Privacy Policy

Last updated: May 29, 2026 | Effective: May 29, 2026

This Privacy Policy describes how Trellis Group LLC ("we," "us," or "our") collects, uses, and protects information about you when you use TrellisSearch and TrellisMail (collectively, the "Services"). By using our Services, you agree to this policy.

1. Who We Are

Trellis Group LLC operates TrellisSearch, a web search engine and business directory, and TrellisMail, an email service. Our Services are operated from the United States.

2. Information We Collect

Information you provide

Username
First and last name
Email address (used for account verification only)
Password (stored as a one-way hash — we cannot read it)
Birth year (collected for age verification — we do not store your full date of birth)
City, state/province, and country (stored encrypted)

Information collected automatically

IP address (used for rate limiting, abuse prevention, and search suggestion quality)
Browser and device information (user agent)
Pages visited and search queries submitted (including the IP address associated with each search)
Search result clicks (used to improve search ranking quality)
Login timestamps and session information
URL submissions to our search index

Device location (optional)

If you use the "Near Me" or "Find Businesses Near Me" feature, your browser will ask your permission to share your device's location. We only access your location if you explicitly grant permission by clicking a button. Location coordinates are:

Rounded to approximately 111 meters before being sent to our servers
Used only to find nearby businesses in your search session
Not stored on our servers after your request completes
Never shared with third parties

You can deny location access at any time through your browser or device settings. Denying location access does not affect any other part of the Services.

Business directory information

If you submit a business listing, claim a business, post a review, or respond to a review, we collect and store:

Business name, address, phone number, website, category, and hours
Business geographic coordinates (latitude and longitude) for map display
Review text, star ratings, and review titles you submit
Owner responses to reviews
Business posts and announcements
Business photos (if uploaded)
Claim verification information

Business listing information you submit is displayed publicly on TrellisSearch. Reviews and owner responses are moderated before publication. You are responsible for ensuring that business information you submit is accurate and that you have the right to submit it.

TrellisMail

When you create an account, we create a TrellisMail email address for you (username@trellissearch.com). Email content stored in your TrellisMail inbox is your data. We do not read, scan, or sell your email content.

3. How We Use Your Information

To create and manage your account
To provide search results, business directory, and email services
To verify your identity and prevent fraud
To send account-related emails (verification, password reset, security alerts)
To detect and prevent abuse, spam, and security threats
To comply with legal obligations

We do not sell your personal information. We do not use your data for advertising.

Specifically regarding newer features:

Search queries and IPs: Stored to power autocomplete suggestions. Suggestions only surface queries searched by at least 3 different IP addresses, and sensitive terms are filtered before display.
Search clicks: Used anonymously to improve search result ranking. We track which results are clicked for a given query to surface more relevant content over time.
Device location: Used only to calculate distances to nearby businesses. Not stored after the request completes.
Rate limiting data: IP addresses are stored temporarily (up to 7 days) to prevent abuse of our APIs. This data is not used for any other purpose.
Business reviews and responses: Stored and displayed publicly after moderation. Used to provide business quality information to users.

4. How We Protect Your Information

Passwords are hashed using bcrypt and are never stored in readable form
Location data (city, state, country) is encrypted at rest using AES-256 equivalent encryption
All data is transmitted over HTTPS
Session tokens are hashed before storage
Access to production systems is restricted and logged
We use two-factor authentication for administrative access
Device location coordinates are rounded before transmission and are not stored

5. Data Retention

Account data is retained while your account is active
Security logs are retained for up to 90 days
Search queries and associated IP addresses are retained to power autocomplete features, but are only surfaced publicly if searched by multiple distinct users
Search click data is retained to improve ranking quality
Rate limiting records (IP addresses) are automatically deleted after 7 days
Device location data is not retained after your search request completes
Business listings and reviews are retained until removed by the owner or an administrator
When you delete your account, your personal data is removed or anonymized within 30 days. Business reviews and listings you submitted may remain if they are associated with a public business record.
We may retain certain records longer if required by law

6. Sharing Your Information

We do not sell, rent, or trade your personal information. We may share information only in these circumstances:

Service providers: We use Mailgun to deliver transactional emails. They process email addresses and message content solely to deliver emails on our behalf.
Geocoding: When a business address is submitted, we send the address to OpenStreetMap's Nominatim service to obtain geographic coordinates for map display. No personal account information is sent. Address data is subject to OpenStreetMap's privacy policy.
Legal requirements: We may disclose information if required by law, court order, or government request.
Safety: We may disclose information to protect the rights, property, or safety of our users or the public.
Business transfer: If Trellis Group LLC is acquired or merged, your data may transfer to the new entity subject to the same privacy commitments.

7. Your Rights

Regardless of where you live, you have the right to:

Access the personal data we hold about you
Correct inaccurate data
Delete your account and associated data
Export your data in a machine-readable format
Withdraw consent for optional features such as device location access at any time

You can exercise these rights from your account dashboard or by contacting us at privacy@trellissearch.com.

8. California Residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you.
Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
Right to Correct: You may request correction of inaccurate personal information.
Right to Opt Out of Sale or Sharing: We do not sell or share your personal information with third parties for cross-context behavioral advertising.
Right to Limit Use of Sensitive Personal Information: We only use sensitive personal information (such as your precise location) for the purpose of providing our Services, and we do not store precise location data.
Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To submit a California privacy request, contact us at privacy@trellissearch.com. We will respond within 45 days.

Categories of personal information collected in the past 12 months: identifiers, personal records, internet activity, geolocation data (approximate, session-only for location features), commercial information (business directory submissions), and inferences drawn from this information.

9. European and UK Residents (GDPR / UK GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, you have rights under the General Data Protection Regulation (GDPR) or UK GDPR:

Legal basis for processing: We process your data on the basis of contract performance (providing our Services), legitimate interests (security, fraud prevention, search quality improvement), consent (device location access), and legal compliance.
Right of access: You may request a copy of your personal data.
Right to rectification: You may request correction of inaccurate data.
Right to erasure: You may request deletion of your data ("right to be forgotten").
Right to restriction: You may request we limit processing of your data.
Right to data portability: You may request your data in a structured, machine-readable format.
Right to object: You may object to processing based on legitimate interests.
Right to withdraw consent: Where processing is based on consent (such as device location), you may withdraw consent at any time without affecting prior processing.
Right to lodge a complaint: You have the right to lodge a complaint with your local data protection authority.

Data transfers outside the EEA are made with appropriate safeguards. To exercise your rights, contact privacy@trellissearch.com.

10. Canadian Residents (PIPEDA / Law 25)

If you are located in Canada, we comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws including Quebec's Law 25. You have the right to access, correct, and request deletion of your personal information. Contact privacy@trellissearch.com to exercise these rights.

11. Children's Privacy

Our Services are not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately at privacy@trellissearch.com.

12. Cookies and Tracking

We use only essential session cookies required for the Services to function. We do not use advertising cookies, tracking pixels, or third-party analytics. Your session cookie is deleted when you sign out or your session expires.

13. Business Directory and User-Generated Content

TrellisSearch includes a business directory where users may submit listings, claim businesses, write reviews, and post announcements. Please be aware:

Business listing information, reviews, and owner responses are displayed publicly on TrellisSearch and may be indexed by other search engines.
Do not include personal, private, or sensitive information in reviews or business posts that you do not wish to be publicly visible.
We moderate reviews and responses before publication but cannot guarantee the accuracy of user-submitted content.
If you believe a review or listing contains your personal information and you wish it removed, contact us at privacy@trellissearch.com.
Business geographic coordinates are obtained via OpenStreetMap's Nominatim geocoding service. Address data submitted for geocoding is subject to OpenStreetMap's privacy policy.

14. Third-Party Links

Search results may link to third-party websites. We are not responsible for the privacy practices of those sites. We encourage you to review the privacy policies of any site you visit.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email. Continued use of our Services after changes take effect constitutes acceptance of the updated policy.

16. Contact Us

Trellis Group LLC
Email: privacy@trellissearch.com
For legal notices: legal@trellissearch.com