§1Controller

Triad Holdings Group, LLC, Danville, Virginia, USA. Contact: privacy@triadholdingsgroup.com.

§2What We Collect

2.1 Public visitor telemetry

• Page views and session duration (aggregated, k≥5 anonymity floor)
• Referring URL, browser user-agent, viewport size
• Coarse geolocation derived from IP, then SHA-256 hashed and the original IP discarded

2.2 Form submissions

• Name, email, business name, phone (only fields you choose to provide)
• Vendor application content and uploaded documents

2.3 Authenticated portal users

• Email address, authentication tokens (managed by Lovable Cloud)
• Role assignments, audit log of in-portal actions

2.4 What we do NOT collect

• Names, exact addresses, device IDs, or precise locations of city residents
• Government IDs, payment card numbers, or biometric identifiers (we do not process payments directly)
• Children's data — the Services are not directed to anyone under 13

§3Why We Collect It

• Service operation — running the portal, processing applications
• Aggregate analytics — understanding traffic patterns at a k≥5 bucket level
• Security — the Sentinel framework uses telemetry to detect abuse, scraping, and fraud
• Legal compliance — audit trails required by municipal contracting standards

§4Sentinel Privacy Firewall

Every record written to our security and audit logs is run through a server-side redactor that strips emails, phone numbers, government IDs, and card-shaped numbers before storage. This is a code-level guarantee, not a policy promise.

§5Sharing

We do not sell, rent, or trade personal information. We share only with:

• Sub-processors required to deliver the Services (cloud hosting, email delivery). Contracts require equivalent privacy protections.
• Municipal partners, only the aggregated, k≥5 reports they have contracted for, and only data with a hash-verifiable certificate.
• Law enforcement, only when compelled by valid legal process.

§6Retention

• Telemetry: 13 months in aggregated form; raw event data 30 days
• Form submissions: lifetime of the relationship + 7 years (statute of limitations)
• Audit logs: 7 years (Virginia recordkeeping standard)
• Suppressed/unsubscribed emails: indefinitely (legally required to honor)

§7Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete data (subject to legal retention obligations)
• Port your data to another provider
• Opt out of targeted advertising or sale (we do neither, but you may still file the request)
• Appeal a denied request to the Office of the General Counsel

Submit requests to privacy@triadholdingsgroup.com. We respond within 45 days (extendable once by 45 days for complex requests).

§8Cookies

See the Cookie Policy.

§9International Transfers

Our infrastructure is hosted on edge networks that may transfer data outside your country of residence. Where required, we rely on Standard Contractual Clauses (SCCs) and equivalent safeguards.

§10Children

The Services are not directed to children under 13. If we discover we have collected data from a child, we will delete it.

§11Changes

We will revise this Policy as our practices evolve. Material changes will be announced at least seven (7) days before they take effect.