Privacy Policy
1. What we collect
- Email address (provided at signup)
- IP address (used for rate limiting and abuse detection)
- API usage logs: state, license number queried, timestamp, credits charged
- Stripe-provided billing metadata (last 4 digits, billing address via Stripe Customer object)
- Terms-acceptance audit record: timestamp, IP, user agent, accepted version
2. What we do not collect
No analytics trackers, no third-party cookies, no advertising pixels, no device fingerprinting, no behavioral tracking.
3. Third-party processors
- Resend — verification email delivery
- Stripe — payment processing and PCI scope
- Railway — application hosting
- Google Workspace — support email (hello@tradesapi.com)
4. Retention
- API usage logs: 90 days (verification history within the retention window is exportable on demand — see §5)
- Account email and key metadata: until deletion request
- Billing records: retained per Stripe and applicable legal requirements (typically 7 years)
- Terms acceptance records: retained for the lifetime of the account (deleted when the account is deleted)
5. Your rights
You may export your account's verification history (CSV or JSON) at any time from the customer dashboard. Exports are scoped to API keys you own and rate-limited.
Email hello@tradesapi.com to request deletion or export of any other data.
California residents may have rights under the CCPA, including the right to know, delete, and opt out of sale (we do not sell personal information). Residents of other jurisdictions should contact us to discuss applicable rights; we will honor reasonable deletion and export requests on a best-effort basis.
Note: TradesAPI is offered to and intended for businesses operating in the United States. If you are a resident of the European Economic Area, the United Kingdom, or another jurisdiction with comprehensive data protection laws, the service may not be appropriate for your use.
6. Using TradesAPI through AI assistants
You can connect TradesAPI to AI assistants such as ChatGPT and Claude. When you do:
- You sign in to your TradesAPI account and approve the connection. The assistant gets an access token tied to your account. It never sees your TradesAPI sign-in details.
- When you ask the assistant to check a license, it sends us only what the lookup needs: the state or city, the license number or business name, and the trade. We treat these like any other API request. They are logged as described in section 1, kept as described in section 4, and use credits from your account.
- We send the lookup results back to the assistant so it can answer you. The assistant's provider handles your conversation under its own privacy policy. We do not receive your conversation or any other messages.
- We do not use anything received through an assistant for advertising, and we do not sell it.
- You can disconnect TradesAPI in the assistant's settings at any time. Access tokens expire after one hour. To revoke all access or delete your data, email hello@tradesapi.com.
7. Security
API keys are stored as SHA-256 hashes; plaintext keys are never stored after the moment of generation. HTTPS is enforced everywhere. Verification email codes are single-use and consumed atomically (Redis GETDEL).
8. Contact
hello@tradesapi.com