Privacy Policy

1.1 Information You Provide

• Account Information: Name, email address, phone number, company name, and job title when you register for an account or apply for access.
• Business Information: Legal entity name, address, industry classification (NAICS/SIC codes), tax identification numbers (last 4 digits only), and owner/borrower names.
• Financial Documents: Bank statements uploaded for analysis, including transaction data, account numbers (masked), and balance information.
• Communications: Messages sent through our contact forms, support requests, and correspondence with our team.

1.2 Information Collected Automatically

• Usage Data: Pages visited, features used, actions performed, and timestamps of interactions within the platform.
• Device Information: Browser type, operating system, IP address, and device identifiers.
• Log Data: Server logs including access times, error logs, and API request metadata.
• Cookies: Session cookies for authentication and preference cookies for user experience customization.

1.3 Information from Third Parties

• Business Verification Sources: Public records, Google Places API, WHOIS data, Wayback Machine, and government registries used for TraceIQ business verification.
• Payment Processors: Billing information processed by our third-party payment provider (Stripe).

We use the information we collect for the following purposes:

• Service Delivery: Processing bank statements, generating analysis reports, underwriting reports, and risk assessments.
• Account Management: Creating and managing your account, authenticating access, and providing customer support.
• Platform Improvement: Analyzing usage patterns to improve features, performance, and user experience.
• Security: Detecting and preventing fraud, unauthorized access, and other security threats.
• Compliance: Meeting legal obligations, responding to legal process, and enforcing our Terms of Service.
• Communication: Sending service-related notifications, updates, and responding to inquiries.
• AI Processing: Using artificial intelligence and machine learning to classify transactions, detect patterns, and generate insights from financial data.

We do not sell your personal information. We may share information in the following limited circumstances:

• Within Your Organization: Team members within your tenant organization can access shared data as permitted by role-based access controls.
• Service Providers: Trusted third-party vendors who assist in operating our platform (cloud hosting, AI processing, payment processing) under strict data protection agreements.
• Legal Requirements: When required by law, subpoena, court order, or government regulation.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, with notice to affected users.
• With Your Consent: When you explicitly authorize us to share information with a designated third party.

We implement comprehensive security measures to protect your data:

• Encryption: AES-256 encryption at rest and TLS 1.3 encryption in transit for all data.
• Access Controls: Row-level security (RLS) enforced at the database level, ensuring strict multi-tenant data isolation.
• Authentication: Multi-factor authentication, secure session management, and role-based permissions.
• Monitoring: 24/7 infrastructure monitoring, audit logging, and anomaly detection.
• Compliance: SOC 2 Type II aligned practices and regular third-party security assessments.

For more details, see our Security page.

• Active Accounts: Data is retained for the duration of your account and as needed to provide services.
• Deleted Data: Soft-deleted items (customers, statements) are held in a recycle bin for 30 days before permanent deletion.
• Financial Records: Bank statement data is retained per your organization's configured policy (default 7 years) to meet regulatory requirements.
• Account Closure: Upon account termination, we will delete or anonymize your data within 90 days, except as required by law.
• Backups: Encrypted backups may retain data for up to 30 additional days after deletion for disaster recovery purposes.

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete personal data.
• Deletion: Request deletion of your personal data, subject to legal retention requirements.
• Portability: Request your data in a structured, machine-readable format.
• Objection: Object to certain processing activities.
• Restriction: Request restriction of processing under certain circumstances.

To exercise any of these rights, contact us at privacy@tracedataiq.com.

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights regarding your personal information, including the right to know, delete, and opt-out of the sale of personal information. We do not sell personal information.

We use essential cookies for authentication and session management. We do not use third-party advertising cookies or cross-site tracking. Analytics are used solely to improve our platform.

For questions or concerns about this Privacy Policy, contact us at:

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page and updating the "Last Updated" date. Your continued use of our services after changes are posted constitutes acceptance of the updated policy.