Privacy Policy

1. Information we handle

• Contractor account. Your business name, your name, trade, account email, your business phone and website, a securely hashed password (never the plain password), optional payment handles (Venmo, PayPal, Cash App) you choose to add, and the referral reward amount you set. If you sign in with Google, we receive your name and verified email address from Google to create or access your account — we never receive or store your Google password. When you sign the referral agreement, we record the name you sign with, the date, and the IP address, as the signature record.
• Contacts you import. If you use the contacts feature, we store the name, email address, and (when provided) phone number of each contact you add or import. That information is used only to send your referral asks — it is never sold or shared with third parties, and you can delete any contact at any time from your contacts page.
• Referral records. Information entered when a referral is created — the referrer's name and contact, the homeowner's name, email, or phone, an optional job description, and the referrer's eligibility confirmation along with the IP address and timestamp recorded at the time it was made. While the referral is still pending, either party may withdraw it and remove this information using the link on their referral page.
• Email activity. A log of the transactional emails the service sends or simulates (for example a homeowner confirmation or a password-reset link), and whether a recipient has asked to stop receiving them.
• Mailbox connection. If you connect a Gmail or Outlook account, nod stores your OAuth tokens encrypted at rest. The tokens are used to send outreach email from your own address and — if you choose to import them — to read your contacts so you can build your outreach list. You can disconnect at any time from your dashboard; disconnecting or deleting your account removes the tokens immediately.
• AI-generated copy. If you use the social caption, personal Text/Email, or outreach features, your business name, trade, reward, tracking link, and any context note you type are sent to Anthropic (the AI provider) to produce a draft caption or message. Anthropic does not use this data to train its models. The feature works without enabling AI — polished built-in templates are used instead.
• Message performance (to improve the suggestions). We record whether the referral link in a message you generate or send is clicked and whether it leads to a referral. We use these outcomes — aggregated and anonymized across all nod contractors — to learn which copy patterns convert and improve the drafts the tool suggests for everyone. Only aggregate patterns are used: your business identity, your contacts, and the actual text of your messages are never shared with, shown to, or attributed to any other business.
• Subscription billing. If you subscribe, our payment processor (Stripe) handles your card details — nod never sees or stores card numbers. We retain only the identifiers Stripe gives us to associate your subscription with your account.
• Technical basics. A single session cookie — used to keep you signed in, protect forms against forgery, and (when you arrive via a shared referral link) connect your referral to the message that brought you — plus ordinary server logs needed to operate and secure the service. We use no analytics or third-party tracking scripts.

2. How the information is used

• To run the referral tool: show your dashboard, generate share links, and let you mark a referral as paid (a record only — no money moves through nod).
• To send transactional email you or your referrers expect (confirmations, reminders, password resets). We honor unsubscribe requests.
• To provide and bill the contractor subscription, separately from the referral rail.
• To improve the AI suggestions: we learn which copy patterns convert from anonymized, aggregated message outcomes across all contractors — never from any single business's identity, contacts, or message text in a way that is shared between businesses.
• To secure the service, prevent abuse, and meet legal obligations.

3. What we do not do

• We do not sell personal information.
• We do not move referral-reward money; rewards are paid by the contractor directly, using the contractor's own payment method.
• We do not store payment-card details.

4. Sharing

Information is shared only with service providers that help us operate nod — such as our hosting provider, our email-delivery provider, and our payment processor (Stripe) — and only as needed to provide the service, or when required by law.

5. Retention & your choices

We keep account and referral records for as long as your account is active and as needed for legitimate business and legal purposes. You can edit your business profile and account email in Settings, and you can ask us to access, correct, or delete your information.

6. Your deletion rights

You have the right to request deletion of your personal information. nod provides in-product paths to do this without having to contact us:

• Delete a contact. From your Contacts page, click Remove next to any contact to permanently delete their name and email from your contact list. Entries in your email activity log are kept until you delete them from Notifications or delete your account.
• Delete a referral (contractor). From your Dashboard, click "Delete referral" on any referral row to permanently remove the referral record, its agreement, and its associated email log.
• Withdraw a referral (referrer or homeowner). While a referral is still pending, anyone who holds the referral link (the referrer or the homeowner) can visit that link and choose "Remove my information" to permanently delete the referral record. Once the homeowner confirms the job, the referral becomes the contractor's payout record and can no longer be removed through the public link — you can still ask us, or the contractor can delete it from their dashboard.
• Delete your account. From Settings, open the Danger zone, download your data first (optional), then enter your password and type DELETE to permanently remove your account, all referrals, all contacts, and all settings. We cancel your subscription first so you are not billed after deletion, and you can sign up again at any time. Unsubscribe records are retained so we never email you again, and we keep a minimal log of processed Stripe webhook events; our payment processor (Stripe) retains its own records of your customer and payment history as required by law. If you told us why you left, we keep only an anonymized reason (no name, no free-text) to improve the product.

Deletions are permanent and immediate in the live service — there is no grace period in the current version. Deleted data may still exist in our routine service backups for a limited period (daily backups are kept 14 days; weekly backups up to 8 weeks) before being automatically purged. Backups exist only for disaster recovery and are never used to restore data you deleted.

7. Contact

For privacy-related inquiries, email us at info@tradesource.app.