Privacy Policy

Introduction

At SMBTruth ("we," "us," or "our"), we take your privacy seriously. As the Source of Truth for the trades, we understand that trust is our foundation. This Privacy Policy explains how we collect, use, protect, and share information when you use our platform.

1. Information We Collect

1.1 Information You Provide

• Account Information: Business name, owner name, email, phone number
• Business Details: Revenue range, years in business, service territory
• Trade Selection: Primary trade designation (must be >50% of revenue)
• Verification Documents: Business licenses, insurance certificates, tax documents (top line only), bank statements
• Pricing Data: Invoices, receipts, vendor pricing information
• Community Content: Forum posts, comments, Truth Circle discussions

1.2 Information We Collect Automatically

• Usage Data: Pages viewed, features used, time spent on platform
• Device Information: IP address, browser type, operating system
• Location Data: General geographic location for territory management
• Cookies: Session management and platform functionality

1.3 Information We DON'T Collect

• Social Security Numbers (automatically redacted)
• Full tax returns (only top-line revenue)
• Customer lists or personal client data
• Employee personal information
• Credit card numbers (processed by Stripe)

2. How We Use Your Information

2.1 Primary Uses

• Verification: Confirm you're a legitimate contractor, not a vendor
• Trade Classification: Ensure you're registered under your primary trade (>50% revenue)
• Territory Management: Protect your exclusive service area within your trade
• Platform Access: Provide appropriate features based on verification level
• Pricing Intelligence: Aggregate and anonymize data for community insights
• Communication: Send platform updates, verification reminders, trade activation notices

2.2 Secondary Uses

• Platform Improvement: Analyze usage patterns to enhance features
• Quality Control: Monitor for false data and vendor infiltration
• Support: Respond to inquiries and resolve issues
• Legal Compliance: Meet legal obligations and protect rights

3. How We Share Information

3.1 Within the Community

3.2 Third-Party Service Providers

We share limited information with essential service providers:

• Payment Processing: Stripe (payment information only)
• Infrastructure: AWS/hosting providers (encrypted data)
• Communication: Email service providers (contact info only)
• Analytics: Aggregated usage data only

3.3 Aggregated Data

We may share anonymized, aggregated insights such as:

• "HVAC contractors in Texas pay 23% above market average"
• "Q3 material costs increased 15% industry-wide"
• "Average member saves $50K annually"

Individual member data is NEVER included in these insights.

3.4 Legal Requirements

We may disclose information if required by law, court order, or to protect:

• The safety of our members or others
• Our legal rights and property
• Against fraud or security threats

4. Data Security

4.1 Security Measures

• Encryption: All data encrypted at rest and in transit (SSL/TLS)
• Access Controls: Role-based permissions, two-factor authentication available
• PII Protection: Automatic redaction of sensitive information
• Watermarking: Invoice tracking to prevent unauthorized sharing
• Regular Audits: Quarterly security reviews and updates

4.2 Data Retention

• Verification Documents: 90 days after verification complete
• Invoices: Retained while membership active + 1 year
• Account Information: Retained while active + 3 years
• Forum Content: Indefinitely (anonymized after membership ends)

5. Member Privacy Controls

5.1 Your Privacy Settings

• Forum Visibility: Choose to post with member number only
• Hot Deals Attribution: Optional after 48 hours
• Direct Messages: Only available at L2, same revenue band
• Truth Circles: Full transparency required (no anonymous option)

5.2 Territory Privacy & Protection

Territory Visibility

• Member IDs with trade shown on map (e.g., BF47-HVAC, SF23-Plumbing)
• Same geographic territory can have multiple trades (HVAC doesn't block Plumbing)
• Only same-trade members can trigger territory conflicts
• Exact address never shown publicly
• Only city/state visible to other members

Territory Overlap Resolution

Overlap Notifications Include

When territories overlap within the same trade, affected members receive:

• Business name and owner name of applicant
• Exact overlap percentage
• Service area details
• Contact information for discussion
• Clear deadline for response

6. Cookies and Tracking Technologies

6.1 Essential Cookies

• Session Management: Keep you logged in
• Security: Prevent unauthorized access
• Preferences: Remember your settings

6.2 Analytics Cookies

• Platform Usage: Understand feature adoption
• Performance: Monitor site speed and errors
• Improvement: Identify areas to enhance

6.3 What We DON'T Use

• Third-party advertising cookies
• Cross-site tracking
• Social media pixels
• Behavioral targeting

7. Your Rights and Choices

7.1 Your Rights

You have the right to:

• Access: Request a copy of your personal data
• Correct: Update inaccurate information
• Delete: Request deletion (subject to legal requirements)
• Port: Receive your data in a portable format
• Object: Opt-out of certain data uses
• Restrict: Limit how we process your data

7.2 How to Exercise Rights

Email us at [email protected] with your request. We'll respond within 30 days.

7.3 California Privacy Rights (CCPA)

California residents have additional rights under CCPA:

• Right to know what information we collect
• Right to delete personal information
• Right to opt-out of sale (we don't sell data)
• Right to non-discrimination

7.4 European Privacy Rights (GDPR)

While we focus on US contractors, we comply with GDPR principles:

• Lawful basis for processing
• Data minimization
• Purpose limitation
• Right to lodge complaints with supervisory authorities

8. AI Assistant and Intelligent Features

8.1 How Our AI Assistant Works

We're developing an optional AI assistant to help members find pricing insights faster:

• RAG System: Retrieval-Augmented Generation searches our pricing database to answer your questions
• Private LLM: Custom language model trained only on SMBTruth data, hosted on our servers
• Member Matching: Suggests connections based on similar challenges or vendor relationships
• Proactive Insights: Optionally alerts you to relevant new information

8.2 Data Used for AI Training

8.3 Your AI Privacy Controls

• Opt-In Required: AI features are OFF by default - you must explicitly enable them
• Data Selection: Choose what information the AI can access about you
• Query Privacy: Your questions to the AI are not stored or shared
• Delete Rights: Request removal of your contributions from AI training data
• Transparency: See exactly what data is used for AI responses

8.4 What the AI CANNOT Do

• Cannot identify you beyond your member number
• Cannot share your specific pricing with other members
• Cannot access your verification documents
• Cannot make decisions about your account
• Cannot share data with external AI services

8.5 AI Development Principles

8.6 Future AI Features (Roadmap)

As we develop new AI capabilities, we commit to:

• Announcing features 30 days before launch
• Providing opt-out options for all AI features
• Never changing privacy defaults without consent
• Regular audits of AI training data for privacy compliance

9. Children's Privacy

SMBTruth is not intended for anyone under 18 years old. We don't knowingly collect information from children. If we learn we've collected data from someone under 18, we'll delete it immediately.

10. Changes to This Policy

We may update this Privacy Policy as our platform evolves. We'll notify you of material changes via:

• Email notification to all members
• Platform announcement
• 30-day notice before changes take effect

Your continued use after changes means you accept the updated policy.

11. Contact Us

Privacy Questions

If you have questions about this Privacy Policy or our data practices:

• Email: [email protected]
• Support: [email protected]

Data Protection Officer

For formal privacy inquiries:
Magnet Mint, LLC
Attn: Privacy Officer
Sheridan, Wyoming

Complaints

If you're unsatisfied with our response, you may have the right to lodge a complaint with your local data protection authority.