Draft for attorney review, not yet in effect. This page describes how Tradesfile works today, in plain language. Items in [brackets] are waiting for the attorney.

Privacy Policy

Draft of November 15, 2026. Questions: support@tradesfile.ai.

This policy explains what Tradesfile stores, where it comes from, who helps us run the site, and the choices you have. We do not sell personal data and we do not sell leads.

Public license and permit records

Most of what the site shows comes from files that government agencies publish. We download them on a schedule, usually nightly, and keep the date each was read. License records come from:

California Contractors State License Board (CSLB)
Florida Department of Business and Professional Regulation (DBPR): construction and electrical contractors
New York City Department of Buildings (DOB): licensed trades
Oregon Construction Contractors Board (CCB)
Texas Department of Licensing and Regulation (TDLR): electricians and air conditioning contractors
Texas State Board of Plumbing Examiners
Washington State Department of Labor and Industries (L&I)
U.S. Federal Motor Carrier Safety Administration (FMCSA): motor carriers and their insurance filings

Building permits that name the contractor come from:

City of Austin
City of Chicago
City of Seattle
New York City Department of Buildings (DOB NOW)

These records can include a business or holder name, license number and type, city and ZIP code, status and expiry dates, insurance and bond dates, the insurer's name, and a phone number. Phone numbers are used only to match a sub to the right record. They are not shown on pages and we never call or text them.

Asking us to remove a public record

Every record page has a "Request removal" link. Give your name, email, how you relate to the record and why you want it removed.
We review each request by hand and email you when it is decided.
If we approve it, the record no longer appears in search, on its own page, in the directory or the lapsing list, or in answers from the JSON check. The leaderboard, which lists names from city permits, no longer links to it or shows its license status.
Contractors who already saved that business on a private list, or add it later, still see it matched on their own list, because checking your own subcontractor's license is the purpose of the site. Those lists are visible only to the account that owns them.
Removal from Tradesfile does not change the agency's record. To correct the record itself, contact the agency.
We keep your request (name, email, relationship, reason and decision) so we can show what was decided and why.

What we store when you use an account

Account: email, name, company, account type, plan and billing status, when you joined and when you confirmed your email. Your password is stored only as a salted scrypt hash. If you sign in with Google, we also store the account id Google gives us, and your name and email from Google.
Saved lists: the names, phone numbers and states you enter for each sub, the license each matched, and when its status last changed.
Profiles: what you add: name, trade, city and state, a headline and bio, years in the trade, the area you work, skills, what you are open to, work history, certifications with their numbers and expiry dates, and photos. Your profile page is public.
Messages to profiles: the name, email and message someone sends through a profile's contact form. They are shown to the profile owner on their account.
Training providers: the organization's name, city, state, website and description, and the decisions it makes on certifications.
Claims and requests: when you claim a license record, ask to pay for a plan before payments are on, or ask for a record's removal, we keep your email with that request.
Sign-in: a record of each signed-in session (a hashed token and when it expires), and single-use links for confirming email, resetting a password and changing email, each stored hashed. To slow down password guessing, failed sign-ins are counted by email and network address in memory for 15 minutes.
Email we send: a copy of every message is kept in a mail folder on our server.

Email we send

Links to confirm your email, reset your password or confirm a new email; a weekly summary of what changed on your saved lists; reminders about your certifications that run out within 90 days; and replies about removal requests. Alerts and reminders go only to confirmed addresses.

Who helps us run the site

Fly.io hosts the site and its database.
Stripe handles payments. Card details go to Stripe, not to us; we keep the Stripe customer and subscription ids and the plan status Stripe reports.
Resend delivers our email, so it receives each recipient's address and the message.
Google signs you in if you choose "Continue with Google". Pages also load their typeface from Google Fonts, so your browser asks Google's servers for it, which shares your network address and browser details with Google.

The people who run Tradesfile can see account details, saved lists and requests in order to run the site and answer you.

We do not sell personal data, share it for advertising, or sell leads. We do not use analytics or advertising trackers.

Cookies

One cookie keeps you signed in (tf_session, for up to 30 days). It holds a random token and nothing else.
Two short-lived cookies are used only for single steps: tf_pending holds a list you checked before signing up, for up to an hour, and tf_oauth protects a Google sign-in, for up to ten minutes.
No advertising or analytics cookies.

Your choices

Download your data: your account page has "Download my data", one file with your account, lists, profile, profile items and the messages your profile received. Passwords and sign-in links are not included.
Change your email: from your account page. The change happens only after you open a link sent to the new address.
Delete your account: from your account page, by typing your email to confirm. It deletes your account, sessions, saved lists, profile with its items, photos and messages, training provider page, license claims and plan requests, and our copies of email sent to that address. A paid plan must be cancelled first. Public agency records are not part of your account and stay, unless removed as described above.
To ask about your data, write to support@tradesfile.ai. [Rights under state privacy laws and response times to be added by the attorney.]

How long we keep data

Account data stays until you delete the account. Public records are refreshed from each agency and replaced when the agency's file changes. [Retention of server logs and backups to be confirmed.]

Changes

We will post changes on this page and email account holders before a material change takes effect.