analyze usage patterns, diagnose technical issues, and improve our AI models, services, and user experience.
• Advertising: to serve you targeted advertisements on third-party platforms (Meta/Facebook, Google) based on your interactions with our Platform, and to measure advertising effectiveness.
• Legal Compliance: to comply with applicable laws, regulations, legal processes, or governmental requests.
• Fraud Prevention: to detect, prevent, and address fraud, abuse, or other harmful activity.

4. AI Processing of Your Data

Our Platform uses artificial intelligence extensively to generate your website. It is important that you understand how your data is processed by AI systems:

4.1 AI Content Generation

Your quiz answers, scraped business data, Google Business Profile information, and research results are sent to third-party AI service providers to generate website copywriting, including headlines, service descriptions, about-us text, calls-to-action, and other marketing content. These AI providers process your data according to their own privacy policies and data processing agreements.

4.2 AI Image Analysis

Scraped images and your uploaded owner photo (if provided) are sent to AI service providers for visual analysis. The AI evaluates image quality, identifies image content (e.g., work examples, team photos, equipment), and assigns suitability scores for different website sections. The images and resulting analysis metadata are stored.

4.3 AI Image Generation

When insufficient suitable images are available from scraping, our system uses AI to generate additional images. These AI-generated images are created based on your business type, services, and style preferences. Generated images are stored in cloud object storage and deployed with your website.

4.4 AI Quality Review

After your website is built, an AI-powered quality check reviews the generated content for errors, placeholder text, and other quality concerns.

4.5 AI-Assisted Phone Interviews

When you request a phone interview, the call is conducted by an AI voice assistant. The assistant identifies itself as an AI at the start of every call and discloses that the call is recorded. During and after the call, the audio and transcript are processed by our voice-AI infrastructure provider and third-party AI service providers to transcribe the conversation, summarize it, and extract the business information used to build your website. The transcript is stored in our systems; the audio recording is kept only temporarily and automatically deleted within 30 days of the call. The interview does not produce automated decisions with legal or similarly significant effects; it is used solely to create website content that you review before deciding whether to purchase or publish anything.

4.6 Lead Calls Placed on Behalf of a Business

Some businesses that use our platform turn on a feature we call auto-connect. When a person submits a request through that business's website, our systems call the business and, if the business accepts, connect that call to the phone number the person provided. We place these calls on behalf of, and at the instruction of, the business: the business is the controller of the resulting call, and we act as its service provider.

Where the business has enabled recording, these calls are recorded. The business agrees to that recording when it turns the feature on, and it is a party to every call. Some US states require every party's consent to record a call. When the business or the person who submitted the request is in one of those states, or when we cannot tell where either of them is, the person hears a notice that the call may be recorded before being connected, the business hears one before the call is placed, and either party may end the call before recording begins. In states that require the consent of only one party, the business's own consent is the basis for the recording and no notice is played. After the call, our third-party AI service providers transcribe the audio and produce a short summary and the details the person gave, which are delivered only to the business that received the request. We do not use these recordings to make automated decisions about anyone, and we do not use them to train models.

The same feature works in the other direction. The phone number shown on a business's website may be a number we operate for that business, and when you call it we connect you through to the business's own line. Where the business has enabled recording, that call is recorded too, and you hear a notice that it may be recorded before you are connected. Because we have no way to know which state an incoming caller is in, that notice is played on essentially every such call. The transcript and summary go only to the business that received the call, on the same terms and the same retention as above.

Call audio is deleted within 30 days of the call (see Section 10). The written transcript and summary are retained by us on behalf of the business for as long as it remains our customer. If you would rather not be recorded, say so when the call connects, or hang up and contact the business directly using the details on its website.

If you forward your website form's notification emails to a TradeSite address, we process those emails to extract the customer's name, contact details and message, create a lead in your account and, where Lead Bridge is on, place the call described above. We keep the extracted details with your lead records and the sender, subject and outcome of each message for troubleshooting. We do not keep the original email.

4.7 Data Retention by AI Providers

Data sent to our AI providers is transmitted via their respective APIs. We use these services under their API terms of service, which generally provide that API inputs are not used to train their models. However, these providers may retain data temporarily for abuse monitoring and safety purposes in accordance with their own privacy policies. A list of our current AI sub-processors is available upon request at privacy@tradesite.ai.

5. Image Handling

Images are a critical component of the websites we generate. Here is how we handle different types of images:

• Scraped Images: images found on your existing website and Google Business Profile are downloaded and stored in our cloud object storage. These images are analyzed by AI (see Section 4.2) and may be included in your generated website.
• Owner Photos: if you upload a personal photo during the quiz, it is processed and transmitted to our servers. Your photo may be displayed on the “About” section of your generated website and is stored in our systems.
• AI-Generated Images: when insufficient real images are available, AI-generated images are created and stored in cloud object storage and deployed with your site.
• Image Storage Duration: images are retained as long as your generated website is active. If you request deletion of your website and account, associated images will be removed (see Section 10 on data retention).

6. Cookies & Tracking Technologies

We use cookies and similar tracking technologies to collect and track information about your activity on our Platform. Cookies are small data files placed on your device. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent.

6.1 Types of Cookies We Use

• Strictly Necessary Cookies: required for the Platform to function (e.g., session management, authentication state, CSRF protection). These cannot be disabled.
• Analytics Cookies: help us understand how visitors interact with our Platform, which pages are most popular, and how users navigate through the quiz funnel.
• Advertising & Targeting Cookies: placed by third-party advertising platforms to track your activity across websites and serve you relevant ads. These include cookies set by Meta (Facebook) and Google.
• Functional Cookies: remember your preferences (e.g., quiz progress saved to session storage) to provide a more personalized experience.

6.2 Advertising Pixels & Tracking Tags

We do not share your mobile phone number, SMS opt-in status, or SMS message content with any third-party advertising partners, pixel vendors, or data brokers. The pixels and tags described in this section do not transmit phone numbers or SMS consent data.

We use the following third-party advertising pixels and tracking technologies on our Platform:

• Meta Pixel (Facebook Pixel): we use the Meta Pixel to measure the effectiveness of our advertising on Facebook and Instagram, to understand actions people take on our Platform, and to deliver targeted advertisements to you and people similar to you. The Meta Pixel collects data such as your IP address, browser information, page views, button clicks, form submissions (e.g., quiz completion, purchase events), and other interactions. This data is sent to Meta Platforms, Inc. and may be used by Meta to provide measurement services, improve ad targeting, and build audience segments. When you sign up, our server also sends Meta a scrambled (hashed) copy of your email address, first name and business location, so we can measure which ads work and show them to similar businesses. We never send your phone number. For more information, see Meta's Privacy Policy. You can manage your ad preferences at Facebook Ad Preferences.
• Google Ads (Google Tag / gtag.js): we use Google Ads conversion tracking and remarketing tags to measure the performance of our Google Ads campaigns and to serve personalized ads to you across Google's advertising network. Google may collect data about your visits, conversions, and interactions. For more information, see Google's Privacy Policy. You can opt out of personalized ads at Google Ad Settings.

6.3 Cookie Consent

Where required by applicable law (including under the GDPR for users in the European Economic Area and the UK), we obtain your consent before placing non-essential cookies on your device. You may withdraw your consent at any time by adjusting your cookie preferences through the cookie banner on our Platform or by clearing cookies in your browser settings. Please note that disabling certain cookies may impact the functionality of our Platform.

6.4 Do Not Track Signals

Some browsers transmit “Do Not Track” (DNT) signals. There is currently no universally accepted standard for how companies should respond to DNT signals. At this time, our Platform does not respond to DNT signals. However, you can exercise your privacy rights as described in Sections 11 and 12 of this policy.

7. SMS & Email Communications

7.1 Transactional Communications

We send the following transactional messages that are necessary for the operation of our services:

• OTP Codes: one-time passwords sent via SMS or email for account authentication and login verification.
• Build Status Notifications: updates about the progress and completion of your website build.
• Deployment Notifications: confirmation when your website is deployed and live.
• Payment Confirmations: receipts and confirmation of subscription or one-time purchases.

You cannot opt out of transactional messages, as they are essential to the delivery of our services.

7.2 Marketing Communications

With your consent, we may send marketing communications via email or SMS, including promotions, feature announcements, upgrade offers, and tips for improving your website. You can opt out of marketing communications at any time by:

• Clicking the “Unsubscribe” link in any marketing email.
• Replying “STOP” to any marketing SMS message.
• Contacting us at support@tradesite.ai.

Standard message and data rates may apply to SMS messages. Marketing SMS frequency: up to 4 messages per month.

7.3 Mobile Information & SMS Consent Sharing

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All categories of personal data described in this Privacy Policy exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Specifically:

• We do not sell, rent, lease, or otherwise disclose your mobile phone number to third parties for their own marketing or promotional purposes.
• We do not share your SMS opt-in status, SMS consent, or SMS message content with advertising networks, analytics vendors, data brokers, social media platforms, affiliates, or any other third parties for marketing.
• Your phone number is shared only with our licensed SMS and voice communication providers (e.g., Twilio and our voice-AI infrastructure provider) for the sole purpose of delivering messages and phone calls you have consented to receive, and with payment processors or law enforcement where strictly required (see Section 8).
• Our SMS communication providers process your phone number under strict data processing agreements and are contractually prohibited from using it for their own marketing.

This restriction applies in addition to, and overrides where in conflict with, any other section of this Privacy Policy that describes data sharing.

7.4 SMS Program Details

• Program name: TradeSite LLC (tradesite.ai)
• Message types: account authentication (OTP), website build status updates, deployment confirmations, lead and inquiry notifications, payment receipts, and (with separate consent) marketing messages such as feature announcements, tips, and promotional offers.
• Frequency: transactional messages are sent as events occur, approximately 1–5 per website build, plus 1 per new lead received through your website. Marketing messages (with separate opt-in) are sent up to 4 per month.
• Cost: message and data rates may apply per your wireless carrier’s plan. TradeSite LLC does not charge you for SMS messages.
• Opt-out: reply STOP to any SMS message to unsubscribe from marketing. You will receive a final confirmation message. Transactional messages required for service operation may continue while your account is active.
• Help: reply HELP to any SMS message for assistance, or contact support@tradesite.ai.
• Sample message: “TradeSite: Your verification code is 123456. Reply STOP to opt out, HELP for help. Msg&data rates may apply.”
• Supported carriers: messages are deliverable across all major U.S. wireless carriers. Carriers are not liable for delayed or undelivered messages.

7.5 Phone Calls & Call Recordings

If you request a phone interview through one of our signup forms, we place calls to the phone number you provided, with your prior express consent given on that form. These calls are conducted by an AI voice assistant that identifies itself as an AI and discloses recording at the start of every call. Calls you request may be followed by a limited number of follow-up call attempts and related text messages if we are unable to reach you.

Separately, if you submit a request on a business's website and that business has turned on auto-connect, we may place a call to you on that business's behalf and connect you to it. If you call the number shown on that business's website, we connect that call to the business in the same way. Calls in either direction may be recorded. Section 4.6 describes that feature and when a recording notice is played, and Section 10 its retention.

• Consent: we only place these calls after you submit a form requesting the call and agreeing to be contacted. Consent is not a condition of purchase.
• Recording: interview calls are recorded so that our systems can build your website from what you tell us. If you do not wish to be recorded, say so on the call or hang up, and no recording of you will be kept. Where available, we may offer you the option to complete the interview by text message instead.
• Opt-out: you can decline further calls at any time by saying so during a call, replying STOP to any related text message, or contacting support@tradesite.ai. Opt-out requests are honored across both calls and text messages.

8. Data Sharing & Third-Party Services

We share your information with the following categories of third-party service providers, each of whom processes your data only for the purposes described below:

A complete list of named sub-processors is available upon request by contacting privacy@tradesite.ai.

Mobile phone numbers, SMS opt-in data, and SMS consent are excluded from all sharing categories above except SMS Communication Providers (used solely to deliver messages you have consented to receive). See Section 7.3 for full details.

We may also share your information in the following circumstances:

• Legal Requirements: if required to do so by law, regulation, legal process, or governmental request.
• Protection of Rights: to enforce our Terms of Service, protect the security or integrity of our Platform, or protect the rights, property, or safety of TradeSite, our users, or the public.
• Business Transfers: in connection with a merger, acquisition, reorganization, or sale of all or a portion of our assets, in which case your personal data may be transferred to the acquiring entity.
• With Your Consent: we may share your information for any other purpose with your explicit consent.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption of data in transit using TLS/SSL (HTTPS).
• Encryption of data at rest in our database and storage systems.
• Access controls limiting who within our organization can access personal data.
• OTP-based authentication (no passwords stored) reducing the risk of credential theft.
• Regular review of our data collection, storage, and processing practices.
• Use of industry-standard infrastructure providers that maintain their own security certifications and compliance programs.

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security. You use our services at your own risk.

10. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements. Specific retention periods include:

• Active Accounts & Generated Websites: your build job data, quiz responses, research results, generated website files, and images are retained for as long as your account is active and your generated website remains deployed.
• Free Tier (Preview) Websites: build job data for free-tier preview websites may be retained for up to 12 months after generation. After this period, the data may be automatically deleted.
• Paid Accounts: data is retained for the duration of your subscription and for up to 24 months after account termination or subscription cancellation to allow for potential reactivation.
• Payment Records: transaction records are retained for up to 7 years to comply with tax and financial reporting obligations.
• Communication Logs: records of OTP codes and transactional communications are retained for up to 90 days for debugging and security audit purposes.
• Call Recordings: audio recordings of interview calls are automatically deleted within 30 days of the call, including any copies held by our voice-AI infrastructure provider. We do not keep call audio beyond this period.
• Lead Call Recordings: audio of auto-connect calls placed on behalf of a business (Section 4.6) is deleted within 30 days of the call. Any link to that audio stops working at the same time. The transcript and summary are kept on behalf of the business for as long as it remains our customer.
• Call Transcripts: text transcripts of interview calls follow the same retention schedule as the build job they belong to (see the free-tier and paid-account periods above), since they are the source material for your generated website.
• Analytics & Advertising Data: aggregated analytics data may be retained indefinitely. Identifiable tracking data is subject to the retention policies of the respective third-party providers (Meta, Google).
• After Deletion Request: upon receiving a valid deletion request, we will delete or anonymize your personal data within 30 days, except where we are required to retain it by law.

11. Your Rights Under the GDPR (European Economic Area & UK)

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR) and the UK GDPR:

• Right of Access (Article 15): you have the right to request a copy of the personal data we hold about you.
• Right to Rectification (Article 16): you have the right to request correction of inaccurate personal data or completion of incomplete data.
• Right to Erasure (Article 17): you have the right to request deletion of your personal data under certain circumstances (also known as the “right to be forgotten”).
• Right to Restriction of Processing (Article 18): you have the right to request restriction of processing of your personal data under certain circumstances.
• Right to Data Portability (Article 20): you have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.
• Right to Object (Article 21): you have the right to object to processing of your personal data based on our legitimate interests, including for direct marketing purposes.
• Right Not to Be Subject to Automated Decision-Making (Article 22): while our Platform uses AI to generate website content, this does not constitute automated decision-making that produces legal effects or similarly significant effects on you. The AI is used solely to create a website on your behalf, and you retain full control over whether to publish or use the generated content.
• Right to Withdraw Consent: where we process your data based on consent, you have the right to withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

Legal Bases for Processing (GDPR)

We process your personal data under the following legal bases:

• Performance of a Contract: processing necessary to provide you with our website generation services.
• Consent: for marketing communications, non-essential cookies, and advertising tracking.
• Legitimate Interests: for fraud prevention, security, service improvement, and analytics (where not overridden by your rights).
• Legal Obligation: for compliance with tax, financial, and regulatory requirements.

To exercise any of these rights, please contact us at support@tradesite.ai. We will respond to your request within 30 days. You also have the right to lodge a complaint with your local data protection supervisory authority.

12. Your Rights Under the CCPA (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: you have the right to request that we disclose what personal information we have collected about you, the sources of that information, the business purposes for collecting it, the categories of third parties with whom we share it, and the specific pieces of personal information we have collected.
• Right to Delete: you have the right to request that we delete the personal information we have collected about you, subject to certain exceptions (e.g., where retention is necessary for completing a transaction, detecting security incidents, or complying with legal obligations).
• Right to Correct: you have the right to request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing: you have the right to opt out of the “sale” or “sharing” of your personal information. See Section 12.1 below.
• Right to Limit Use of Sensitive Information: you have the right to limit the use and disclosure of your sensitive personal information.
• Right to Non-Discrimination: we will not discriminate against you for exercising any of your CCPA/CPRA rights.

12.1 “Do Not Sell or Share My Personal Information”

Under the CCPA/CPRA, the use of advertising pixels (Meta Pixel, Google Ads tags) that share personal information with third parties for cross-context behavioral advertising may constitute a “sale” or “sharing” of personal information. We may share the following categories of personal information with advertising partners for targeted advertising purposes:

• Identifiers (e.g., IP address, device identifiers, cookie IDs)
• Internet or other electronic network activity information (e.g., browsing history on our Platform, interactions with our ads)
• Inferences drawn from the above (e.g., user preferences, interests)

To opt out of the sale or sharing of your personal information, you may:

• Email us at support@tradesite.ai with the subject line “Do Not Sell or Share My Information.”
• Adjust your cookie preferences using the cookie consent banner on our Platform.
• Use browser-level privacy tools or opt-out mechanisms provided by Meta and Google.
• Enable the Global Privacy Control (GPC) signal in your browser. We honor GPC signals as a valid opt-out request.

We do not knowingly sell or share the personal information of consumers under 16 years of age.

12.2 Authorized Agents

You may designate an authorized agent to submit a CCPA/CPRA request on your behalf. To do so, the authorized agent must provide proof of written authorization or a power of attorney. We may also require you to verify your identity directly.

To exercise any of your CCPA/CPRA rights, please contact us at support@tradesite.ai. We will verify your identity before fulfilling your request and respond within 45 days.

13. International Data Transfers

Our Platform and services are operated from the United States. If you are accessing our Platform from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States and other countries where our service providers operate.

Our third-party service providers may process data in various countries around the world. These transfers are necessary for us to provide our services to you.

For transfers of personal data from the EEA or UK to countries that have not received an adequacy decision from the European Commission, we rely on appropriate safeguards, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Binding corporate rules of our service providers where applicable.
• The EU-U.S. Data Privacy Framework, where our service providers are certified participants.

By using our Platform, you acknowledge and consent to the transfer, storage, and processing of your data in jurisdictions outside of your own, which may have different data protection laws than your country of residence.

14. Children's Privacy

Our Platform is not directed to children under the age of 13 (or under the age of 16 in the EEA/UK). We do not knowingly collect personal information from children under these ages. Our services are designed for business owners, contractors, and tradespeople who are adults.

If you are a parent or guardian and believe that your child has provided us with personal information, please contact us at support@tradesite.ai. If we become aware that we have collected personal information from a child without verification of parental consent, we will take steps to delete that information promptly in accordance with the Children's Online Privacy Protection Act (COPPA) and applicable law.

15. Third-Party Links & Generated Websites

Our Platform may contain links to third-party websites or services that are not operated by us. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party sites or services. We encourage you to review the privacy policy of every site you visit.

Websites generated by our Platform and deployed to hosting providers are separate websites. Once deployed, those websites may collect visitor data through their own analytics, contact forms, or integrations that you configure. You are responsible for ensuring that your generated website complies with applicable privacy laws and for providing your own privacy policy to your website visitors.

16. Data Breach Notification

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours (where required by the GDPR).
• Notify affected users without undue delay via email and/or SMS to the contact information on file.
• Provide details of the nature of the breach, the data affected, and the measures taken or proposed to address the breach.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will:

• Update the “Last Updated” date at the top of this page.
• Post the updated Privacy Policy on our Platform.
• Where required by law, notify you via email or a prominent notice on our Platform before the changes take effect.

Your continued use of our Platform after the posting of a revised Privacy Policy constitutes your acceptance of the changes. We encourage you to periodically review this Privacy Policy to stay informed about how we are protecting your data.

18. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

For GDPR-related inquiries, you may also contact your local data protection supervisory authority.

For CCPA/CPRA-related inquiries, California residents may also contact the California Attorney General's office at oag.ca.gov/privacy.