Privacy Policy
Effective date: [DATE THESE PAGES GO LIVE] Last updated: [SAME DATE]
1. Introduction
TRACQ ("TRACQ", "we", "us" or "our") operates an online platform used by individuals and entities evaluating the acquisition of a business. This Privacy Policy describes how we collect, use, disclose and protect personal information in connection with the website at usetracq.com and the application at app.usetracq.com (together, the "Service").
This Policy forms part of and should be read together with our Terms of Use. Capitalised terms not defined in this Policy have the meaning given to them in the Terms of Use.
By accessing or using the Service, you confirm that you have read this Policy.
2. Scope
This Policy applies to personal information we process in operating the Service.
Users of the Service routinely upload material relating to a target business, including information concerning its owners, employees, customers and suppliers. Where you upload such material, you are the controller of the personal information it contains and we process that information on your behalf and on your instructions. Clause 12.4 sets out the consequences of that allocation.
3. Information we collect
3.1 Information provided by you
Account information. Your name, email address, authentication credentials, which are stored only in hashed form, and any optional profile information you supply. Where you authenticate through a third-party identity provider, we receive your name, email address and profile image from that provider.
Enquiry information. Where you request a consultation, subscribe to our newsletter or otherwise contact us, we collect your name, email address, telephone number, the stage of search you select and the contents of any message you send.
Operator profile information. Information you provide through features including Buy Box Preferences, CEO Profile, Industry Match and About Me. This may include your professional background, operating experience, capital position and stated sector and geographic preferences.
Deal information. Information you record against a deal, including business names, locations, listing particulars, notes, highlights and documents uploaded through Company Inputs. Uploaded documents frequently include confidential information memoranda, financial statements, tax filings, customer and supplier records and other broker material.
Query information. The questions you submit through Deal Compass and Search Compass and the outputs generated in response.
Payment information. Where you subscribe to a paid plan, our payment processor collects your payment card details and billing address directly. We receive a record of the transaction, the card type, the final four digits of the card and your subscription status. We do not receive or store complete payment card numbers.
3.2 Information collected automatically
We collect technical and usage information including IP address, browser type and version, device type, operating system, referring URL, pages and features accessed, actions taken, timestamps, session duration and error logs. This information is collected through our systems and through the technologies described in clause 9.
3.3 Information received from third parties
We receive information about you from identity providers where you use third-party authentication, from our payment processor in relation to billing status, from our email and newsletter platform in relation to message delivery and engagement, and from analytics providers in aggregated form.
We do not acquire personal information from data brokers.
4. Purposes of processing
We process personal information for the following purposes:
(a) establishing, authenticating and administering your account;
(b) generating the reports, briefings, risk profiles and other outputs you request;
(c) responding to queries submitted through Deal Compass and identifying patterns across your search through Search Compass;
(d) storing your highlights, notes and generated results, and producing exports at your request;
(e) administering subscriptions, trials, invoicing and renewals;
(f) providing support and responding to correspondence;
(g) sending service communications relating to your account, security, billing or changes to the Service;
(h) sending newsletters and product communications where you have subscribed or where otherwise permitted by law, each containing a means of unsubscribing;
(i) monitoring performance, diagnosing faults and maintaining the reliability of the Service;
(j) analysing feature usage for the purpose of product development;
(k) detecting, investigating and preventing fraud, abuse and security incidents; and
(l) complying with legal obligations and enforcing our Terms of Use.
5. Confidential deal material
This clause prevails over any inconsistent provision elsewhere in this Policy.
5.1 Material uploaded to a deal record is accessible to you, to any person you expressly invite to that deal record, and to the limited categories of our personnel described in clause 7.4.
5.2 We process deal material solely to produce the reports, analysis and responses requested by you within your account. We do not use deal material for advertising purposes. We do not disclose deal material to other users of the Service, including other users evaluating the same business. We do not disclose the identity of a business you are evaluating to any third party except where required by law.
5.3 Where we produce aggregate or statistical information concerning use of the Service, that information is produced in a form which does not identify you, your deal records or any business evaluated through the Service.
5.4 You are responsible for ensuring that you are entitled to upload the material you upload. Material handled in the course of a search is frequently subject to a non-disclosure agreement or other confidentiality undertaking. Clause 7 of our Terms of Use addresses your obligations in this respect.
6. Automated processing and artificial intelligence
6.1 The Service uses large language models supplied by third-party providers to generate reports, briefings, assessments and responses.
6.2 When you request an output, the relevant contents of the applicable deal record, which may include text you have entered and text extracted from documents you have uploaded, are transmitted to our artificial intelligence provider together with our processing instructions. The generated output is returned to us and stored within your account.
6.3 Our agreements with our artificial intelligence providers prohibit those providers from using content submitted through our account to train their models, and require such content to be retained only for the limited period necessary for service delivery and abuse monitoring. We will identify our current providers on request made to ele@usetracq.com.
6.4 We do not use deal material, uploaded documents, operator profile information or query history to train artificial intelligence models serving other customers or the public.
6.5 Outputs generated by the Service are unverified and may contain errors or omissions. Clause 6 of our Terms of Use sets out the basis on which outputs are provided.
6.6 We do not take decisions producing legal or similarly significant effects concerning you on the basis of automated processing alone.
7. Disclosure of personal information
We do not sell personal information and we do not share personal information for cross-context behavioural advertising. We disclose personal information only in the circumstances set out in this clause.
7.1 Service providers
We engage third-party providers to operate the Service. Each provider is engaged under contractual terms requiring it to process personal information only on our instructions and to maintain appropriate security measures. The categories of provider we engage are:
| Category | Purpose | Categories of information |
|---|---|---|
| Cloud hosting and storage | Operation of the Service and storage of data | All account and deal information |
| Artificial intelligence providers | Generation of outputs | Deal content submitted for a given request |
| Payment processing | Subscription administration and billing | Name, email address, billing information |
| Email delivery | Transactional and newsletter email | Name, email address, engagement information |
| Analytics and monitoring | Usage measurement and error reporting | Usage and device information |
| Support tooling | Handling of correspondence | Contact details and message contents |
| Scheduling | Booking of consultations | Name, email address, telephone number |
We will provide a current list of named providers on request made to ele@usetracq.com.
7.2 Persons invited by you
Where you invite a collaborator, adviser, lender or accountant to a deal record, that person will have access to the material contained in it. Such invitations are controlled by you.
7.3 Legal and regulatory disclosure
We may disclose personal information where we reasonably consider disclosure necessary to comply with any applicable law, regulation, subpoena, court order or lawful request of a governmental authority, to enforce our agreements, or to protect the rights, property or safety of TRACQ, our users or any third party. Where permitted to do so, we will notify you of any such request.
7.4 Our personnel
A limited number of authorised personnel may access account information where necessary for the purposes of support, security, billing or fault diagnosis. Access to deal material is restricted, recorded and granted only where necessary to resolve a specific matter, ordinarily one reported by you.
7.5 Corporate transactions
In the event of a merger, acquisition, financing or sale of assets, personal information may be transferred as part of that transaction. We will give notice before any personal information becomes subject to a different privacy policy.
8. Retention
8.1 We retain personal information for the period during which your account remains active, and thereafter in accordance with the periods set out below.
| Category | Retention period |
|---|---|
| Account information | [NUMBER] months following closure of the account |
| Deal content and uploaded documents | Deleted from active systems within [NUMBER] days of deletion by you or closure of the account |
| Backups | Overwritten on a rolling [NUMBER] day cycle |
| Billing records | The period required under applicable tax and accounting law, ordinarily seven years |
| Correspondence | [NUMBER] months |
| Aggregated, de-identified usage information | Indefinitely, such information no longer identifying any individual |
8.2 You may request deletion of individual deal records or of your account at any time in accordance with clause 11.
9. Cookies and similar technologies
9.1 We use cookies and similar technologies for the following purposes:
(a) strictly necessary purposes, including maintaining your session, authenticating you, securing form submissions and balancing load. The Service cannot operate without these technologies;
(b) preference purposes, including retaining your display and layout settings; and
(c) analytics purposes, including measuring feature usage and identifying errors.
9.2 We do not use advertising cookies and we do not permit third-party advertising networks to operate on the Service.
9.3 Cookies may be controlled through your browser settings. Disabling strictly necessary cookies will prevent access to your account. Where required by applicable law, non-essential technologies are set only following your consent, obtained through the consent banner presented on first access.
9.4 There is no consistent industry standard governing responses to browser "Do Not Track" signals and we do not currently respond to them. We honour Global Privacy Control signals where required by applicable law.
10. Security
10.1 We maintain technical and organisational measures appropriate to the sensitivity of the material processed through the Service, including:
(a) encryption of data in transit using Transport Layer Security, and encryption of stored data and documents at rest;
(b) storage of authentication credentials in salted hashed form only;
(c) role-based access controls, with access to deal material restricted and recorded;
(d) least-privilege access to production systems and network segregation;
(e) monitoring, alerting and logging across production infrastructure;
(f) assessment of third-party providers before engagement; and
(g) regular backups subject to restoration testing.
10.2 No system of transmission or storage is entirely secure. You are responsible for maintaining the confidentiality of your authentication credentials and for notifying us at ele@usetracq.com of any suspected unauthorised access to your account.
10.3 Where a security incident affects your personal information, we will notify you and any competent supervisory authority within the periods required by applicable law.
11. Your rights
11.1 Subject to applicable law, you may request that we:
(a) confirm what personal information we hold about you and provide access to it;
(b) provide your personal information in a portable format;
(c) correct personal information which is inaccurate or incomplete;
(d) delete your account and the information held within it;
(e) restrict or cease certain processing;
(f) cease processing carried out on the basis of your consent, without affecting processing already carried out; or
(g) cease sending marketing communications.
11.2 Requests may be made to ele@usetracq.com from the email address registered to your account, or through the controls within your account. We will respond within thirty days, or within any shorter period required by applicable law. We may require verification of your identity before acting on a request.
11.3 We will not discriminate against you for exercising any right under this clause.
12. Jurisdiction-specific provisions
12.1 United States
Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana and other states having comprehensive privacy legislation hold the rights set out in clause 11, together with the right to be informed of the categories of personal information collected, the sources of that information, the purposes of processing and the categories of recipient. That information is set out in clauses 3, 4 and 7.
12.2 California
We do not sell personal information and we do not share personal information for cross-context behavioural advertising, each as defined under the California Consumer Privacy Act. We do not knowingly collect personal information concerning any individual under sixteen years of age.
Requests may be submitted by an authorised agent on production of written authorisation. Where a request is declined, an appeal may be submitted to ele@usetracq.com marked "Appeal", to which we will respond within forty-five days.
We do not collect sensitive personal information for the purpose of inferring characteristics about any individual. Financial information uploaded in respect of a target business is processed solely to deliver the Service requested.
12.3 European Economic Area and United Kingdom
Where the General Data Protection Regulation or the UK General Data Protection Regulation applies, our legal bases for processing are as follows:
| Purpose | Legal basis |
|---|---|
| Provision and administration of the Service | Performance of a contract |
| Billing and subscription administration | Performance of a contract |
| Security, fraud prevention and product development | Legitimate interests |
| Newsletter and marketing communications | Consent, or legitimate interests where permitted |
| Compliance with legal and tax obligations | Legal obligation |
You have the right to lodge a complaint with your supervisory authority. We invite you to raise any concern with us in the first instance.
12.4 Information relating to third parties
Where you upload information relating to a third party, including a seller, its employees or its customers, you are the controller of that information and we act as your processor in respect of it. You are responsible for ensuring that you have a lawful basis for disclosing that information to us.
13. International transfers
13.1 We operate from [COUNTRY]. Our infrastructure and providers are located in [HOSTING PROVIDER AND REGION TO CONFIRM]. Where you access the Service from another jurisdiction, your personal information will be transferred to and processed in those locations.
13.2 Where personal information is transferred outside the European Economic Area or the United Kingdom, we rely on Standard Contractual Clauses approved by the European Commission, the United Kingdom International Data Transfer Addendum or another lawful transfer mechanism, together with supplementary technical measures. Copies of the relevant safeguards are available on request made to ele@usetracq.com.
14. Children
The Service is intended for use by adults in a business context. It is not directed at children and we do not knowingly collect personal information from any individual under eighteen years of age. Where we become aware that we hold such information, we will delete it.
15. Third-party websites
The Service may contain links to broker listings, marketplaces, lender websites and other third-party resources. We do not control those resources and this Policy does not apply to them. Their practices are governed by their own policies.
16. Amendments
We may amend this Policy to reflect changes to the Service or to applicable law. The date at the head of this Policy will be updated accordingly. Where an amendment is material, we will give notice by email or through the Service before it takes effect. Continued use of the Service following the effective date of an amendment constitutes acceptance of the amended Policy. Previous versions are available on request.
17. Contact
TRACQ [REGISTERED ADDRESS]
Email: ele@usetracq.com
All enquiries, including requests under clause 11 and reports of suspected security incidents, may be directed to the address above.
