Privacy Policy

1. Introduction and Scope

This Privacy Policy describes how Nabbit Marketplace ("Nabbit," "we," "us," or "our") collects, uses, discloses, sells, shares, and protects personal information in connection with our websites, mobile applications, telephone systems, and related services (collectively, the "Platform"). It applies to: (a) Service Providers (businesses that purchase leads); (b) Lead Providers (businesses that submit leads); (c) visitors to our websites and applications; and (d) consumers whose contact information is contained in leads ("Lead Subjects"), including individuals who have never created an account with us.

By using the Platform, you acknowledge this Privacy Policy. If you do not agree with it, do not use the Platform. This Policy is incorporated into our Terms of Use. Capitalized terms not defined here have the meanings given in the applicable Terms of Use.

Our Platform is a business-to-business marketplace. IMPORTANT: a core function of the Platform is the transfer of Lead Subjects' contact information from Lead Providers to purchasing Service Providers, in exchange for payment. Under certain state privacy laws, including the California Consumer Privacy Act as amended ("CCPA"), this constitutes a "sale" of personal information. Section 7 describes this in detail, and Section 12 describes how to opt out.

2. Categories of Personal Information We Collect

Account and profile information: name, email address, telephone number, company or business name, password (stored in hashed form by our authentication provider), account role, profile settings, service categories, and service areas.

Identity and payout verification information: for accounts receiving payouts, our payment processor (Stripe, Inc.) collects and verifies government-grade identity information, which may include legal name, date of birth, government identification numbers (such as SSN or EIN), and bank account details. Nabbit does not receive or store full government identification numbers or full bank account numbers; we receive verification status and limited metadata from Stripe.

Payment information: payment card details and bank transfer details are collected directly by Stripe. Nabbit never receives or stores full card numbers. We store transaction records (amounts, timestamps, last four digits and card brand where provided by Stripe, wallet balances, ledger entries).

Lead information (including Lead Subject data): names, telephone numbers, email addresses, service addresses or areas, requested service categories and job types, project descriptions, and related notes submitted by Lead Providers. This is personal information about Lead Subjects, who may not be Platform users.

Communications data: call metadata (numbers, timestamps, durations, outcomes) for calls placed through our call-connection system; call recordings and machine-generated transcripts and analyses of such calls; SMS messages sent through the Platform (including delivery status); ratings, comments, and dispute submissions.

Technical and usage data: IP address, device and browser type, operating system, pages viewed, actions taken, referral URLs, session identifiers, push notification tokens, approximate location derived from IP address, and log data. We log IP addresses at account creation and at acceptance of legal terms.

Cookies and similar technologies: see Section 10.

3. Sources of Personal Information

We collect personal information: directly from you (account registration, profile setup, lead submission, payments, communications, support); automatically through your use of the Platform (technical and usage data, call systems); from Lead Providers (Lead Subject information contained in leads); from our service providers (e.g., identity verification results from Stripe, telephony data from Twilio); and from publicly available or licensed mapping/geocoding services used to validate locations.

Lead Providers are contractually required to collect Lead Subject information lawfully and with all consents necessary for its use as described in this Policy, including consent to be contacted by service providers. See our Lead Provider Terms of Use.

4. How We Use Personal Information

We use personal information to: operate the marketplace (listing, matching, selling, and delivering leads); create and administer accounts; verify identity and eligibility for payouts; process payments, credits, refunds, holds, and payouts through Stripe; route, connect, record, transcribe, and analyze calls placed through the Platform for verification, quality assurance, fraud prevention, and dispute resolution; send transactional communications (lead alerts, receipts, verification codes, rating requests, account notices) by email, SMS, and push notification according to your settings; measure and improve lead quality, including fraud scoring, duplicate detection, freshness-based pricing, and customer ratings; detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms; comply with legal obligations; and establish, exercise, or defend legal claims.

We may use de-identified or aggregated data (which cannot reasonably be linked to you) for analytics, benchmarking, and product improvement. We commit to maintaining such data in de-identified form and not attempting re-identification.

5. Automated Decision-Making

The Platform uses automated systems that affect users, including: automated lead pricing adjustments based on freshness and demand; automated fraud and quality scoring of leads and accounts; automated duplicate-lead detection; and automated account suspension when customer-rating thresholds or fraud signals are met. Suspensions are subject to human review upon request through our support channels.

6. Call Recording and Monitoring

Calls placed through the Platform's call-connection system may be recorded, transcribed, and analyzed (including by automated and artificial-intelligence tools) for lead verification, quality assurance, fraud prevention, dispute resolution, and platform improvement. Where required by law, call participants are notified of recording. Some U.S. states require the consent of all parties to a call recording; by using the Platform's calling features, Service Providers consent to recording and are responsible for any additional notice obligations that apply to them. Lead Subjects receive notice through the call flow where required.

7. How We Disclose, Sell, or Share Personal Information

Sale of lead information (the core of our marketplace): when a Service Provider purchases a lead, we disclose the Lead Subject's contact information (such as name, telephone number, email, and service address) and project details to that Service Provider in exchange for payment. Under the CCPA and similar state laws, this is a "sale" of personal information. We do not sell the personal information of our registered users (Service Providers and Lead Providers) — the personal information sold consists of Lead Subject data contained in leads. Purchasing Service Providers are contractually restricted to using lead information solely to pursue the specific service opportunity described in the lead.

Service providers and processors: we disclose personal information to vendors that process it on our behalf under contract, including Stripe (payments, identity verification, payouts), Twilio (telephony, SMS), Supabase (database and authentication hosting), Vercel (application hosting), transcription and AI analysis providers (call transcripts and lead analysis), Resend (email delivery), Expo (mobile push notifications), and Google (address and place validation). These providers are contractually limited to processing for our business purposes.

Within transactions: limited profile information of Service Providers (such as company name and rating) may be shown to Lead Providers and to Lead Subjects (for example, in rating requests); limited Lead Provider information (such as company name and rating) may be shown to Service Providers.

Legal and safety: we may disclose personal information to comply with law, regulation, legal process, or governmental request; to enforce our Terms; to detect or prevent fraud, abuse, or security issues; or to protect the rights, property, or safety of Nabbit, our users, Lead Subjects, or the public.

Business transfers: in connection with a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of the transaction, subject to this Policy or successor policies.

We do not sell or share the personal information of individuals we know to be under 18 years of age.

8. Communications and Telephone Consumer Protection

Transactional SMS and calls: by providing a telephone number and creating an account, you consent to receive transactional and account-related calls and text messages (such as verification codes, lead alerts you enable, and rating requests). Message and data rates may apply. Reply STOP to any Nabbit SMS to opt out of that message category; reply HELP for help. Opting out of transactional messages may limit Platform functionality.

Service Providers contacting Lead Subjects are independently responsible for compliance with the Telephone Consumer Protection Act (TCPA), state telemarketing laws, do-not-call registries, and call-recording laws. Lead Providers represent that they obtained consent sufficient for such contact. Nabbit is a platform intermediary and does not itself place telemarketing calls to Lead Subjects.

9. Data Retention

We retain personal information for as long as reasonably necessary for the purposes described in this Policy, including: account data for the life of the account plus a reasonable period thereafter; transaction, ledger, payout, and terms-acceptance records for the periods required by tax, accounting, anti-fraud, and legal-compliance obligations (typically at least seven years); call recordings and transcripts for as long as needed for verification, quality, and dispute purposes; and lead data subject to our aging practices (for example, customer telephone numbers in aged leads are removed from active lead records after a defined period). When retention is no longer necessary, we delete or de-identify the information.

10. Cookies and Tracking Technologies

We use cookies and similar technologies that are strictly necessary to operate the Platform: authentication/session cookies, security tokens, and preference storage (such as your theme choice). We do not use third-party advertising cookies and we do not engage in cross-context behavioral advertising. Because our cookies are limited to essential functions, no cookie-consent choice is required; disabling essential cookies in your browser will prevent login and core functionality.

11. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information, including: encryption of data in transit (TLS); encrypted storage managed by our hosting providers; row-level security controls in our database restricting each account to its own data; server-side gating of protected lead fields until purchase; hashed passwords managed by our authentication provider; payment data handled exclusively by Stripe (PCI-DSS Level 1); audit logging of sensitive actions; and access controls for administrative functions. No method of transmission or storage is completely secure; we cannot guarantee absolute security. If we become aware of a breach of security affecting your unencrypted personal information, we will notify affected users and regulators as required by applicable breach-notification laws.

12. Your Privacy Rights (State Privacy Laws)

Depending on your state of residence (including California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia, among others), you may have some or all of the following rights: to know/access the personal information we hold about you, including categories, sources, purposes, and third parties; to obtain a portable copy; to correct inaccurate personal information; to delete personal information, subject to legal exceptions; to opt out of the sale or sharing of your personal information and of targeted advertising; to limit use of sensitive personal information; to non-discrimination for exercising rights; and, in some states, to appeal a denial of your request.

How to exercise rights: submit a request via our Do Not Sell or Share page at /privacy/do-not-sell, or email privacy@nabbitmarketplace.com. We will verify your identity using reasonable methods (such as confirming control of the email or phone number associated with the data) before acting. You may use an authorized agent where permitted by law; we may require proof of authorization. We respond within the timeframes required by applicable law (generally 45 days, extendable where permitted). If we deny a request, residents of states with appeal rights may appeal by replying to our decision email with "APPEAL" in the subject line.

Opt-out preference signals: where required by law, we treat opt-out preference signals (such as Global Privacy Control) as valid requests to opt out of sale or sharing for that browser or device.

California notice at collection: the categories of personal information we collect and our purposes are described in Sections 2 and 4. We sell the category of personal information described in Section 7 (Lead Subject identifiers and service details) to Service Providers. We do not use or disclose sensitive personal information for purposes requiring a "Limit the Use of My Sensitive Personal Information" right. We retain information as described in Section 9.

13. Rights of Lead Subjects (Non-Users)

If your contact information was submitted to our Platform in a lead and you are not a Platform user, you have the same rights described in Section 12 with respect to that information, including the right to know, delete, and opt out of sale. You may exercise these rights at /privacy/do-not-sell or by emailing privacy@nabbitmarketplace.com. If you tell us you never requested the service described in a lead (including through our rating page), we treat that as a fraud signal against the submitting Lead Provider, and you may additionally request deletion of your information from active lead records. Note that copies of your information already delivered to a purchasing Service Provider are held by that provider as an independent business; we will identify to you, upon verified request and where required by law, the third parties to which your information was sold.

14. Children

The Platform is a business service intended for users 18 years of age or older. We do not knowingly collect personal information from children under 13, and we do not knowingly sell the personal information of consumers under 18. If you believe a child's information has been submitted to the Platform, contact privacy@nabbitmarketplace.com and we will delete it.

15. Users Outside the United States

The Platform is operated from and directed to users in the United States. If you access it from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those of your jurisdiction. The Platform is not intended to offer goods or services to residents of the European Economic Area or the United Kingdom.

16. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced through the Platform or by email before they take effect, and the "Version" date above will change. Your continued use of the Platform after the effective date constitutes acknowledgment of the updated Policy.

17. Contact Us

For privacy questions or to exercise your rights: email privacy@nabbitmarketplace.com, or use the request form at /privacy/do-not-sell. For general support, use the contact options in your account. If you have an unresolved privacy concern, you may also contact your state Attorney General's office.