1.Introduction
This Privacy Policy explains how TrafficNodes ("TrafficNodes", "we", "us" or "our") handles personal data when you visit trafficnodes.com, create or use an account, or use our marketplace, dashboards and API (together, the "Service"). It also explains the choices and rights you have.
In short: we collect what we need to run a professional marketplace and keep it secure. We do not sell personal data, we do not use third-party advertising or analytics trackers, and when you sign in with Google we receive only basic identity information — see Google Sign-In and Google user data.
2.Who we are and scope of this policy
TrafficNodes operates the Service and decides how and why personal data is processed for it; for the purposes of data-protection laws that use these terms, TrafficNodes is the controller of that data. You can reach us about anything in this policy at support@trafficnodes.com.
This policy applies to personal data processed through the Service. It does not apply to third-party websites, platforms or services you reach through the Service, which have their own privacy policies. Information that sellers and buyers exchange with each other and then use outside the Service is the responsibility of the party using it.
3.Information we collect
We collect personal data in three ways: information you provide to us, information collected automatically when you use the Service, and information we receive from third parties such as Google when you choose to sign in with them. The following sections describe each category. The Service does not currently include a document-upload flow for identity or business verification; if we introduce one, we will update this policy before it begins. Please do not submit special categories of personal data (such as health data) or government identification documents through the Service.
4.Information you provide
- Account information — your email address and password when you register with email (passwords are stored by our authentication provider in hashed form; we never see them in plain text), and your display name.
- Seller application and seller profile — if you apply to sell: the display name, public profile address (slug), country, description and pitch you submit, and the review outcome.
- Marketplace content — Node listings and Node Passport details, buyer requests and their descriptions, budgets and targeting, responses to buyer requests, offers, reviews, and bundles you create.
- Transaction content — order details, service requirements, deliveries and revision requests, transfer notes and evidence, dispute statements and evidence links, and messages exchanged within an order between the buyer and the seller.
- Workspace content — watchlists, saved items, network, stack and workflow configurations, templates, team names and the email addresses of people you invite to a team, the names and scopes of API clients you create (we store only a one-way hash of API secrets), integration connection records (which do not contain third-party passwords or keys), and the in-app notifications we generate for you.
- Communications — the content of emails and other messages you send us, such as support requests, privacy requests and security reports.
5.Information collected automatically
- Session and authentication data — the cookies and tokens that keep you signed in (see Cookies and similar technologies).
- Technical request data — when your browser or API client connects to the Service, our servers and hosting infrastructure receive standard request information such as your IP address, the date and time, the page or endpoint requested, and technical headers sent by your browser. We use IP addresses and account identifiers to apply rate limits and protect the Service against abuse; this throttling data is held in server memory only for a short window and is not stored in our database.
- Activity and audit records — records of significant actions on the Service, such as changes to listings, orders, transfers, account status and administrative actions, and a limited set of first-party product events (for example, that a buyer request was created). These records are linked to your account and are used for security, integrity, support and improving the Service. They are not shared with advertising or analytics companies.
- Preferences — your interface language is taken from the address of the page you visit, and one interface preference (whether the dashboard sidebar is collapsed) is stored in your browser's local storage.
We do not use third-party analytics services, advertising pixels, cross-site trackers or fingerprinting on the Service.
6.Marketplace and transaction information
TrafficNodes is a marketplace, so some information is public by design. Please consider this before you post it:
- Public profile information — your display name, profile handle, profile image (if any), bio and country can be visible to other users and visitors.
- Seller profiles — for approved sellers, the seller name, description, country, member-since date, verification status, listings, reputation metrics (such as Seller Score, completed sales, dispute rate, on-time transfer rate and ratings) and reviews are public.
- Listings and buyer requests — Node listings, Node Passports and buyer requests you publish are visible to visitors of the Service.
- Reviews — reviews you write are shown with the author name attached to them.
Order details, order messages, transfer evidence and dispute materials are not public. They are visible to the buyer and seller involved in the order and to authorized TrafficNodes personnel.
At the date of this policy, no payment provider is connected to the Service and we do not collect or store payment-card numbers, bank-account details or other payment credentials. Balances, escrow states and ledger entries shown in the Service are simulated records. If we introduce real payment processing, we will update this policy before it begins.
7.Authentication and identity information
Accounts are managed through our authentication provider, Supabase. For each account we hold a unique user identifier, your email address and whether it has been verified, the sign-in methods linked to your account (email and password, and/or Google), timestamps such as when the account was created and last signed in, and your account status and roles (for example, buyer, seller or administrator). Our authentication provider also records the IP address and browser user agent associated with sign-ins and sessions, for security purposes.
If you register with email, we send you a verification email, and we may send password-reset emails when you request them. These authentication emails are sent through our authentication provider, directly or through the email-delivery service configured for it.
8.Google Sign-In and Google user data
You can choose to create an account or sign in with your Google account. This section explains exactly how TrafficNodes accesses, uses, stores, shares, retains and deletes the information we receive from Google ("Google user data").
What we access
TrafficNodes requests only Google's basic sign-in scopes: openid, email and profile. Through them, Google shares with us:
- your Google account identifier (a unique ID for your Google account);
- your primary Google email address and whether Google has verified it;
- your name as shown on your Google profile; and
- the address of your Google profile picture, if you have one, and other basic profile information Google includes in the profile scope.
We do not request access to your Gmail messages, Google Drive files, Google Calendar, Google Contacts, or any other content in your Google account, and we do not request permission to act in Google services on your behalf.
How we use it
We use Google user data only to:
- authenticate you and link your Google sign-in to your TrafficNodes account;
- create, establish and maintain your account and session;
- populate basic account information — for example, using your Google name as your initial display name, which you can change;
- protect the security of your account and detect and prevent fraud and abuse; and
- provide the account functionality you request, including contacting you about your account at your email address.
How we store it
Google user data is stored in your account record in our authentication system, which is operated for us by Supabase, and your display name is stored in your TrafficNodes profile. Google issues OAuth access tokens as part of sign-in; we discard Google's access and refresh tokens from your session immediately after sign-in and do not retain them to access Google services. We use the sign-in only to establish your TrafficNodes session. Your display name, which may initially come from your Google profile, is also recorded in the orders, reviews and similar records you take part in; those records keep the name as it was at the time, even if you later change your display name.
How we share it
We do not sell Google user data and do not share or transfer it to third parties, except: to service providers that process it on our behalf to provide the Service (Supabase, for authentication and data storage, and our hosting provider); where necessary to comply with applicable law or a valid legal request; to protect the security of the Service and its users; as part of a merger, acquisition or sale of the Service's assets, subject to this policy; or with your explicit consent. Your display name may be shown publicly as described in Marketplace and transaction information, but your Google email address is not shown publicly.
How we retain and delete it
We keep Google user data for as long as your TrafficNodes account exists. You can ask us to delete your account and associated Google user data at any time by emailing support@trafficnodes.com from the address associated with your account; see Account and data deletion. You can also remove TrafficNodes' connection to your Google account at any time in your Google Account's security settings (third-party connections). Removing that connection does not by itself delete your TrafficNodes account or the data already in it.
Our Limited Use commitments
- We use Google user data only to provide and improve the user-facing sign-in and account features described above.
- We do not sell Google user data, including to data brokers or information resellers.
- We do not use or transfer Google user data for serving advertisements, including targeted, personalized, retargeted or cross-context behavioral advertising.
- We do not use Google user data to determine creditworthiness or for lending purposes.
- We do not use Google user data to build databases or profiles for purposes unrelated to the Service.
- We do not use Google user data to develop, improve or train generalized artificial-intelligence or machine-learning models.
- We do not allow humans to read Google user data except with your consent (for example, when you ask us for help with your account), where necessary for security purposes (such as investigating abuse), to comply with applicable law, or where the data has been aggregated and anonymized for internal operations.
10.How we use personal data
- To provide the Service — creating and managing accounts, operating the marketplace, displaying listings, profiles and buyer requests, running orders, transfers, messages, disputes, teams, API access and other features you use.
- To review sellers and listings — processing seller applications, moderating listings and content, and calculating Node Scores, verification indicators and seller reputation metrics.
- To keep the Service safe — authenticating users, applying rate limits, detecting and preventing fraud, abuse, prohibited assets and security incidents, and enforcing our Terms of Service.
- To communicate with you — sending account, verification, security and service messages, and responding to your requests.
- To maintain and improve the Service — troubleshooting, measuring how features are used through first-party records, and developing new features.
- To comply with law — meeting legal obligations, responding to lawful requests, and establishing, exercising or defending legal claims.
Some features, where enabled, use an AI provider to generate an explanation of a public Node listing. Only public listing information (which can include the seller's public name and public reputation metrics) is sent for this purpose; the viewer's identity, email address and Google user data are not sent. We do not use your personal data to train generalized AI models.
11.Legal bases for processing
Where data-protection laws such as the EU or UK General Data Protection Regulation (GDPR) apply, we rely on the following legal bases:
- Performance of a contract — to provide the Service under our Terms of Service, including account creation, sign-in (including with Google) and marketplace features.
- Legitimate interests — to secure the Service, prevent fraud and abuse, moderate the marketplace, keep audit records, and improve the Service, where these interests are not overridden by your rights.
- Legal obligation — to comply with laws that apply to us, such as record-keeping or responding to lawful requests.
- Consent — where we ask for it for a specific purpose. You can withdraw consent at any time without affecting processing that took place before.
13.Service providers
We use a small number of service providers that process personal data on our behalf, under contractual obligations to protect it and to use it only to provide their services to us:
- Supabase — authentication, database and related infrastructure. Supabase stores account, profile, marketplace and transaction data and sends authentication emails, directly or through the email-delivery service configured for it.
- Hosting provider — the cloud servers that run the TrafficNodes application and receive the technical request data described above.
- Google — if you choose to sign in with Google, Google authenticates you and shares the identity information described in Google Sign-In and Google user data. Google's own use of your data is governed by Google's privacy policy.
- Anthropic — where the AI explanation feature is enabled, processes public Node listing information, which can include the seller's public name and metrics, to generate an explanation. No account data of the person viewing the listing is sent.
If we add a service provider that processes personal data in a materially different way — for example, a payment provider or email-delivery provider — we will update this policy.
14.International data transfers
TrafficNodes serves users globally, and our service providers may process personal data in countries other than the one where you live, including countries whose data-protection laws differ from yours. Where the law requires, we rely on appropriate safeguards for such transfers, such as adequacy decisions or standard contractual clauses approved by the relevant authorities, and the safeguards our service providers offer. You can contact us for more information about the safeguards that apply.
15.Data retention
We keep personal data only for as long as we need it for the purposes described in this policy:
- Account and profile data, including Google user data, is generally kept for as long as your account remains active.
- Marketplace, transaction, moderation and security information — such as orders, transfers, disputes, audit records and records of policy enforcement — may be kept after an account closes for as long as reasonably necessary to operate the Service, prevent fraud and abuse, resolve disputes, enforce our Terms and meet legal, accounting or regulatory obligations.
- Rate-limiting data is held in server memory only briefly and is discarded automatically.
When personal data is no longer needed, we delete it, anonymize it, or otherwise dispose of it securely, subject to any legitimate or legal need to keep it longer.
16.Account and data deletion
You can ask us to delete your TrafficNodes account and personal data — including Google user data — at any time. To make a request, email support@trafficnodes.com from the email address associated with your account, with the subject "Account deletion request". If you cannot use that address, tell us and we will verify your identity in another reasonable way.
We handle deletion requests individually. After we verify the request, we will delete or anonymize your account and the personal data associated with it, except as described below, within a reasonable period and in any case within the time limits required by applicable law. We will confirm when this is done. Some information may be kept where it is legitimately or legally necessary, in particular:
- security logs and records of fraud, abuse or policy enforcement;
- records of orders, transfers, disputes and reviews that another user is party to — including the name shown in them at the time — or that are needed for accounting or legal purposes;
- information we are required to keep by applicable law; and
- copies in backups, which are overwritten as part of normal backup cycles rather than deleted immediately.
Deletion is therefore not instantaneous in every system, but retained information is used only for the purposes that justify keeping it. Content you published that other users have already interacted with — for example, a review attached to a completed order — may be anonymized rather than removed.
17.Security
We use reasonable technical and organizational safeguards designed to protect personal data, including encrypted connections (HTTPS), hashed passwords and API secrets, database access controls that limit each user to their own data, rate limiting, security headers, and restricted administrative access. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You help protect your account by using a strong, unique password, keeping your API tokens secret, signing out on shared devices, and telling us promptly at support@trafficnodes.com if you suspect unauthorized access.
18.Your privacy rights
Depending on where you live, applicable law may give you some or all of the following rights regarding your personal data:
- to access the personal data we hold about you and receive a copy;
- to correct inaccurate or incomplete data;
- to delete your data;
- to restrict or object to certain processing, including processing based on legitimate interests;
- to data portability — receiving data you provided in a structured, machine-readable format;
- to withdraw consent where processing is based on consent; and
- to complain to a data-protection authority or other competent regulator.
You can update your display name in your account settings. To exercise any other right, email support@trafficnodes.com. We will verify your request, typically by confirming it comes from the email address associated with your account, and respond within the time required by applicable law. We will not discriminate against you for exercising your rights. You may use an authorized agent where the law allows; we may ask for proof of the agent's authority.
19.Additional information for the EEA and the UK
If you are in the European Economic Area or the United Kingdom, the GDPR or UK GDPR gives you the rights listed in Your privacy rights, and we process your personal data on the legal bases described in Legal bases for processing. You have the right to lodge a complaint with the supervisory authority in the country where you live or work, or where you believe an infringement occurred. We would appreciate the chance to address your concern first at support@trafficnodes.com.
20.Additional information for U.S. residents
If you live in California or another U.S. state with a comprehensive privacy law, you may have rights to know what personal information we collect and how we use and disclose it, to access, correct and delete it, and to opt out of its "sale" or "sharing" for cross-context behavioral advertising, or its use for targeted advertising or certain profiling.
- Categories collected — identifiers (such as name, email address, account identifiers and IP address), commercial information (such as listings, offers, orders and transfers), internet or electronic network activity (such as interactions with the Service), and professional information you choose to provide in a seller profile or listing. Sources and purposes are described in this policy.
- No sale or sharing — we do not sell personal information and do not share it for cross-context behavioral advertising, and we have not done so in the past twelve months. Because of this, we do not offer an opt-out link. We do not knowingly sell or share the personal information of consumers under 16.
- Sensitive personal information — we do not use or disclose sensitive personal information for purposes that would give rise to a right to limit its use.
- Disclosures for business purposes — we disclose the categories above to the service providers described in Service providers, for the purposes described there.
To make a request, email support@trafficnodes.com. If we deny your request, you may appeal by replying to our decision; where the law provides it, you may contact your state attorney general if you are not satisfied with the outcome of your appeal.
21.Children's privacy
The Service is a professional marketplace intended for adults. It is not directed to children, and you must be at least 18 years old (or the age of legal majority where you live, if higher) to use it. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at support@trafficnodes.com and we will delete it.
22.Third-party services and external platforms
The Service refers to, and Nodes often depend on, external platforms such as advertising networks, social networks and other websites. Some features let you open external services yourself — for example, copying a public research prompt about a listing to use in an AI assistant of your choice. When you leave the Service or share information with an external service, that service's own privacy policy applies, and we are not responsible for its practices. Third-party names and trademarks belong to their respective owners, and their mention does not imply affiliation with or endorsement of TrafficNodes.
23.Changes to this policy
We may update this policy from time to time, for example when we add features or service providers. The "Last updated" date at the top shows when it last changed. If we make material changes, we will notify you in the Service or by email before they take effect where reasonably practicable. We will not use Google user data in a materially different way from what is described here without first updating this policy and obtaining your consent where required.
24.Contact
For privacy questions, requests to access, correct or delete your data (including Google user data), or concerns about this policy, email support@trafficnodes.com. Please send requests from the email address associated with your account so we can find it and verify the request. You can also find our contact options on the contact page.