Privacy
Privacy Policy
Last updated: October 4, 2026
Tradesfront Marketing ("Tradesfront," "we," "us") builds and runs marketing for local service businesses. This policy covers this website (tradesfront.com), the Tradesfront portal (app.tradesfront.com), our email and phone lines, and the work we do for our clients. It explains what we collect, why, who helps us handle it, how long we keep it, and the rights you have. It does not cover the websites we build for clients: each of those carries its own privacy policy, and the client is the business you are dealing with.
Two kinds of people read this. Business owners who hire us, and their customers, whose details reach us when they fill in a form on a client's site, call a client's tracking number, or come in through a client's Google Local Services Ads account. The section "If you're a client's customer" is for the second group.
Who we are
tradesfront.com and the Tradesfront portal are operated by Derek Cummings, a sole proprietor doing business as Tradesfront Marketing, an assumed business name registered under the North Carolina Assumed Business Name Act. He decides how the information described here is used. For anything about your information, email privacy@tradesfront.com.
What we collect, at a glance
| What | Why | Kept for |
|---|---|---|
| Your name, email and what you wrote, when you use the contact form or chat with Trey on this site | To answer you and, if you sign up, to carry the conversation into your account | While we deal with it; chat history stays with your account |
| A website address you enter in the "Ask the AIs" check | To run the check you asked for and show you the result | With the result, in your account if you have one |
| Account details: your name, email and profile picture from Google sign-in, your business's name, services, hours, areas, photos and the answers you give during onboarding | To build and run your site and your account | While your account is active, then 3 years for billing records |
| Payment details, handled by Stripe (we never see card numbers) | To bill your plan | Stripe's own retention; our invoices 3 years |
| Your name, email and phone when you book a call with us | To hold the call and send the invite | With the calendar event |
| Your IP address and browser details when you submit a form | To stop repeated and automated submissions | 1 hour, never saved with your message |
| Usage statistics on tradesfront.com (Google Analytics) | To see which pages people read | Google's standard retention (2 to 14 months) |
| Client customers' form submissions, calls, recordings, transcripts and Local Services Ads leads (see below) | To deliver them to the client and report on them | 365 days, then deleted |
We do not sell personal information, we do not share it for targeted advertising, and we do not use sensitive personal information to infer anything about anyone.
Information you give us
On this site: the contact form (name, email, message), the chat with Trey (whatever you type), and the "Ask the AIs" check (a website address). Trey is an AI assistant; what you type is sent to our AI provider to generate a reply (see "Who helps us handle it") and is kept so the conversation can continue. If you start a chat without an account, a cookie keeps your conversation together; if you later sign up, the conversation carries over into your account.
In the portal: your Google sign-in details (name, email address, profile picture), the business facts you give us during onboarding (services, service areas, hours, phone numbers, licences, photos, logo, the people to name on your site, your current website and tools), the changes you request, files you upload, your billing address, and the conversations you have with Trey in the portal or by email.
Booking a call: your name, email, phone and anything you want to discuss, so we can put the call on our calendar and send you the invite.
Information collected automatically
Google Analytics runs on tradesfront.com (not in the portal, and not on the sites we build unless a client installs their own tag). It sets cookies and reports aggregate statistics such as pages viewed, approximate location and traffic source. You can opt out with Google's browser add-on or by blocking cookies.
Forms and bot protection: when you send a form on this site, Cloudflare Turnstile checks that you are a person; it receives your IP address and browser details for that check, under Cloudflare's privacy policy. We also use your IP address to limit repeated submissions, for one hour, and never store it with your message.
Hosting logs: our hosting provider, Cloudflare, keeps routine technical logs, as any website host does. We read aggregate visitor counts from them for our own site and for clients' sites; nothing in those counts identifies a person.
Our phone line: calls to Tradesfront's own number go to voicemail. Voicemails are recorded, converted to text automatically, and kept so we can call you back.
Cookies and browser storage
| Name | Where | What it's for | How long |
|---|---|---|---|
| _ga, _ga_* | tradesfront.com | Google Analytics, described above | Up to 2 years |
| tf_chat_thread_id | app.tradesfront.com, set when you chat with Trey | Keeps your chat conversation together before you have an account | Until you clear it |
| better-auth.* | app.tradesfront.com | Keeps you signed in to the portal | Your session |
| tf_current_project | app.tradesfront.com | Which of your businesses the portal is showing, if you have more than one | Until you clear it |
| cf_* | Cloudflare, on both sites | Turnstile's bot check and Cloudflare's own security cookies | Cloudflare's retention |
Stripe sets its own cookies on its checkout page when you sign up. You can clear or block cookies in your browser; the portal will then ask you to sign in again.
Google account data
This section covers every piece of information Tradesfront receives from Google through its APIs, in the order Google asks us to disclose it.
What we access. When you sign in to the portal with Google, we receive your basic profile: your name, email address and profile picture. Nothing else from your Google account is requested; we never read your Gmail, Contacts, Drive or Calendar. Separately, members of the Tradesfront team authorize Google access on their own Tradesfront Google accounts so we can do the work our clients hire us for: Google Business Profile (the listing's details, services, hours, categories, reviews and performance numbers for client businesses that have added us as a manager), Google Ads Local Services (the leads, campaign status and budget of client accounts that have given us access), and Google Calendar (our own team calendar, to book calls you ask for).
How we use it. Your profile details create and secure your account and address you by name. Business Profile data is read to show you how your listing performs and changed only to make the edits you ask for or approve. Local Services Ads data is read to show you your leads and to send Google feedback on lead quality on your behalf; campaign settings are changed only as you ask. Calendar access creates the event for a call you booked.
How we share it. We do not sell Google user data, and we do not share it with anyone outside Tradesfront except the service providers that run our platform (Cloudflare for hosting and storage, and the AI provider that generates replies in the portal, which receives only what is needed for the reply). Nothing from Google is shared with other clients, advertisers or data brokers.
How we protect it. Google access tokens are stored encrypted in a secrets store and are never written to code, logs or email. All connections are encrypted in transit and the databases are encrypted at rest. Each client's data is kept behind that client's own account, and only the Tradesfront team members who need it can reach it, with multi-factor sign-in.
How long we keep it, and how to delete it. Your sign-in profile stays for as long as your account exists and is deleted within 30 days of your request to close it. Business Profile and Local Services Ads data is refreshed from Google and kept while the client remains a customer; Local Services Ads lead details are deleted after 365 days. Removing our manager access in Google, or emailing privacy@tradesfront.com, ends our access and we delete what we hold from it within 30 days, except billing records the law requires us to keep.
Limited Use. Tradesfront's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use Google user data only to provide or improve the features described here; we do not use it for serving advertisements, including retargeting, personalized or interest-based advertising; we do not sell it or transfer it to data brokers or information resellers; we do not use it to determine creditworthiness or for lending purposes; we do not transfer it except as needed to provide these features, to comply with the law, or as part of a merger or acquisition with notice to you; we do not use it to develop, improve or train generalized artificial intelligence or machine learning models; and humans do not read it except with your consent, for security purposes, to comply with the law, or for internal operations after it has been aggregated and anonymized.
If you're a client's customer
When you fill in a form on a site we built, we receive it on the business's behalf, deliver it to them (their CRM, their inbox, or a tool they chose) and keep a copy for up to 365 days so it appears in their portal and a failed delivery can be retried. When you call a tracking number on a client's site (Growth plans), we receive the number you called from, the time and length of the call, and, where the business has turned it on, a recording and an automatic transcript; the transcript is used to pull out your name and what you asked about so the business can follow up. Recordings are kept for 365 days. When you contact a business through its Google Local Services Ads, Google gives the business (and us, acting for them) your name and phone number, the type of request, and for calls the length and a recording link; we keep that for 365 days, and we use it to report on the ads and to tell Google when a lead was spam or a sales pitch.
The business you contacted decides what to do with your request. To exercise your privacy rights over something you sent a client, contact that business; if you'd rather ask us, email privacy@tradesfront.com and we'll handle it with them.
How we use information
- To provide what you signed up for: building and hosting your site, delivering your leads, tracking calls, reporting, managing your Google presence, Trey.
- To answer you and to send account messages: receipts, build progress, your monthly report, reminders about things waiting on you. We don't send marketing newsletters.
- To draft content for your site and answer questions with AI, from the facts you gave us.
- To keep the service secure and to stop spam and abuse.
- To improve the service in aggregate.
Who helps us handle it
These companies process information for us, only for the purposes above:
- Cloudflare: hosting, storage (files, photos, recordings), email delivery, bot protection, visitor statistics, and the speech-to-text that transcribes calls and voicemails.
- Anthropic: the AI model behind Trey and behind the content we draft. Conversations and the business facts needed for a reply are sent to generate it. Anthropic does not train on this data under our agreement with them.
- Google: sign-in to the portal; Google Analytics on tradesfront.com; Business Profile, Search Console, Local Services Ads and Calendar through the access described above; the Places service, to match service-area towns to Google's own place records.
- Stripe: payments and invoices.
- Telnyx: the phone service behind tracking numbers and our own line, including call recording.
- GitHub: stores the content of the sites we build, which includes the public reviews we publish on them.
- DataForSEO: search-ranking checks and public Google review data for clients' listings. It receives business names, locations and search phrases, not customer details.
Your leads are also delivered to wherever you point them (your CRM, your email, a webhook); from there, that provider's own policy applies. We may disclose information if the law requires it or to protect our rights. We don't sell or rent information, and we don't share it with unrelated businesses for their own marketing.
How long we keep it
- Client customers' form submissions, call records, recordings, transcripts and Local Services Ads leads: 365 days, then deleted automatically.
- Your account, business facts, site content and conversations with Trey: while your account is active. When you leave, your site stays up for a 30-day grace period, then we hand the domain back and archive the site content; we delete or return your data within 30 days of a request.
- Billing records and delivery audit logs: 3 years.
- IP addresses used for rate limiting: 1 hour.
Your privacy rights
Depending on where you live, including California, Colorado, Connecticut, Minnesota, Oregon, Texas, Virginia and other US states with privacy laws, you have the right to:
- know what personal information we hold about you and get a copy of it;
- correct information that is wrong;
- delete information you gave us, including a recording of a call you made;
- opt out of the sale of your information, targeted advertising and profiling (we do none of these);
- not be treated differently for using any of these rights.
To use them, email privacy@tradesfront.com. We'll confirm it's you by matching what you tell us to what we hold, and reply within 45 days. Someone you authorize can ask for you. If we turn down a request, reply to our answer and we'll look again. We treat a Global Privacy Control signal from your browser as an opt-out request; since we don't sell or share information, there is nothing further to switch off. Clients can export their lead data from the portal at any time.
Do Not Track
Some browsers send a "Do Not Track" signal. There is still no common standard for how sites should react to it, so we don't respond to it. The Google Analytics opt-out above does work.
Security
Everything is served over encrypted connections, data is encrypted at rest, access to each client's data is scoped to that client's account, secrets are kept in a secrets store rather than in code, and our infrastructure accounts use multi-factor sign-in. No system is completely secure, so we can't promise absolute security, and we'll tell you if something goes wrong with your data.
Children's privacy
Our services are for businesses and are not directed to children under 13; we do not knowingly collect their information, and we do not sell or share the information of anyone under 16.
Changes to this policy
We may update this policy. The date at the top changes when we do, and if a change materially affects how we handle information already collected, we'll email account holders before it takes effect.
Contact us
Questions about this policy: privacy@tradesfront.com, or send us a message.