Privacy notice

• We use one cookie that the site needs to work: it remembers your region. It is set when you first visit, with no banner, because the site cannot show the right prices and spelling without it.
• We measure how people use the site only if you accept analytics on the cookie banner. If you decline, no analytics code runs.
• We do not sell personal data, and we do not share it for advertising.
• Questions or requests: email michael@tradeflo.ie.

TradeFlo designs, builds and runs websites for trade businesses and workflow automation for construction firms. We run the site at tradeflo.ie. We are the controller of the data described in this notice, except where a client's customers contact that client through a site we built: then the client is the controller and we process the data for them (see section 8).

Contact for anything in this notice: michael@tradeflo.ie.

We are Michael Hallers, trading as TradeFlo, a sole trader based in Ireland. We have not appointed a representative in the UK or the US.

Postal address

27 Termonbarry, Bunclody, Co. Wexford, Y21 Y990, Ireland

Visitors

Your approximate region, set from your country when you arrive, so we can show the right currency, spelling and phone number. If you accept analytics: page views, clicks, scroll depth, device and browser type, where you came from, and session replays with typed text masked.

People who use a free tool or the website check

What you type in: a web address, business name, trade, service area or place, and a phone number or email if you ask for a report. We also read the public pages of the site you ask us to check.

Clients

Business name, contact name, phone, email, trade, location, billing details and payment records.

People who contact a client through a site we built

Name, phone, email and the message. We pass it to the client. We keep a copy for support and reporting.

We do not knowingly collect data from children, and the site is not for them.

If you decline analytics, no PostHog code runs and nothing else on the site changes. We honor a Do Not Track signal from your browser even if you accepted. To change your mind, clear the tf-consent entry from your browser storage and reload, or email us.

We do not sell your data, and we do not share it for advertising. These companies process data for us to run the site and the tools:

• Vercel: Hosts the website and its server code. Data location: United States: our server code runs in Washington, D.C. Covered by the EU-US Data Privacy Framework. Applies: every visit.
• Supabase: Holds our database and runs some server functions. Data location: Ireland: our database region. Standard contractual clauses in its terms cover any access from outside the EU. Applies: when you submit a form or a check, or are a client.
• PostHog: Measures how visitors use the site, including masked session replays. Data location: Frankfurt, Germany: PostHog's EU cloud. Covered by the EU-US Data Privacy Framework for any access from the US. Applies: only if you accept analytics on the cookie banner.
• Resend: Sends service emails such as inquiry alerts and report links. Data location: United States. Standard contractual clauses in its terms. Applies: when we email you about a check or an inquiry.
• Anthropic: Provides AI tools that read and summarize a website scan, and one of the AI assistants the AI mention check asks. Data location: United States, and its AI may run in other countries. Standard contractual clauses in its terms. Applies: when you run the website check or the AI mention check.
• Perplexity: Provides an AI search tool that the AI mention check asks. Data location: Not published, so we treat it as outside the EU. Standard contractual clauses in its terms. Applies: when you run the AI mention check.
• Google: Provides business profile data, page speed results and an AI tool used by the AI mention check. Data location: United States and the other countries where Google has facilities. Covered by the EU-US Data Privacy Framework. Applies: when you run the Google profile check, the site speed check or the AI mention check.
• Upstash: Counts requests so we can stop abuse of our tools. Data location: Ireland: the region of our database. Covered by the EU-US Data Privacy Framework for any access from the US. Applies: when you use a tool.

The full table, with links to each company's terms, is on the sub-processors page. A client's inquiries go to that client and to no one else.

Each company handles personal data under a data processing agreement with us. Where a company stores or reaches data outside the EU or the UK, the safeguards in section 6 apply.

Some of these companies are based in the US or process data there. When personal data from the EU or the UK goes outside those areas, we rely on a recognized safeguard: the EU-US Data Privacy Framework and its UK extension where the company has certified, or standard contractual clauses (with the UK addendum for UK data). Ask us if you want a copy of the safeguard for a given company.

• Analytics events: 1 year. Session replays: 30 days.
• Client account data: while they are a client, then 12 months.
• Inquiries sent to a client through their site: 24 months, or less if the person asks us to delete them.
• Website check and audit submissions: 12 months.
• Request counters used to stop abuse: 24 hours.
• Payment and tax records: 6 years. After that we remove the personal fields.

When someone inquires through a client's site, that client decides what happens to the data and we process it on the client's instructions. Our terms with clients are in the data processing addendum. If you contact a client and want to use your rights, ask the client first. We will help them answer.

Depending on where you live, you can ask us to:

• tell you what data we hold about you and give you a copy
• correct data that is wrong
• delete your data
• limit how we use it, or stop using it for a purpose
• send it to you in a portable format
• withdraw consent you gave, at any time

Email michael@tradeflo.ie. We answer within one month. We may need to check who you are first. You will not be treated differently for using these rights.

The EU General Data Protection Regulation and the ePrivacy rules apply. You can complain to the Data Protection Commission (dataprotection.ie), or to the authority in the EU country where you live or work.

The UK GDPR and the Data Protection Act 2018 apply to UK visitors and clients. You can complain to the Information Commissioner's Office (ico.org.uk). We would like the chance to fix a problem first, but you do not have to ask us before you contact the ICO.

We do not sell personal information, and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of in that sense. Residents of states with privacy laws, including California, can ask to know what we hold, to correct it and to delete it, using the email above. We do not collect sensitive personal information on purpose. We will not charge you more or give you worse service for using these rights.

If we deny a request you can appeal by replying to our answer with the word Appeal. Where the law lets you, you can then contact your state's attorney general.

Someone you choose can make a request for you. Before we act on any request, we may check that it comes from you.

The site and its tools are served over HTTPS. Our database separates one client's records from another's with row-level security. Server keys stay on the server and are never sent to your browser. Our tools limit how often one address can call them. No system is perfectly secure. If a breach affects your data we will tell you and the regulator where the law requires it.

More on how we handle data is on the security page.

If we change something that matters, such as a new company handling data or a longer retention period, we will update this page and its date. We will email active clients.