Privacy Policy

Who we are

SubTrack is a product of Jacked Trade LLC. Jacked Trade LLC — not "SubTrack", which is a brand name and not a separate legal entity — is the controller of personal information processed through the Service. Contact: justin@jackedtrade.com.

Note the two relationships: for information about you, our customer, we act as controller. For information about your subcontractors that you upload, we act as a processor on your behalf — you decide what to collect and why, and we handle it under your instructions and this policy.

What we collect

Account information: your email address, and the email addresses and access levels of people you invite. We use emailed sign-in links, so we do not store passwords.

Content you upload: certificates of insurance, licenses, and related documents, together with the information extracted from them — company names, contacts, addresses, carriers, policy numbers, limits, and expiration dates. These documents may incidentally contain personal information about individuals at your subcontractors.

Usage and technical data: pages viewed, actions taken, timestamps, IP address, and browser user agent. We record IP and user agent when you accept our legal agreements, as evidence of that acceptance.

Communications: emails you send us and delivery metadata for emails we send on your behalf.

How we use it

To provide the Service — store and read documents, calculate compliance status, send reminders and requests. To secure the Service, investigate abuse, and meet legal obligations. To support you, bill you, and tell you about material changes. To understand aggregate product usage so we can improve it.

We do not sell personal information. We do not share it with advertisers. We do not use your uploaded documents to train machine-learning models for other customers or for our own general benefit.

Who we share it with

Service providers who process data on our behalf under contract, limited to what they need: cloud hosting and database, email delivery, automated document extraction, payment processing, and business enrichment lookups. Each is bound to use the data only to provide services to us.

Also: to comply with law or valid legal process; to protect rights, safety, and the integrity of the Service; and, if we're ever acquired or merged, to the successor entity, with notice to you.

How long we keep it

Customer Data is retained while your account is active and for 30 days after termination so you can export it, after which we may delete it. Records of legal-agreement acceptance are retained as long as needed to evidence the agreement. Backups may persist for a limited additional period before being overwritten on their normal cycle. Aggregate, de-identified usage statistics may be retained indefinitely.

Security

Data is encrypted in transit. Access is limited to what's needed to operate the Service. Sign-in uses single-use, time-limited emailed links rather than passwords; API tokens are stored hashed, never in plaintext. Every account's data is scoped to that account.

No system is perfectly secure. If a breach affects your personal information we'll notify you as required by law and without undue delay.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or port your personal information, to object to or restrict processing, and to withdraw consent. Residents of California, and of states with comparable laws, have rights including access, deletion, correction, and the right not to be discriminated against for exercising them. Since we do not sell or share personal information for cross-context behavioral advertising, there is nothing to opt out of on that front.

Exercise any of these by emailing justin@jackedtrade.com. You can also export your data yourself at any time from the dashboard. If your information reached us because a customer of ours uploaded it, we'll refer your request to that customer, who controls it.

Cookies

We use a single session cookie to keep you signed in. We do not use third-party advertising or cross-site tracking cookies. Product analytics are recorded server-side and tied to your account rather than to a tracking cookie.

Children, and international users

The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect information from children.

The Service is operated from the United States and data is processed there. If you access it from elsewhere, you're transferring information to the United States.

Changes

We'll post updates here with a new effective date and, for material changes, notify you by email or in the Service.