Privacy Policy

TradeBuilds (“TradeBuilds,” “we,” “us,” or “our”) provides software and related services for small businesses and home service professionals, including TradeBuilds CRM, custom applications, websites, hosting, domains, and professional email (collectively, the “Services”). This Privacy Policy describes our practices in connection with information we process through https://tradebuilds.app, https://crm.tradebuilds.app, our native applications for iPhone, iPad, and Mac, and any other TradeBuilds product that links to this Policy.

By using the Services, you acknowledge this Policy. If you do not agree, please do not use the Services. Capitalized terms not defined here have the meanings in our Terms of Service.

This Policy is effective as of September 7, 2026 and was last updated on September 7, 2026.

We process two broad categories of information:

• Account and usage information about people who create TradeBuilds accounts, visit our websites, or use our apps. For that information, TradeBuilds is the business / data controller.
• Customer Content that shops store in the Services — for example, client names, job addresses, quotes, invoices, schedules, notes, and files. For Customer Content, the shop is the business / controller, and TradeBuilds acts as a service provider / processor on the shop’s instructions.

If you are a homeowner or end customer of a TradeBuilds shop, the shop’s own privacy practices govern how they use your information. Questions about a specific job, quote, or invoice should be directed to that business. We process that information to provide the Services to the shop.

We collect information you provide, information generated by your use of the Services, and information from third parties you authorize, including Google and Apple.

When you create or use a TradeBuilds account, we may collect name, email address, phone number, business name, role, password or credential hashes, billing contact details, and preferences. Team members invited by an account administrator will have profiles associated with that shop.

You may sign in with email credentials, Google, or Sign in with Apple. We store the identifiers needed to recognize your account on later visits, including a unique user ID issued by Google or Apple.

If you choose Google Sign-In, you are directed to Google’s authentication screens. Depending on the permissions you grant, we may receive your Google account email, name, profile image, language, and a stable Google user identifier. We use this information to create or authenticate your TradeBuilds account, keep you signed in, and associate your session with the correct shop.

We do not receive your Google password. Google’s handling of your information is described in the Google Privacy Policy at https://policies.google.com/privacy. You can disconnect Google Sign-In by updating your TradeBuilds account or your Google account permissions at https://myaccount.google.com/permissions.

Google Sign-In is optional. You may use an email and password or Sign in with Apple instead, where those options are offered.

If you choose Sign in with Apple on the web, iOS, iPadOS, or macOS, Apple authenticates you and may provide us with a unique Apple user identifier and, if you share them, your name and email address. If you use Hide My Email, Apple issues a relay address that forwards to your real inbox. We treat that relay address as your account email.

We do not receive your Apple ID password. We do not use Apple-provided identity information to track you across third-party apps or websites for advertising, and we do not sell it to data brokers. Apple’s practices are described at https://www.apple.com/legal/privacy/.

Users who create an account with Sign in with Apple can request deletion of that account as described in “Your rights and choices.” We honor Apple’s requirements for account deletion and for using Sign in with Apple data only to authenticate and operate the account you requested.

TradeBuilds CRM can connect to Google Calendar so jobs, appointments, and related events can sync with calendars your shop already uses. Connecting Google Calendar is optional and is not required to use the rest of the Services.

When you connect Google Calendar, we request OAuth access tokens and the Google API scopes needed to provide scheduling and calendar sync — typically identity (to know which Google account you connected) and Calendar access to read and/or create, update, or delete events you choose to sync. We store tokens, token expiry metadata, the connected calendar identifiers, and event identifiers required to keep TradeBuilds jobs and Google events in sync.

We use Google Calendar data solely to provide the calendar features you enable: displaying availability, creating or updating job-related events, preventing double-booking where the feature is offered, and troubleshooting sync at your request. We do not use Google Calendar data for advertising, credit decisions, or profiling unrelated to the Services.

Under Google’s Limited Use rules, we do not (a) sell Google user data; (b) use it for advertising, including retargeting, personalized, or interest-based advertising; (c) use it to train generalized AI or machine-learning models; or (d) allow humans to read Google user data unless you give us affirmative consent for a specific support case, it is necessary for security or legal compliance, or the data is aggregated and no longer identifiable. We do not transfer Google user data to third parties except to our infrastructure providers as needed to operate the feature, or as required by law.

You may disconnect Google Calendar at any time in TradeBuilds settings or by revoking access in your Google account. After disconnection we stop new sync and delete or revoke stored Calendar tokens. Residual event identifiers or logs may remain for a limited period as described in “Retention,” or as needed for security, dispute, and legal purposes.

Shops using TradeBuilds CRM and related tools may store business and personal information about their own customers and crew, including names, phone numbers, email addresses, service addresses, job notes, photos or attachments, price-book items, quotes, invoices, payment status, schedules, maintenance plans, and communication history. We process this Customer Content to provide, maintain, secure, and support the Services.

If you enable AI-assisted quoting or follow-ups on an eligible plan, prompts and outputs may include Customer Content you submit to that feature so we can generate the draft you requested. We do not sell that content, and we do not use Google Calendar data as training material for generalized models.

If you subscribe to a paid plan or collect customer card payments through the Services, payment card data is collected and processed by PCI DSS–compliant payment processors. TradeBuilds does not store full primary account numbers or card verification codes. We may receive tokens, last-four digits, card brand, expiration month/year, billing ZIP, transaction amounts, status, and dispute information as needed to show payment history, reconcile invoices, and manage your subscription.

Subscription billing information (plan, renewal date, invoices, and tax-relevant details you provide) is stored to administer your account.

TradeBuilds provides native applications for iPhone, iPad, and Mac that connect to the same TradeBuilds CRM account you use on the web. The apps may collect or access:

• Account credentials, session tokens, and Sign in with Apple or Google tokens stored in the device Keychain or equivalent secure storage.
• Device and app diagnostics such as device model, OS version, app version, language, time zone, crash logs, and performance data so we can keep the apps stable.
• Push notification tokens if you enable alerts for jobs, quotes, payments, or other account events. You can disable notifications in iOS or macOS Settings.
• Calendar-related data if you use in-app scheduling that syncs with Google Calendar (and, if a future release requests access to the on-device Calendar, only after you grant that permission in the system prompt).
• Network information reasonably required to reach our servers (for example, that a request originated from a mobile network).

We do not use the advertising identifier (IDFA) to track you across other companies’ apps or websites. If a system permission is not needed for a feature you are using, we do not request it. You can withdraw permissions in Settings; some features will stop working without the related permission.

App Store and Mac App Store listings include Apple’s privacy nutrition labels for each app version. Those labels summarize data types linked or not linked to your identity. This Policy controls if there is a conflict in interpretation, except where Apple rules require a stricter disclosure for that listing.

On iOS, iPadOS, and macOS we honor platform rules on data use, including restrictions on using Sign in with Apple information and on tracking. We do not sell personal information collected through the native apps.

If we host a website, customer portal, custom domain, or professional email for your business, we process DNS records, mailbox metadata, message content transmitted through those systems, server logs, and security telemetry as needed to operate and protect that infrastructure. Email content is accessed by humans only as required to provide support you request, combat abuse, or comply with law.

Domain registration, DNS, TLS certificates, and email delivery may involve third-party registrars and infrastructure providers. Those providers process technical data (such as WHOIS/registration contacts you supply and mail-routing information) under their own terms.

When you visit our websites or use the apps, we automatically collect IP address, approximate location derived from IP, browser or app type, device type, referring URL, pages or screens viewed, timestamps, and diagnostic events. We use this information for security, fraud prevention, capacity planning, and improving the Services.

We use cookies, local storage, and similar technologies that are necessary to sign you in, keep sessions secure, remember preferences, and load the Services. TradeBuilds CRM session cookies are used to authenticate you after you sign in with email, Google, or Apple.

Our marketing site uses Vercel Analytics and Vercel Speed Insights to understand aggregated traffic and performance. These tools are designed to collect privacy-friendly, aggregated metrics rather than advertising profiles. We do not use third-party advertising cookies on tradebuilds.app to sell ads.

We also use Help Scout Beacon to provide live chat, messaging, and AI-assisted support. If you open the messenger, Help Scout may process the page you are on, device and browser information, and the name, email, and message content you submit so we can reply. Help Scout’s practices are described at https://www.helpscout.com/company/legal/privacy/.

You can control cookies through your browser. Blocking necessary cookies may prevent sign-in from working. Do Not Track signals are not standardized; we do not currently respond to DNT as a separate legal request, but we do not run cross-site ad tracking on the marketing site.

We use information to:

• Provide, operate, maintain, and improve the Services, including CRM, scheduling, quoting, invoicing, payments display, maintenance plans, hosting, and native apps.
• Authenticate users, including via Google Sign-In and Sign in with Apple, and to keep accounts secure.
• Sync jobs and appointments when you connect Google Calendar, in line with Google’s Limited Use rules.
• Process subscriptions, send receipts, and collect customer payments through our processors.
• Provide customer support, onboarding, and professional services you request, including live chat and AI-assisted support through Help Scout Beacon.
• Send service, security, and (where permitted) product communications. You may opt out of non-essential marketing emails.
• Monitor for abuse, fraud, spam, and security incidents.
• Comply with law, enforce our Terms, and protect TradeBuilds, our users, and the public.
• De-identify or aggregate data to understand how the Services perform. We will not attempt to re-identify data that has been de-identified, except to test our de-identification, as permitted by law.

If you are in a jurisdiction that requires a legal basis, we process personal data as needed to perform our contract with you; as needed for our legitimate interests (such as securing accounts, improving product reliability, and understanding aggregated usage) where those interests are not overridden by your rights; with your consent (for example, connecting Google Calendar or optional notifications); and to comply with legal obligations.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share information only as follows:

• Service providers / subprocessors that host infrastructure, send email, process payments, provide analytics, operate in-app chat and support (including Help Scout), or help us operate the apps, under contracts that limit their use of the data.
• Authentication and integration partners you choose, including Google (Sign-In and Calendar) and Apple (Sign in with Apple and App Store / Mac App Store distribution).
• Shop administrators and teammates on the same TradeBuilds account, according to roles that shop configures.
• Professional advisors (legal, accounting) under confidentiality obligations.
• Authorities or other parties when we believe disclosure is required by law, legal process, or to protect rights, safety, or security.
• A buyer or successor if we are involved in a merger, acquisition, or asset sale, with confidentiality appropriate to the transaction. We will continue to protect personal information and give notice if a successor will use it in a materially different way.

We retain account information for as long as the account is active and for a reasonable period afterward to complete billing, resolve disputes, enforce agreements, and meet legal, tax, and security requirements. Customer Content is retained until the shop deletes it or closes the account, plus a limited backup window. Google Calendar tokens are retained only while the integration is connected, then revoked. Diagnostic logs are generally kept for a shorter operational period unless needed for an incident investigation.

When we no longer need personal information, we delete or de-identify it. Residual copies in encrypted backups are overwritten on the backup cycle.

We use administrative, technical, and physical safeguards appropriate to the nature of the data, including TLS in transit, access controls, hashed credentials for password accounts, secure token storage, and least-privilege access for personnel. Native apps store session material in platform secure storage where available. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

You are responsible for protecting credentials, device passcodes, and who you invite into your shop account. Enable device lock and revoke access for departed technicians promptly.

TradeBuilds is based in the United States. If you access the Services from another country, your information will be processed in the United States and possibly other countries where our providers operate. Those countries may have different data-protection laws than your own. Where required, we use appropriate transfer mechanisms such as contractual clauses with processors.

Depending on your location, you may have the right to request access, correction, deletion, a portable copy of personal information, restriction or objection to certain processing, and withdrawal of consent. You may also appeal a denial of a request, and you may lodge a complaint with a supervisory authority.

To exercise these rights, email sabrina@tradebuilds.app or call (513) 804-8941. We will verify the request (for example, by confirming control of the account email) before fulfilling it. If you are an end customer of a shop, we may redirect you to that shop when they are the controller of the data.

You may also: update profile information in the CRM; disconnect Google Calendar; revoke Google or Apple access from those providers’ account settings; disable push notifications; delete the iOS or Mac app; opt out of marketing emails via the unsubscribe link; and request account deletion.

Account deletion: email us from the address on the account (or the Apple Hide My Email relay, if that is how you signed up) and ask us to delete the account. We will delete or de-identify personal information associated with the account except where we must retain it for legal, security, or billing reasons. Customer Content owned by a shop may persist in that shop’s account until the shop administrator deletes it.

If you are a resident of California or another U.S. state with a comprehensive privacy law, the categories of personal information we collect are described above and include identifiers, commercial information, internet or electronic activity, professional information, and (if you provide them) customer records stored as Customer Content. We collect them for the business purposes in this Policy. We do not sell personal information or share it for cross-context behavioral advertising. We do not use or disclose sensitive personal information for purposes that require a right to limit under California law, other than to provide the Services you request.

California residents may designate an authorized agent. We will not discriminate against you for exercising privacy rights. Shine the Light: we do not disclose personal information to third parties for their own direct marketing in a manner that requires a separate Shine the Light list.

The Services are for businesses and are not directed to children under 13 (or under 16 where that is the relevant age). We do not knowingly collect personal information from children. If you believe a child has provided information, contact us and we will delete it.

The Services may link to Google, Apple, payment processors, maps, or other third-party sites. Their privacy practices are their own. Connecting an integration is your instruction to exchange the data needed for that integration to function.

We may update this Policy from time to time. The “last updated” date will change, and we will post the revised Policy on this page. If changes are material, we will provide additional notice (for example, by email or an in-product message) where required. Continued use after the effective date constitutes acceptance of the updated Policy.

Privacy questions, requests, and complaints: sabrina@tradebuilds.app · (513) 804-8941.

Postal and online: TradeBuilds, United States · https://tradebuilds.app · https://crm.tradebuilds.app.

If we cannot resolve a privacy concern, you may contact your local data-protection authority. U.S. users may also contact their state attorney general.