TRADESPAN PRIVACY POLICY
Version 2.0 — Effective {{effective_date}}
TradeSpan, Inc. ("TradeSpan," "we") respects your privacy. This Policy describes how we collect, use, share, retain, and protect personal information, and explains your rights.
1. Scope
Applies to www.tradespan.io, pro.luckysconnect.com, our mobile apps, and all TradeSpan services. Not to third-party sites we link to.
2. Information We Collect
From Customer/Users: name, email, phone, company, role, IP address, browser info, device info, login credentials (hashed).
From Customer's End Users (via Customer): contact info, service history, payment info (via Stripe), messages, call recordings, photos, signatures. TradeSpan is a processor for this data; the Customer (tenant) is the controller.
Automatically: log data, cookies, analytics, usage metrics.
From Third Parties: enrichment data (Clearbit-type), fraud signals (Stripe Radar), background integrations (Google, Microsoft, Intuit).
3. How We Use Information
(a) provide, maintain, and improve the Services; (b) process payments; (c) send transactional messages; (d) marketing (with consent where required); (e) fraud prevention; (f) legal compliance; (g) aggregate analytics.
4. How We Share Information
(a) Subprocessors (see Subprocessor List); (b) Customer (their end-users' data); (c) Legal (subpoena, court order, law enforcement); (d) Acquirer (in M&A); (e) With consent. We do not "sell" personal information as defined by CCPA/CPRA; we may "share" for cross-context behavioral advertising if you opt in.
5. Cookies
See the Cookie Policy. Essential, functional, analytics, and marketing categories. Opt-out via cookie banner or browser settings.
6. Data Retention
Account data: for the duration of your subscription plus 30 days for export, then anonymized or deleted, except (a) financial records retained 7 years, (b) audit logs retained 3 years, (c) as required by law.
7. Security
Encryption at rest (AES-256) and in transit (TLS 1.2+). Access controls, quarterly penetration tests, annual SOC 2 Type II audits. See DPA Annex II (TOMs) for details.
8. International Transfers
We are U.S.-based. For EU/UK/Swiss data, we rely on Standard Contractual Clauses (SCCs) and the UK IDTA/Addendum. See DPA for details.
9. Your Rights
Depending on your jurisdiction, you may have the right to (a) access, (b) correct, (c) delete, (d) port, (e) restrict/object, (f) opt out of sale/share/targeted advertising, (g) appeal a denial, (h) not be discriminated against. To exercise: privacy@tradespan.io.
10. STATE-SPECIFIC RIGHTS
California (CCPA/CPRA): You have the right to know, delete, correct, opt out of sale/sharing, limit use of sensitive personal information, and to non-discrimination. We do not knowingly sell personal information of California residents. Categories of PI collected: identifiers, commercial info, internet activity, geolocation, professional info, inferences. Sources, purposes, and third-party sharing detailed above. Retention per §6. Authorized-agent requests accepted with verifiable authority. Metrics: [published annually at tradespan.io/ccpa-metrics].
Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Delaware (DPDPA), Iowa (ICDPA), Montana (MTCDPA), Tennessee (TIPA), Indiana (INCDPA), Kentucky (KCDPA), New Jersey (NJDPA), New Hampshire, Minnesota, Rhode Island, Maryland: You have the rights to access, correct, delete, port, opt out of targeted advertising and sale, and appeal. Requests: privacy@tradespan.io. Appeal denials: privacy-appeal@tradespan.io.
Nevada (NRS 603A.340): You may opt out of sale of covered information: privacy@tradespan.io.
Illinois (BIPA): We do not collect biometric identifiers or biometric information. If biometric collection is ever added, a separate written release will be required.
Washington (My Health My Data Act): We do not knowingly collect consumer health data as defined by the Act.
Children (COPPA): Not directed to children under 13. If we learn we have collected PI from a child under 13, we will delete it.
11. Third-Party Links / Do Not Track
Our sites may link to third-party sites. We are not responsible for their practices. We do not respond to Do Not Track signals. We honor Global Privacy Control (GPC) as an opt-out of sale/sharing where required.
12. Changes
We will post material changes 30 days before effect. Continued use = acceptance.
13. Contact
TradeSpan, Inc., Attn: Privacy — legal@tradespan.io
EU/UK Representative: [as required under GDPR Art. 27].