Privacy Policy

This Privacy Policy explains how Tracer Labs, Inc., doing business as Trust ID (“Trust ID,” “we,” “us,” or “our”), collects, uses, discloses, and otherwise processes personal information in connection with our websites, applications, platform, tags, APIs, integrations, customer-intelligence services, identity and enrichment features, support and business operations, and any consumer-controlled identity or data features we may make available (collectively, the “Services”).

This Policy is designed to cover both information we process for our own business purposes and information we process on behalf of business customers. Depending on the context, the feature being used, the customer’s instructions, and applicable law, Trust ID may act as an independent data controller or “business,” or as a data processor or “service provider,” under applicable data protection laws.

1. Who We Are and When This Policy Applies

This Policy applies to personal information relating to:

• visitors to Trust ID websites and public pages;
• prospective and current customers, business contacts, and authorized users of the Services;
• individuals who interact with a website, application, store, venue, or other property on which a customer has lawfully deployed Trust ID;
• individuals whose information a customer lawfully submits or connects for recognition, identity resolution, enrichment, matching, analytics, or related processing; and
• individuals who use or participate in an optional consumer-controlled wallet, portable credential, permission, or personal-data-store feature if and when such functionality is enabled.

This Policy does not replace a customer’s own privacy notice. When you interact with one of our customers, that customer’s privacy policy and choices generally govern the customer’s collection and use of your information. When Trust ID acts as a processor or service provider on behalf of a customer, inquiries and privacy rights requests concerning the personal information we process on that customer’s behalf should be directed to the customer.

2. Our Role Depends on the Processing Context

3. Trust ID Is Not a Standalone Consumer-Data Marketplace

Trust ID does not operate a standalone marketplace whose purpose is to acquire customer-specific consumer profiles and independently resell those profiles to unrelated third parties. When Trust ID processes personal information on behalf of a customer, we use that information to provide the Services under the customer’s instructions and applicable contractual restrictions.

We may use contracted identity, resolution, enrichment, infrastructure, security, analytics, communications, artificial-intelligence, and other service providers to perform requested Services. Those providers may return identity or enrichment information to Trust ID for delivery or use within the applicable customer context. Trust ID does not obtain an independent right to commercialize customer-specific personal information merely because it is processed through the Services.

Trust ID may facilitate sharing or portability between affiliated brands, separately contracting brands, or a consumer and participating brands when the relevant customer(s) and/or consumer have authorized the activity and it is permitted by applicable law. Trust ID does not independently decide to make one customer’s identifiable customer profile available to another customer for an unrelated purpose.

Legal roles and regulatory classifications are determined by applicable law and the actual processing activity; this Policy does not override those rules.

4. California Notice at Collection and Categories of Personal Information

Depending on how you interact with Trust ID and how a customer configures the Services, Trust ID may collect or process the categories of personal information below. Not every category applies to every person, customer, feature, or deployment. This section is also intended to serve as a California Notice at Collection for information Trust ID collects directly for its own business purposes where a link to this section is presented at or before collection.

Retention criteria for these categories are described in Section 13. Whether a category is “sold,” “shared,” used for targeted advertising, or otherwise disclosed under a particular law depends on the specific activity and applicable legal definition. Trust ID does not sell personal information for money. Optional advertising or measurement activity on our own public site may involve disclosures to advertising or analytics partners that may be treated as a “sale,” “sharing,” or targeted advertising under certain laws; where required, we provide a choice and honor applicable opt-outs, including legally recognized opt-out preference signals.

5. Sources of Personal Information

We may receive personal information from the following sources:

• directly from you, including when you create an account, contact us, request information, enter into a contract, configure the Services, or use a consumer-controlled feature;
• our business customers, including through websites, applications, CRM systems, CDPs, data warehouses, uploaded files, APIs, forms, purchases, logins, or other customer-controlled systems;
• your interaction with a customer property where Trust ID has been lawfully deployed, including device, browser, session, behavioral, campaign, and interaction signals;
• customer-authorized service providers or integrations, including identity, resolution, enrichment, verification, analytics, security, and related providers;
• business partners, referrals, events, and publicly available professional or company sources for ordinary B2B relationship management and sales activities;
• Authorized Data Collaborations or entities within an authorized Customer Group; and
• consumer-controlled wallets, portable credentials, personal data stores, or permission systems when the consumer elects to present or authorize access to information.

6. How We Use Personal Information

Depending on context, we may process personal information to:

• provide, operate, maintain, secure, troubleshoot, and support the Services;
• create and administer accounts, authenticate users, manage subscriptions, process billing, and communicate about the Services;
• recognize returning visitors or devices and maintain permitted continuity across sessions, devices, properties, or approved environments;
• perform live visitor identity resolution, post-identifier profile binding, enrichment, refresh, validation, matching, or bulk/database enrichment when enabled and authorized;
• stitch customer journeys, maintain persistent customer context, create customer-specific audiences, generate analytics, measure attribution, and support customer-directed activation or personalization;
• facilitate authorized sharing within a Customer Group, an Authorized Data Collaboration, or a consumer-controlled sharing flow;
• generate intent scores, classifications, summaries, recommendations, and other AI-assisted or statistical outputs;
• detect fraud, abuse, bots, automation, security threats, or technical problems;
• respond to requests, support inquiries, legal process, audits, and compliance obligations;
• improve, test, and develop the Services using information permitted by contract and law, including aggregated or de-identified information, but not by combining personal information across unrelated customer accounts or training generalized commercial identity models using customer-derived personal information; and
• market Trust ID to business customers and prospective business customers, subject to applicable choices and law.

7. Visitor Recognition, Identity Resolution, and Enrichment

A customer may configure Trust ID to recognize a visitor pseudonymously before the visitor provides a name, email address, login, purchase, form submission, or other first-party identifier, provided the customer has lawfully deployed the Services and provided any required pre-collection notice or obtained any required consent. Where enabled by the customer and permitted by law, and only after the customer has satisfied its notice, consent, and authorization obligations, the customer may also instruct Trust ID to attempt to resolve a live visitor to an identity using approved providers and signals.

Identity or enrichment results may include contact information, postal information, professional or firmographic attributes, account or household context, and other fields permitted by the applicable provider, customer instructions, and law. The result is used to provide the applicable customer’s Services or an authorized collaboration; Trust ID does not sell or share customer personal information, treat the result as a standalone consumer profile available for unrelated resale, or use it to build independent data broker profiles across clients.

If a visitor later provides a first-party identifier through a form, login, purchase, registration, newsletter signup, or other customer interaction, the customer may direct Trust ID to associate that identifier with prior permitted context and to enrich or refresh the resulting customer profile.

Customers may also submit existing CRM, CDP, data-warehouse, database, API, or uploaded records for customer-directed bulk enrichment where that capability is enabled and permitted by applicable provider rights and law.

8. Customer Groups, Cross-Brand Collaboration, and Consumer-Authorized Sharing

Trust ID may support continuity of customer context across brands or entities where there is a lawful basis and documented authority for the sharing. This may include:

• brands or entities under common ownership or control where the participating entities are authorized to use the information;
• separate customers that have entered into an appropriate data-sharing or collaboration arrangement and instructed Trust ID to facilitate the approved use; and
• a consumer who elects to present or authorize the same portable identity, credential, preference, or customer context to more than one participating brand.

Trust ID may use technical matching, linking, routing, federated identifiers, permissions, credentials, or other mechanisms to enable an authorized collaboration. These mechanisms operate solely to support customer-directed and, where applicable, consumer-authorized processing, and do not create a pooled, independently controlled Trust ID identity graph across participating brands. Participation does not mean that every Trust ID customer can see or use every other customer’s data. Access and use remain subject to the relevant customer instructions, consumer choices, contractual restrictions, and applicable law. Each participating brand remains responsible for its respective transparency, notice, consent, and opt-out obligations for its collection, disclosure, and use of personal information.

The standard legal terms for Customer Groups, Authorized Data Collaborations, and Consumer-Authorized Sharing are incorporated into the Trust ID Terms of Service and applicable DPA. The specific participants, purposes, data categories, permissions, sources and destinations, duration, and technical controls may be documented through an Order Form, account configuration, administrator workflow, electronic acceptance, written instruction, consumer permission record, or other verifiable Collaboration Instruction. A separate signed agreement may be used where a particular transaction, jurisdiction, upstream right, or negotiated enterprise arrangement requires additional terms.

9. Consumer-Controlled Identity, Wallets, and Portable Credentials

The Services may evolve to support architectures in which an individual can exercise technical control over identity, permissions, credentials, preferences, and customer context through a digital wallet, personal data store, portable credential, or similar mechanism. Such functionality is optional, may be available only for certain Enterprise deployments, pilots, geographies, or separately enabled modules, and may not be available in the standard self-service product.

Where enabled, a consumer-controlled feature may allow an individual to decide whether to present, disclose, or authorize access to selected information to a participating brand. Trust ID does not claim ownership of personal information merely because Trust ID processes, routes, verifies, caches, references, or helps synchronize that information.

The underlying data architecture may vary. Depending on the feature, the information may reside primarily with the consumer, a participating customer, Trust ID, an approved service provider, or in a hybrid or federated arrangement. Trust ID may store a full or partial copy, a temporary cache, a token, hash, credential, identifier, permission record, audit record, routing reference, or no persistent copy at all, depending on what is reasonably necessary to provide the feature.

Revoking a wallet permission may stop future access through that permission but may not automatically delete information that a participating brand previously received and is independently permitted or required to retain. The brand’s own privacy policy and applicable law govern that brand’s retention and use.

If Trust ID offers a direct consumer wallet or account relationship, we may provide additional consumer-facing terms or privacy notices describing the applicable feature, permissions, legal roles, and controls.

10. How We Disclose Personal Information

We may disclose personal information to the following categories of recipients for the purposes described in this Policy:

• service providers and subprocessors that help provide infrastructure, hosting, storage, security, identity resolution, enrichment, analytics, artificial intelligence, communications, billing, support, or other operational services;
• our business customers, their Authorized Users, and customer-directed systems or integrations;
• authorized affiliates, Customer Group participants, data-collaboration participants, or consumer-authorized recipients where the relevant sharing is enabled and lawful;
• professional advisers, auditors, insurers, financing sources, and other advisers subject to appropriate confidentiality obligations;
• government authorities, regulators, law enforcement, courts, or other parties where required by law or valid legal process, or where reasonably necessary to protect rights, security, safety, or the integrity of the Services; and
• a successor or prospective successor in connection with a merger, acquisition, financing, reorganization, sale of assets, or similar corporate transaction, subject to applicable law.

We may also disclose aggregated or de-identified information that does not identify an individual or customer, subject to applicable law and any contractual restrictions.

11. Cookies, Similar Technologies, Advertising, and Global Privacy Control

Our websites and applications may use cookies, local storage, pixels, tags, device identifiers, and similar technologies for authentication, security, preferences, fraud prevention, analytics, service operation, and optional advertising measurement. We may maintain a separate Cookie & Tracking Policy or privacy-preference interface with more detail about the technologies currently in use.

Where required, optional analytics or advertising technologies are activated only after the applicable choice or consent. If optional advertising or measurement causes personal information to be “shared” or used for targeted advertising under applicable law, you may exercise the applicable opt-out through our privacy choices interface or a recognized opt-out preference signal, which we process without charge and, where required, in a frictionless manner.

Where required by applicable law, including state privacy laws that recognize Global Privacy Control or other opt-out preference signals, Trust ID honors Global Privacy Control or another legally recognized opt-out preference signal for the browser or device from which the signal is received on Trust ID public websites and applications. A customer website may have its own privacy controls because the customer generally determines the purpose of processing on that property.

12. AI, Inferences, and Automated Processing

The Services may use statistical models, machine learning, or generative AI to create intent scores, classifications, summaries, recommendations, audience information, explanations, or other outputs. These outputs may be probabilistic, incomplete, or inaccurate and, in customer deployments, are designed solely as customer-configured decision-support analytics.

Trust ID does not design the standard Services to make or substantially replace human decisions about consumers for credit, employment, housing, insurance, healthcare, education, or other regulated eligibility or similarly significant decisions, and the standard Services are not intended to produce legal or similarly significant effects without appropriate human review. Our customer terms restrict such uses, including uses as a consumer report under the Fair Credit Reporting Act, unless separately authorized and legally permitted.

If Trust ID engages in automated decision-making, profiling, or automated decision technology that triggers additional notice, access, appeal, human-review, or opt-out rights under applicable law, we will provide the required notice and controls for that processing.

13. Data Retention, Storage, and Architecture

We retain personal information for no longer than reasonably necessary for the purposes described in this Policy, the applicable customer agreement, customer instructions, security and fraud prevention, dispute resolution, legal obligations, and legitimate backup or recovery needs. The retention period may vary by data category, feature, customer configuration, source-license requirement, contractual commitment, and legal obligation, and is determined using criteria such as the duration of an active account or customer relationship, applicable customer contract terms and deletion instructions, legal hold or audit requirements, backup and recovery cycles, and applicable statutes of limitations.

Trust ID may provide the Services using centralized, decentralized, distributed, federated, customer-hosted, provider-hosted, consumer-controlled, shared, dedicated, multi-tenant, single-tenant, cached, replicated, or hybrid technical architectures. We may change the underlying architecture as the Services evolve, provided we continue to apply the privacy, security, access, use, and contractual restrictions applicable to the information.

Unless a customer agreement expressly requires a particular data residency or dedicated environment, information may be processed in multiple locations and systems used to provide the Services. Where cross-border transfer safeguards are required, we use an appropriate legal mechanism.

14. Security

We maintain commercially reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, use, alteration, disclosure, or destruction. Depending on the Services and architecture, safeguards may include authentication, access controls, encryption or equivalent protections, logging and monitoring, secure configuration, provider diligence, incident-response procedures, and backup or recovery measures.

No internet-connected service or storage method can guarantee absolute security. Customers are also responsible for securing their own systems, credentials, websites, integrations, and user access.

15. Your Privacy Rights and Choices

Depending on where you live and the context in which Trust ID processes your information, you may have rights to:

• know or access personal information and information about how it is processed;
• correct inaccurate personal information;
• delete personal information, subject to legal exceptions;
• obtain a portable copy of certain information;
• opt out of sale, sharing, targeted advertising, or certain profiling where applicable;
• limit certain uses or disclosures of sensitive personal information where applicable;
• object to or restrict certain processing;
• withdraw consent where processing is based on consent;
• appeal a denial of a privacy-rights request where applicable; and
• not be discriminated or retaliated against for exercising applicable privacy rights.

For information Trust ID processes solely on behalf of a business customer, the customer generally controls the relationship and the relevant privacy request. You should normally submit the request to the customer first. Trust ID will assist the customer as required by law and contract.

For information Trust ID controls directly, you may submit an applicable privacy request by contacting support@tracerlabs.com. We may need to verify your identity before completing certain requests. We will respond within the timeframe required by applicable law, typically within 45 days of receipt, unless an extension is permitted. An authorized agent may submit a request where permitted by law, subject to appropriate verification and signed authorization or power of attorney.

16. Supplemental Notice for California Residents

This section supplements the rest of this Policy for California residents to the extent the California Consumer Privacy Act (“CCPA”) applies to Trust ID as a business for a particular processing activity.

In the preceding 12 months, Trust ID may have collected the categories described in Section 4 from the sources described in Section 5 for the purposes described in Sections 6 through 12. Trust ID may have disclosed those categories to service providers, contractors, customers, customer-directed integrations, authorized collaborators, advisers, and other recipients described in Section 10 for the applicable business purposes.

Trust ID does not sell personal information, whether for monetary or other valuable consideration. To the extent optional advertising or measurement on Trust ID’s own public site constitutes “sharing” under the CCPA, the categories involved are generally identifiers and internet or network activity, and the recipients are advertising or measurement providers. California residents may opt out through our privacy choices mechanism or a recognized opt-out preference signal such as Global Privacy Control, where applicable.

When Trust ID processes Customer Personal Information as a service provider or contractor on behalf of a customer, Trust ID processes that information for the limited and specified purposes in the applicable agreement and customer instructions and does not sell or share that Customer Personal Information for Trust ID’s own independent purposes. Trust ID does not retain, use, or disclose Customer Personal Information outside of the direct business relationship with the customer or combine Customer Personal Information with personal information received from other sources, except as permitted by applicable law. Trust ID certifies that it understands and will comply with these restrictions.

Trust ID does not have actual knowledge that it sells or shares the personal information of consumers under 16 years of age. The standard Services are not directed to children.

The standard Services are not designed to collect or process sensitive personal information for the purpose of inferring characteristics about a consumer. Accordingly, a dedicated “Limit the Use of My Sensitive Personal Information” link is not required for the standard Services under 11 CCR § 7027. If a future feature would require a materially different use of sensitive personal information, we will provide the notices and choices required by applicable law.

California residents may exercise the rights described in Section 15. We will explain the verification process applicable to the request and will process opt-out preference signals as described in Section 11. Requests may be submitted to support@tracerlabs.com. Where a request concerns information processed solely for a customer, we may direct the request to that customer. For purposes of California’s “Shine the Light” law, Cal. Civ. Code § 1798.83, we do not disclose personal information to third parties for their direct marketing purposes.

17. EEA, United Kingdom, and Switzerland

Where European data-protection law applies and Trust ID acts as controller for a processing activity, we may rely on one or more of the following legal bases: performance of a contract or steps requested before entering a contract; our legitimate interests or those of a third party where not overridden by your rights; compliance with legal obligations; and consent where required.

Where Trust ID processes personal data on behalf of a customer, the customer generally acts as controller (or as a processor for another controller) and Trust ID acts as processor or subprocessor, as applicable. The relevant customer agreement and data processing addendum govern that processing. Where cross-border transfers subject to European data-protection law occur, we use appropriate transfer safeguards, such as the EU/UK Standard Contractual Clauses or other lawful mechanisms.

Individuals may have rights of access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and the right to lodge a complaint with an applicable supervisory authority. If your request concerns customer-controlled data, please contact the relevant customer first.

18. Children and Restricted Uses

The standard Services are intended for business use and are not directed to children under 13 as defined by COPPA or to minors under 16 where restricted by applicable state privacy laws. Customers may not knowingly use the standard Services to collect, resolve, enrich, profile, or target children or minors in violation of applicable law. A specialized deployment involving minors or specially regulated information requires Trust ID’s prior written approval, appropriate contractual terms, and all legally required safeguards.

19. Changes to This Policy

We may update this Privacy Policy as the Services, legal requirements, data practices, consumer-controlled features, or business operations evolve. We will update the “Last Updated” date when we make changes. Where required by law, we will provide additional notice of material changes.

Changes to underlying providers, infrastructure, storage architecture, implementation methods, or technical topology do not necessarily require a separate policy revision if the purposes, categories, disclosures, rights, and protections described in this Policy remain materially accurate. We will update the Policy when a change materially affects our information practices or applicable law requires an update.

20. Contact Us

Questions or privacy requests may be directed to:

Tracer Labs, Inc. d/b/a Trust ID

Privacy requests and questions: support@tracerlabs.com