Privacy Policy

This Privacy Policy describes how JadeTrade Marketplace LLC (“JadeTrade,” “we,” “us”), operating under jadetradeapp.com, collects, uses, shares, and protects information when you interact with our website, booking page, outreach messages, preview sites, checkout flows, AI Services, or other interactions.

1. Who We Are

JadeTrade Marketplace LLC is a Maine limited liability company with its mailing address at 180 Bangor Mall Blvd. #1012, Bangor, ME 04401. For privacy questions, contact max@jadetradeapp.com.

2. Categories of Information We Collect

Information you provide directly

Information collected when you book a call

When you book a call through our booking page (provided by Cal.com), we collect:

• Your name and email address
• Your business website (required, so we can look at it before the call)
• The date and time you choose, and any other details you choose to give us
• A hidden reference code. If you book from a link in one of our messages, the link fills in this code (and may fill in your website) automatically, so we can tell which message the booking came from

We use this information to schedule and hold the call, to prepare for it (for example by looking at your website, ads, reviews, and how your calls get answered), and to connect the booking to our earlier conversation with you. You will receive an automatic booking confirmation and reminder emails about the call. Cal.com and our video-call provider may also collect technical information under their own privacy policies.

Information from public sources

When preparing outreach, building website previews and AI service templates, and preparing free bonuses (such as a Google Business Profile review or an ad landing check), we collect publicly available business information:

• Business name, address, phone, hours, website address, and published business email or contact form
• Services, pricing
• Photographs published publicly
• Customer reviews on Google, Yelp, and similar
• Public business directory listings
• Publicly visible ads and the pages those ads link to

We do not access password-protected, private, or non-public information. We do not scrape personal social media accounts.

Information collected automatically

Information related to AI Services (collected on behalf of our customers)

When a JadeTrade customer deploys our AI services, we collect on the customer's behalf the categories below depending on which archetypes are deployed:

Booked-Jobs Build services (missed-call text back, instant lead replies, quote follow-up, after-hours answering, review requests):

• Phone numbers of callers whose calls were missed, and the texts sent to and received from them
• Web form leads (any fields the person fills out) and the replies sent to them
• Your customers' names, phone numbers, email addresses, quote status, and replies, for quote follow-up
• After-hours call details (see voice and call data below) and appointments booked on your calendar
• Your customers' names, contact details, and job dates, for review requests

Voice and call data (AI Receptionist, Call Triage):

• Voice call recordings (only when Recording is opt-in elected by the customer) and transcripts
• Inbound caller phone numbers (from Twilio's Caller ID)
• Caller-provided information (name, business name, callback number, reason for call, email if shared)
• Booking metadata (timestamps, calendar event IDs, Cal.com booking confirmations)
• AI-generated structured analysis (outcome classification, opt-out flag, intent summary)

SMS and messaging data (SMS Sequencer, Inquiry Responder, Inventory Alert, Check-in / Nurture):

• Outbound message contents and timestamps
• Recipient phone numbers and message-status results (delivered, failed, opted out)
• Inbound replies, including STOP/UNSUBSCRIBE confirmations
• Recipient-list metadata uploaded by the customer (e.g., name, last-visit date, service tier)

Inquiry/intake data (Inquiry Responder, Document Generator, Text Quote Generator):

• Web form submissions (any fields the inquirer fills out)
• Inbound emails to monitored addresses (subject, body, attachments)
• AI-extracted structured data from intake (parties, scope, dates, amounts, requested service)

Photographic and document data (Photo Quote Generator, Claim Supplement Generator, Document Generator):

• Customer-uploaded photos (job sites, damage, items for valuation, invoices)
• Customer-uploaded denial letters, insurance policy excerpts, or other supporting documents
• AI-extracted measurements, conditions, and structured observations from images
• Generated PDF outputs (quotes, estimates, scopes, contracts, supplement letters)

Plan and structural data (Blueprint Takeoff, Permit Document Generator):

• Architectural plans, hand sketches, site plans uploaded by customer
• AI-extracted quantities, dimensions, materials, code references
• Generated takeoff bids and permit packages

Health-adjacent data (Insurance Verification, when BAA chain in place):

• Patient appointment schedule (date, time, provider, service)
• Payer eligibility responses (in-network status, copay, deductible remaining, prior auth status)
• Prior auth tracking notes
• Out-of-pocket text confirmations sent to patients

Marketing platform data (Multichannel Reporting):

• API-pulled metrics from Google Ads, Meta Ads, GA4, HubSpot, Salesforce, and similar platforms
• AI-generated commentary and insight summaries
• Generated PDF reports

Vendor integration data (Vendor Integration):

• Per-deal: API responses from Client's chosen vendor systems (e.g., COI brokers, queue systems, parts catalogs)

This data is owned by the JadeTrade customer (the business that deployed the AI), processed by us as their service provider, and governed by our Master Services Agreement with them. If you are an inbound caller, customer, patient, or recipient of a business using our AI, that business is the data controller of your information; contact them directly for access, correction, or deletion requests. For PHI specifically, the customer business is the Covered Entity; JadeTrade is a Business Associate only when a BAA is in place. We do not accept Protected Health Information unless a Business Associate Agreement has been signed. Please do not send health information through our booking form, our email, or our website.

Information we do not collect

• We do not use advertising trackers, social media pixels, or visitor-identification tools on jadetradeapp.com or preview sites. On jadetradeapp.com we use Vercel Web Analytics, a privacy-friendly analytics tool that does not use cookies, to count page views and see which pages are used, in aggregate. We do not use it to identify you or to follow you across other websites.
• We do not sell, rent, or trade personal information.
• We do not knowingly collect information directly from individuals under 16 through our website or checkout flow. See Section 13 for child information that may be voluntarily provided by adults to AI Services we operate on behalf of customer businesses.

3. How We Use Information

We use information solely to:

• Build website previews and configure AI Services using your publicly available business information
• Schedule calls you book with us, send booking confirmations and reminders, and prepare for those calls
• Match a reply, preview visit, or booking to the outreach message it came from, using the reference code in that message
• Prepare free bonuses you receive (such as a Google Business Profile review or an ad landing check)
• Process payments through Stripe
• Deliver approved websites and operate AI Services
• Send transactional communications (payment confirmations, DNS instructions, service notifications)
• Send commercial outreach, including a small number of follow-ups, to business addresses and business website contact forms (you may opt out at any time)
• Improve our Services and website through aggregated, de-identified analytics
• Comply with legal obligations and enforce our Terms

We will not use your email for marketing newsletters unless you explicitly opt in. All commercial outreach complies with CAN-SPAM and includes an opt-out mechanism.

4. Cold Outreach

As part of our business model, we contact business owners about our Services. These communications go to business email addresses obtained from public sources and to the contact forms on businesses' own websites. We do not send cold text messages. All outreach email complies with the CAN-SPAM Act of 2003 and includes:

• Our physical mailing address
• Accurate sender identification
• Clear identification as commercial communication
• A working opt-out mechanism (reply “STOP” or “no,” or use the unsubscribe instruction)
• Honest subject lines

Reference codes and links.Each outreach message includes a short reference code. Links in our messages (for example to a preview of your new website or to our booking page) may carry your business's website address and that code. We use them only to know which message a reply, visit, or booking came from, to follow up properly, and to honor opt-outs. We keep a record of the messages we send, the reference code, and any reply or opt-out.

Replying “STOP” or “no” ends our outreach permanently. Opt-outs are honored within ten (10) business days and the business is added to our permanent exclusion list. We will not contact you again across any channel.

For SMS sent to any JadeTrade-controlled phone number, we treat any inbound message containing “STOP,” “UNSUBSCRIBE,” “REMOVE,” or similar as a binding opt-out and add the sender to our exclusion list.

For inbound voice calls to our AI receptionist, any verbal opt-out request (“remove me,” “stop calling,” “do not contact me”) is binding and triggers exclusion.

5. Third-Party Service Providers

We share information only with the following service providers, solely to deliver our Services:

We do not sell your information to data brokers, advertisers, or any other third parties. We do not share your information for cross-context behavioral advertising.

6. Call Recording (AI Services)

Recording is enabled only when the JadeTrade customer (the business operating the AI receptionist) has affirmatively elected Recording ON in their Statement of Work. When recording is OFF, no audio is captured or stored; only intake fields the caller provides verbally are converted to text by the speech-to-text layer for the operational purpose of routing the call.

When recording is ON:

• The opening message includes the disclosure: “Calls are recorded for quality. If you'd prefer not to be recorded, please hang up now and call back during our staffed hours.”
• Continuing the call after this disclosure (staying on the line) constitutes consent to recording in jurisdictions where consent may be inferred from continued participation. JadeTrade maintains a per-call audit log of the disclosure timestamp, the timestamp the caller continued the conversation, and the call ID, available on request as evidence of consent.
• Transcripts and (when Recording ON) audio clips are stored in LiveKit's agent-observability infrastructure for the duration of the JadeTrade customer's service plus thirty (30) days post-termination, then deleted. LiveKit's default observability retention window is 30 days; recordings retained beyond that are migrated to JadeTrade-managed storage (AWS S3 US-region, encrypted at rest) for the customer service term plus 30 days, then deleted.
• Recordings are available to the JadeTrade customer via dashboards or on request, and may be reviewed by JadeTrade only for quality assurance, debugging, model improvement using de-identified data, or upon customer request.

State-specific notice for callers. Several U.S. states (including CA, CT, DE, FL, IL, MD, MA, MI, MT, NV, NH, PA, WA, and others) require all-party consent for recording. If you do not consent to being recorded, you may hang up after the disclosure and call back during the business's staffed hours, or contact the business through a non-recorded channel. A per-call mid-call opt-out is not currently supported; this Privacy Policy will be updated when that capability becomes available. To request deletion of a specific recording, contact the business that operates the AI receptionist or email max@jadetradeapp.com with the date and approximate time of your call.

7. Categories, Purposes, and Retention

The table below maps each category of personal information we collect to the purpose for which it is used and the retention period applied to it.

Sensitive personal information

Depending on what callers voluntarily disclose, the AI Services may receive sensitive personal information including: precise geolocation (if a caller states their address), health information (if a caller mentions a medical condition or appointment context), financial information (if a caller mentions account or balance details), insurance information, account credentials (if mistakenly shared), and information of household members or minors (e.g., a parent calling on behalf of a child for childcare or pediatric services).

We use sensitive personal information only for the purpose for which it was provided (operating the Services on behalf of our customer). We do not use it for inferences about you, for advertising, or to identify your characteristics. You may request that we limit use of sensitive personal information to what is reasonably necessary to perform the Services.

You may request deletion at any time per Section 9.

8. Data Security and Storage Locations

We implement reasonable technical and organizational security measures:

• All transmission encrypted via TLS/SSL
• Payment processing handled by Stripe (PCI-DSS Level 1)
• Access controls limit who can view customer data (access is restricted to JadeTrade personnel and authorized contractors with a need-to-know basis)
• Third-party providers selected for security posture (SOC 2, ISO 27001 where applicable)
• Authentication on admin systems with multi-factor authentication where supported

Storage locations. Customer data is stored in the following locations depending on category:

• Voice recordings, transcripts, and call analysis: LiveKit infrastructure (US-region, encrypted at rest with AES-256 / TLS 256-bit in transit) for active observability window; OpenAI infrastructure (US-region) transiently during the realtime model session itself; AWS S3 US-region for any audio retained beyond LiveKit's observability window
• SMS message content and delivery logs: Twilio infrastructure (US-based cloud provider, encrypted at rest)
• Generated PDFs, photos, plans, and other uploaded documents: Amazon Web Services S3 (US-region buckets, encrypted at rest with AWS-managed keys), Vercel-hosted storage where applicable, and/or local processing infrastructure operated by JadeTrade in the United States, encrypted at rest, with access restricted to authorized personnel
• Operational logs and per-deal configuration: Local processing infrastructure operated by JadeTrade in the United States, with daily backups, encrypted at rest
• Payment records: Stripe infrastructure
• Email communications: Microsoft 365 (Outlook) infrastructure
• Calendar and booking data: Cal.com infrastructure (and HighLevel/LeadConnector infrastructure for client calendars, where used)
• Booked-jobs automation, messaging, and voice AI data (where used): HighLevel/LeadConnector and Vapi cloud infrastructure

Backups. Operational data is backed up daily to a separate location. Backups are encrypted, retained for 30 days, then rotated.

Customer requests for data location specifics for a particular engagement should be directed to max@jadetradeapp.com.

However, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

In the event of a confirmed breach affecting personal information, we will notify affected parties and applicable authorities without unreasonable delay and in accordance with the timeframes required by applicable law.

9. Your Privacy Rights

Depending on your jurisdiction, you may have the right to:

We will respond to requests within forty-five (45) days (extendable by another 45 days for complex requests, with notice). We may verify your identity by email confirmation or, for sensitive requests, additional confirmation. Requests are free where required by law; in particular, Virginia residents may submit at least two (2) free requests per twelve-month period under the VCDPA, and California residents may submit at least one (1) free request per twelve-month period under the CCPA/CPRA. We may charge a reasonable fee or refuse manifestly unfounded or excessive repeat requests, where permitted by law.

If you authorize an agent to act for you, we may require the agent to provide proof of authorization.

10. California Residents (CCPA/CPRA)

If you are a California resident, you have the rights listed in Section 9 under the California Consumer Privacy Act and California Privacy Rights Act.

Categories of personal information collected in the past 12 months:

• Identifiers (name, email, phone, business name, billing address, callback numbers from inbound callers, recipient phone numbers from Client-provided SMS lists)
• Commercial information (transactions, services purchased, communication preferences)
• Financial information (card last-four and billing ZIP, processed by Stripe; bank or transaction metadata where Client provides for accounting reports)
• Audio recordings (AI service callers; see Section 6) and call transcripts
• Inquiry and intake content (web form submissions, inbound emails, AI-extracted structured fields)
• Photographic and document data (uploaded photos, denial letters, invoices, plans, sketches, generated PDF outputs)
• Health-adjacent data (BAA-gated, Insurance Verification archetype only: appointment schedules, payer eligibility responses, prior auth status)
• Internet activity (Vercel hosting logs: IP, browser, pages visited; aggregated, cookie-free page analytics; reference codes in outreach links)
• Geolocation (only if voluntarily disclosed by an inbound caller; not collected via device sensors)
• Professional information (business name, business website, and role)
• Inferences (AI-generated structured analysis of calls and inquiries: outcome classification, opt-out flag, intent summary)
• Marketing platform data (API-pulled metrics from Google Ads, Meta Ads, GA4, HubSpot, Salesforce; Multichannel Reporting customers only, with Client's connected account credentials)
• Vendor integration data (API request/response data from Client's chosen vendor systems for Vendor Integration archetype customers, only when Client has signed a Vendor Integration Addendum naming the specific vendors)

Sources: directly from you (including our booking form), from public business directories and business websites, from our service providers, and from JadeTrade-customer Clients on whose behalf we operate AI Services (e.g., recipient lists Client uploads for SMS sequences).

Purposes: as listed in Section 3.

Disclosure to third parties: only to the service providers in Section 5, under contracts limiting their use.

No sale or sharing. We do not sell personal information for monetary or other valuable consideration. We do not share personal information for cross-context behavioral advertising.

Sensitive personal information. As described in detail in Section 7, the AI Services may receive sensitive personal information from inbound callers and customer-business uploads. We use sensitive information only for the purpose for which it was provided and never for advertising, profiling, or characterizing you. California residents may request that we limit our use of sensitive information per CPRA § 1798.121.

11. Other State Privacy Laws (VA, CO, CT, UT, TX, OR, MT, IA, TN, IN, DE, NJ, NH, and others)

Residents of states with comprehensive consumer privacy laws, including but not limited to Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), Iowa (ICDPA), Tennessee (TIPA), Indiana (DPDPA), Delaware (DPDPA), New Jersey (NJDPA), New Hampshire (NHDPA), and any equivalent comprehensive privacy law enacted after the Effective Date, have substantially the same rights listed in Section 9. We will respond to verifiable requests within the timeframes required by your state law (typically 45 days). Appeals are addressed within the timeframes required by your state law (typically 45-60 days).

12. International Users (GDPR / UK GDPR)

If you are in the European Economic Area, United Kingdom, or Switzerland, our lawful bases for processing are: contract (to provide services you requested), legitimate interests (to operate and improve our Services, send commercial outreach to businesses), and consent (where required for cookies or marketing).

You have the rights of access, rectification, erasure, restriction, portability, and objection. You may lodge a complaint with your local supervisory authority. For data transfers outside the EEA, we rely on Standard Contractual Clauses with our processors where applicable.

13. Children's Information

Our website (jadetradeapp.com) and direct services are not directed to individuals under 16, and we do not knowingly collect personal information from children through our website or checkout flow.

The AI Services we configure for customer businesses may, however, be deployed on phone lines belonging to businesses that serve families or children, for example, childcare centers, tutoring services, pediatric or family practices, music schools, and similar. In those contexts, callers may voluntarily provide a child's name, age, or scheduling preferences to facilitate booking or intake.

When this occurs:

• We process the information solely to provide the Services to the customer business that operates the AI receptionist (the data controller of the child's information)
• We do not use child information for advertising, profiling, or any purpose beyond the immediate operational task requested by the caller
• The customer business is responsible for compliance with COPPA (for under-13 information), state-level child-privacy laws, and any parental-consent requirements applicable to its industry
• A parent or guardian may contact max@jadetradeapp.com to request deletion of a child's information; we will coordinate with the operating customer business to comply within thirty (30) days

If a customer business intends to operate the AI Services in a way that knowingly collects information from children under 13, we require additional contractual protections including the customer's representation that COPPA-compliant parental consent has been obtained. Otherwise, the AI is configured to capture only the minimum information needed to route the call and is instructed not to solicit further information from minors.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified to active customers by email at least thirty (30) days in advance. Non-material changes are effective immediately upon posting. The “Effective” date at the top reflects the most recent revision.

15. Contact

For privacy questions, requests, or complaints:

JadeTrade Marketplace LLC
180 Bangor Mall Blvd. #1012
Bangor, ME 04401
max@jadetradeapp.com