How we handle the data you trust us with.

Who we are

This privacy policy is published by Tridence ("we", "us", "our"), a digital agency headquartered in Jacksonville, Florida with a studio in Chicago, Illinois. We design, build, and maintain websites, applications, brand systems, and marketing programs for clients across the United States.

For the purposes of GDPR, Tridence is the data controller for the personal information described in this policy. For CCPA, we are a business as defined in the statute.

SPEAR and client services

SPEAR is Tridence's audience-intelligence and marketing offering. This notice describes Tridence's handling of personal information. A client's own notice also applies to information collected or used through that client's website or services.

Our role depends on the activity. When we determine the purposes and means of processing, we act as a controller or business, as applicable. When we process personal information solely on a client's documented instructions, we act as its processor or service provider under the applicable agreement. A service agreement does not remove an individual's rights under applicable law.

What we collect

We collect information you give us directly, information collected automatically as you use the site, and information from third-party services that help us operate.

Information you provide:

• Contact details — name, email, phone, company — when you fill out a form or email us
• Project details — scope, timelines, budgets, and notes you include in a brief or quote request
• Communications — anything you write to us via email, calls, or chat
• Support records: chat messages, ticket details, callback requests, account references, screenshots, documents, and other attachments you choose to provide

Information collected automatically:

• Device & browser metadata — IP address, user agent, referring URL, screen size, language
• Usage data — pages visited, time on page, click events, scroll depth
• Cookies and similar storage — see Section 4

Website, advertising and audience technology

Our website includes configured tools for analytics, advertising measurement, audience matching, customer-relationship management and campaign integration. Information collected through these technologies may include IP addresses, device and browser information, cookie or other online identifiers, referring URLs, page visits, interaction events and campaign responses. The information involved depends on the tool, its configuration and the interaction.

Some audience-matching services are designed to associate online activity with business, household or contact information without a visitor submitting a form. Any use of those capabilities must be described for the relevant deployment; their availability does not mean every visitor is identified or every matching feature is enabled. An IP address, device identifier or hashed identifier is not necessarily anonymous simply because it does not display a person's name.

How we use it

We use the information described above to operate the site, respond to inquiries, deliver work to clients, and improve what we do. Specifically:

• Respond to your inquiries, schedule discovery calls, and prepare proposals
• Deliver services to clients under signed engagement agreements
• Maintain billing, accounting, and statutory records
• Measure site performance and conversion paths in aggregate
• Secure our infrastructure and detect abuse or fraudulent submissions
• Communicate updates, where you have opted in to receive them
• Assist visitors through the Tridence AI Concierge using approved business information and support resources
• Route sales, support, billing, and urgent technical requests to the appropriate workflow or team
• Schedule sales and discovery calls through HubSpot and maintain related CRM records

The configured website and marketing tools support analytics, campaign measurement and attribution, audience matching, advertising delivery, inquiry handling and CRM integration. Before introducing a new SPEAR use that changes the categories of information, purposes or recipients, we will update the relevant disclosures and provide additional notice or obtain consent where required.

Cookies, pixels and other tracking technologies

Our website includes essential, analytics, advertising and audience-related technologies. Depending on the configuration, these can include cookies, tags, pixels, online identifiers and server-side integrations. They support website operation, usage measurement, campaign attribution, audience-related services and advertising. Not every installed integration necessarily operates on every page or for every visitor.

Where applicable law requires consent before a technology is used, that consent must be obtained separately; this privacy notice and continued website use do not themselves provide it. You can manage browser cookies and contact us using the privacy contact in Section 12 with questions or privacy requests. Browser controls may not stop every server-side transmission or downstream audience use. An email unsubscribe is separate from a request to opt out of data sale, sharing or targeted advertising.

Essential cookies are required for the site to function — session state, security, and form submission protection (reCAPTCHA). These cannot be disabled without breaking core functionality.

Analytics cookies help us understand traffic patterns in aggregate. We currently use Google Analytics 4 with IP anonymization enabled. You can opt out at any time using your browser settings or the Google Analytics opt-out add-on.

Technology providers and other recipients

We use providers supporting hosting, security, analytics, campaign measurement, advertising delivery, audience-data and identity-matching technology, customer conversations, CRM and marketing integrations. Information disclosed to a provider depends on the service, configuration and purpose. Providers acting only on our or a client's documented instructions have a different role from recipients that determine their own purposes; not every technology recipient is necessarily a service provider or processor.

The existing list below describes key website and operational providers. For audience and advertising services, relevant recipient categories include analytics and attribution providers, advertising and audience platforms, audience-data and identity-matching providers, and CRM or marketing-integration providers.

• HubSpot — form intake, CRM, scheduling
• Chatwoot: customer conversations, ticket management, routing, and help-center delivery
• OpenAI: AI-assisted responses, conversation summaries, and retrieval of approved Tridence resources
• Cloudflare: DNS, network security, bot protection, content delivery, and protected file or object storage
• Google Workspace — email, calendar, document storage
• Google Analytics 4 — site analytics with IP anonymization
• Hostinger and Tridence-managed VPS infrastructure: website and application hosting
• Square / QuickBooks: invoicing and payment processing for clients
• Zoom / Google Meet — video conferencing for discovery and project calls

Some disclosures for advertising or audience services can constitute a sale or sharing of personal information, or targeted advertising, under applicable privacy law even when no money is exchanged for the information. The classification depends on the actual disclosure and recipient's permitted use, not simply the label given to the service.

Sub-processors used by these vendors are governed by their own privacy programs.

AI Concierge, support hub, and automated assistance

When you use the Tridence AI Concierge or Support Hub, we may process the information you submit, including your contact details, conversation content, ticket information, callback requests, account references, and attachments.

We use this information to answer questions, search approved Tridence resources, create or update support and CRM records, schedule sales calls, summarize conversations, route requests, prevent abuse, and improve our support documentation.

• AI assistance: OpenAI may process the limited conversation context needed to generate a response or summary.
• Support operations: Chatwoot manages customer conversations, tickets, routing, and help-center content on Tridence-controlled infrastructure.
• Sales scheduling: HubSpot displays available appointment times and stores the contact and meeting details you provide.
• Files and screenshots: attachments may be stored on Tridence-managed systems or approved storage providers with access controls and retention limits.
• Human review: refunds, billing disputes, account changes, identity-sensitive requests, and other high-risk actions require verification or human review.

AI-generated responses may be incomplete or incorrect. You may request a human at any time. Tridence does not intentionally use private support conversations to train public AI models, and automated responses are not the sole basis for legal, financial, employment, or similarly significant decisions.

How long we keep it

We retain personal information only as long as we need it for the purposes described above, plus any period required by law.

• Inquiry / brief data — 24 months from last contact, then deleted or anonymized
• Active client records — duration of engagement plus 7 years (US tax & business records)
• Marketing list — until you unsubscribe; suppression list kept indefinitely to honor opt-outs
• Server logs — 90 days rolling
• Backups — 30 days rolling, encrypted at rest
• AI Concierge and support transcripts: generally up to 24 months from the last activity, unless needed for active services, billing, security, disputes, or legal obligations
• Support attachments and screenshots: generally up to 12 months after a case closes, unless continued retention is required for an active matter
• De-identified case summaries: may be retained longer to improve support quality and approved knowledge resources

For audience and campaign information, retention depends on the type of record, the disclosed purpose, the duration of the relevant service and applicable legal requirements. Retention must be limited to what is reasonably necessary for those purposes. Limited request and suppression records may be retained where needed to honor a privacy choice and prevent information from being reintroduced contrary to that choice.

Your rights & choices

Depending on where you live, you may have the following rights regarding your personal information. We honor all of these regardless of jurisdiction, as a matter of policy.

• Access — request a copy of the personal information we hold about you
• Correction — ask us to fix inaccurate or incomplete data
• Deletion — request that we delete your information, subject to legal retention obligations
• Portability — receive your data in a machine-readable format
• Objection / restriction — limit how we process your information
• Opt-out of marketing — unsubscribe from any marketing email at any time

Depending on applicable law, you may opt out of the sale or sharing of personal information, targeted advertising, and certain profiling with legal or similarly significant effects. You may also withdraw consent where processing relies on it and appeal a decision on a privacy request where the law provides that right. Withdrawal does not affect the lawfulness of processing before withdrawal.

Use the privacy contact in Section 12 to submit a request or ask which information and choices apply to you. An email-marketing unsubscribe does not necessarily exercise a separate sale, sharing or targeted-advertising opt-out. Verification requirements depend on the type of request; identity verification must not be imposed on a sale-or-sharing opt-out where the law prohibits it.

To exercise any right, email [email protected]. We respond within 30 days and may need to verify your identity before fulfilling the request.

Security & breach posture

We use commercially reasonable technical and organizational measures to protect personal information, including:

• TLS 1.3 encryption in transit · AES-256 encryption at rest
• Role-based access control on internal systems
• Two-factor authentication required for all team accounts
• Quarterly access reviews and credential rotation
• Vendor security assessments before onboarding processors
• Encrypted backups stored in a geographically separate region
• API credentials and connector secrets stored on protected server systems, not in public browser code
• Identity verification and human approval for sensitive account, billing, and ownership actions

If we ever experience a breach affecting your personal information, we will notify affected individuals and applicable regulators within the timelines required by law (typically 72 hours for GDPR-covered events).

International transfers

Tridence is based in the United States and our primary infrastructure is hosted in the US. If you are visiting from outside the US, your information will be transferred to and processed in the US.

For transfers from the EEA, UK, or Switzerland, we rely on Standard Contractual Clauses (SCCs) and supplementary measures where required, and we work only with processors that meet equivalent standards.

Children's privacy

Our website and services are intended for business audiences and are not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us at [email protected] and we will delete it promptly.

Changes to this policy

We may update this policy from time to time as our services, technology, or legal obligations evolve. When we make material changes, we will update the "Effective" date at the top of this page and, where appropriate, provide additional notice (such as a banner on the site or an email to people on our list).

We will update this notice when our practices change and provide additional notice or obtain consent when required by law. Posting an updated notice or your continued use of a service does not replace consent where consent is required.

How to contact us

Questions, requests, or complaints about this policy or our handling of your data? Reach us directly:

• Email — [email protected]
• General — [email protected]
• Mail — Tridence · Privacy Office · Jacksonville, FL (HQ)

If you are in the EEA or UK and believe we have not adequately addressed your concern, you have the right to lodge a complaint with your local data protection authority.