Privacy Policy
What we collect, why, who we share it with, how long we keep it, and your rights under CCPA/CPRA and GDPR.
Last updated October 12, 2026.
Draft — have a lawyer review before launch. This text is a working draft and is not yet the binding version.
This policy explains how VisualSphere Solutions, LLC ("we") handles personal information on LevelRated.com and AVCleared.com (the "Platform"). Most of what we process is business information about companies and contractors; this policy covers the personal information mixed in with it.
What we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, work email, phone, job title, password hash, MFA settings | You |
| Business owner identity | Government ID check result, selfie liveness result | You, via our ID verification provider |
| Contractor business records | Legal name, EIN (encrypted, shown as last 4), licenses, insurance, OSHA logs, financial summaries | You, your broker, public records, data providers |
| Worker information | Worker names, roles, certifications, certificate numbers | Contractors |
| Reviews and messages | Review text, ratings, messages between organizations | Users |
| Usage and device data | IP address, browser, pages viewed, actions taken, profile views | Automatically |
| Payment data | Billing contact, card brand and last 4 (full card data is held by Stripe) | You, Stripe |
We do not knowingly collect health information, and the incident form warns users not to enter it.
How we use it
- To run the Platform: accounts, search, profiles, verification, monitoring, messaging and billing.
- To verify businesses and people, with consent where the law requires it (identity checks, business credit pulls).
- To calculate Trust Scores and publish verified reviews.
- To prevent fraud and abuse, including duplicate-entity detection and review-fraud checks.
- To send service emails, alerts and, where allowed, product updates (you can opt out of non-essential email).
- To meet legal obligations and defend legal claims.
We do not sell personal information and we do not share it for cross-context behavioral advertising.
Who we share it with
- Subscribed companies see contractor profiles and documents according to the contractor's visibility settings and the company's plan.
- Service providers under contract: hosting, email and SMS delivery, payments (Stripe), identity verification, license and sanctions data, document extraction, business credit. They may only use data to provide services to us.
- Auditors see the records needed for an on-site audit they perform.
- Authorities when required by law or to protect rights and safety.
- A successor in a merger or acquisition, with notice to you.
Retention
| Data | Retention |
|---|---|
| Account data | Life of the account, then deleted or anonymized within 30 days of a verified deletion request |
| Verification records and evidence hashes | 7 years after the record's expiry, for legal defense of published ratings |
| Audit logs | 7 years, append-only |
| Published reviews | While the reviewed contractor's profile exists; reviewer identity is anonymized on account deletion |
| Billing records | As required by tax law (typically 7 years) |
| Usage logs | 13 months |
When you ask us to delete your account we anonymize your user record (name replaced with "Deleted user", email removed, phone, password and MFA cleared, sessions revoked) and keep the verification records and audit logs above with personal data minimized.
Your rights
Depending on where you live, including under the California Consumer Privacy Act as amended by the CPRA and the EU/UK GDPR, you may have the right to know, access, correct, delete and port your personal information, to object to or restrict certain processing, and to not be discriminated against for exercising these rights.
- Export: Account settings, Data export, or contact us.
- Delete: Account settings, Delete account, or contact us. We verify requests before acting.
- Correct: edit your profile, or report a data error.
- Authorized agents may submit requests with proof of authorization.
For GDPR purposes, we are the controller for account and Platform data, and a processor for data an Enterprise customer submits under a Data Processing Addendum. Our legal bases are contract, legitimate interests (fraud prevention, rating integrity), consent (identity and credit checks where required) and legal obligation. EU/UK transfers rely on Standard Contractual Clauses.
Security
TLS in transit; encryption at rest; field-level encryption for EINs and similar fields; encrypted file storage with virus scanning; short-lived signed download links; MFA for all staff; logged access to documents and staff impersonation.
Cookies
See the Cookie notice.
Children
The Platform is for businesses and isn't directed to anyone under 18.
Contact
Privacy requests: privacy@levelrated.com, or the contact form. VisualSphere Solutions, LLC, 927 10th St N, Hudson, WI 54016.