Privacy Policy | Tradalytix Marketing

1. Introduction

Tradalytix Marketing ("we", "our", or "us") provides a software-as-a-service (SaaS) platform for field service businesses. This Privacy Policy governs your use of the Tradalytix platform natively hosted, our API endpoints, and our official website (collectively, the "Services").

We operate as a Data Processor on behalf of our clients (Data Controllers) when providing our platform. This policy explains what data we collect, why we collect it, how it is used, and the rights you have over your data.

2. Categories of Information We Collect

We collect and process the following categories of information:

Account & Administrator Information: Name, email address, corporate billing address, and authentication credentials necessary to provision your workspace.
Marketing & Advertising Metadata: IP addresses, Google Click Identifiers (GCLID), Web/App tracking IDs (WBRAID/GBRAID), and anonymized device fingerprints required to execute attribution mapping.
Field Service Data: When synced via API, we process aggregated invoice values, job disposition statuses (e.g., "Estimate Scheduled", "Closed Won"), and geographic service zones to calculate Return on Ad Spend (ROAS).
Communication Data: In-app messaging, support tickets, and email correspondence related to technical onboarding.

3. How We Use the Data

We strictly limit the use of data to the functional operation of the Tradalytix platform:

Platform Operation: Delivering the automated bid-management algorithms and attribution reporting UI.
API Connectivity: Facilitating secure OAuth 2.0 transmissions of offline conversion payloads back to the Google Ads API.
System Diagnostics: Monitoring server health, API rate limits, and securing against unauthorized access.
Feature Updates: Sending necessary administrative alerts regarding software updates, API deprecations, or billing notices.

Crucially: Tradalytix Marketing DOES NOT "sell", "rent", or "broker" any customer data to third-party data aggregators. We do not use your workspace data to train shared models for competitors.

4. Third-Party Subprocessors & API Integrations

To provide our Services, we utilize specific, vetted third-party infrastructure providers. These Subprocessors are contractually bound to strict data processing agreements:

Amazon Web Services (AWS) / Oracle Cloud: Infrastructure and database hosting.
Stripe: Payment and subscription processing.
Twilio / Resend: Transactional SMS and email delivery for platform alerts.
Google Ads API / Google Cloud: Transmission of hashed conversion data (GCLID/SHA-256) strictly for your account's algorithmic bidding optimization. We use the Google Ads API strictly as a vehicle to transport offline conversion data back to your own authorized Google Ads accounts.

5. Data Retention & Deletion

We retain Customer Data only for as long as necessary to provide the Services. Active workspaces retain historical attribution data in accordance with their subscription tier.

Account Termination & Data Erasure: Upon workspace termination or a direct "Right to be Forgotten" request, all associated PII, attribution logs, and API tokens are cryptographically destroyed from our active databases within 30 days. Minimal aggregated, anonymized telemetry may be retained solely for internal capacity planning.

6. Jurisdictional Rights (GDPR & CCPA/CPRA)

If you are a resident of the European Economic Area (EEA), United Kingdom (UK), or California, you have specific rights regarding your personal data:

Right to Access: You may request a copy of the personal data we hold about you.
Right to Correction: You may request that we correct incomplete or inaccurate data.
Right to Erasure: You may request deletion of your data where there is no legitimate ongoing business need to process it.
Right to Restrict Processing: You may object to the processing of your personal data for direct marketing purposes.

To exercise these rights, please contact our Data Protection Officer at privacy@tradalytixmarketing.com. We will respond to all legitimate requests within 30 days.

7. Security Protocols

We implement enterprise-grade security to protect your data. This includes AES-256 encryption at rest, TLS 1.3 encryption in transit, strict Role-Based Access Control (RBAC) for internal engineering access, and regular vulnerability scanning of our API endpoints.

8. Google API Services User Data Policy Compliance

Tradalytix Marketing's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, concerning data obtained via the Google Ads API or any other Google Workspace APIs:

Prohibition of Data Sales & Retargeting: We will never sell, broker, or transfer your Google API data to third-party advertising platforms, data brokers, or use it for retargeting purposes outside the explicit intent of our software (which is to upload offline conversions exclusively back to your own managed Google Ads accounts).
Human Access Restrictions: Human access to user data acquired via Google APIs is strictly prohibited. Exceptions are only permitted if (a) we obtain your specific affirmative agreement to view the data for a support issue, (b) it is necessary for a security or fraud investigation, (c) it is required to comply with applicable law, or (d) the data is aggregated, anonymized, and used solely for internal operations to improve the platform infrastructure.
Data Minimization: We only request the minimum OAuth scopes necessary to provide the core attribution mapping features of the Tradalytix platform.

9. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes to our software practices or for legal compliance. We will notify active administrators of significant material changes via email or an in-app persistent notification prior to the change becoming effective.

Contact Information:

Tradalytix Marketing Legal Team

privacy@tradalytixmarketing.com