Tradecraft Privacy Policy

Who We Are

Tradecraft is a private contractor intelligence network for verified home-service businesses, operated by CoFabri LLC. When this policy says “Tradecraft,” “we,” or “us,” it refers to that entity.

Data We Collect

From Members (verified businesses):

• Account data: email address, display name, business name, trade type, service area, and verification documents (license, insurance certificate).
• Billing data: handled by Stripe through our CoFabri platform. We store only your plan and billing status — no card numbers.
• Usage data: lookup history, submission records, credit ledger, session events.

From intelligence submissions (about clients):

• Client identity data: name, email, phone, address — stored as normalized identifiers, not as searchable free text.
• Customer notice contact: if the submitting Member entered a client email address, we hold it temporarily only to send the client a one-time notice that a report exists. It is deleted as soon as the notice is sent, or when the report is rejected, or after 14 days if still unsent.
• Project signals: numeric scores, severity flags, project type, value range, and completion date.
• Notes: original text is retained in a legal-hold audit log only; only the AI-neutralized version is shown to other Members.
• Evidence files: stored in encrypted, access-controlled storage.

Automatically collected:

• Request logs (Vercel infrastructure), IP addresses (hashed), browser/device type.
• Performance and error telemetry (Vercel Analytics, Sentry).

How We Use Your Data

• To operate the platform: authenticate you, serve lookups, moderate submissions, compute risk scores.
• To communicate with you: transactional emails for verification status, submission decisions, and billing.
• To prevent abuse: fraud detection, rate limiting, ban enforcement.
• For legal compliance: responding to legal requests, maintaining audit logs.

We do not use your data for advertising, behavioral profiling, or sale to third parties.

Sub-Processors

We share data only with these service providers:

• Supabase — database and file storage. Data encrypted at rest and in transit.
• Stripe — billing, through CoFabri. Processes card data under PCI-DSS compliance. We never see raw card numbers.
• OpenAI — AI moderation and neutralization of submission notes. We use the API tier; OpenAI retains inputs for zero days by default and does not train on API submissions.
• Resend — transactional email delivery, through CoFabri. Retains delivery logs for 30 days. CoFabri keeps its own delivery record for up to 12 months.
• Vercel — hosting and CDN. Request logs do not include application-level data.
• Sentry — error monitoring. Payloads are scrubbed to avoid capturing PII.

We may also disclose data in response to a valid legal process (court order, subpoena) or to protect the safety of users or the public.

Data Retention

• Account data is retained while your account is active and for a reasonable period afterward to satisfy legal obligations.
• Submission data is retained indefinitely for the network’s utility. Submissions can be deleted via a verified DSAR erasure request or by the submitting Member withdrawing their own submission.
• Audit logs are retained for a minimum of three years.
• Tradecraft does not retain client contact details used for a one-time notice after the notice is sent (or after 14 days at most). Our email delivery service, run by CoFabri, keeps a record of each message it sends, including the recipient address, for up to 12 months.
• Billing data is retained per Stripe’s own retention policies.

Your Privacy Rights

Depending on where you live, you may have rights under CCPA/CPRA or other state privacy laws, including:

• Access — know what personal data we hold about you.
• Deletion — request erasure of your personal data.
• Correction — request correction of inaccurate data.
• Opt-out of sale — we do not sell personal data; we will confirm upon request.
• Opt-out of profiling — we do not profile individuals for advertising purposes.

We will respond to verified requests within 45 days. Submit a request via our data subject request form or email privacy@cofabri.com.

Security

We use TLS in transit, encryption at rest, row-level security policies, Content Security Policy headers, and regular access reviews. Sensitive operations are logged and monitored.

To report a security vulnerability, email security@cofabri.com. We aim to acknowledge reports within 48 hours.

Children

Tradecraft is not directed at individuals under 18. We do not knowingly collect data from minors.

Changes to This Policy

We will notify you of material changes by email or in-app notice. Continued use after the effective date constitutes acceptance.

Contact

Privacy questions: privacy@cofabri.com