Privacy Policy

Effective date: 21 July 2026 Last updated: 21 July 2026

1. Who we are

Tracido is a business registered in Ontario, Canada. We are the organization responsible for personal information collected through tracido.com and the Tracido service.

Privacy contact: hello@tracido.com

This policy explains what we collect, why, who we share it with, and your rights. We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

Where applicable, we also handle personal information in accordance with Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25), and the substantially similar private-sector privacy legislation of Alberta and British Columbia.

Privacy Officer: Tushar Malik, Tracido — hello@tracido.com

2. What we collect

Account information Name, email address, business name, province, and password credentials (stored in hashed form — we never see your password).

Documents you upload Utility bills, energy statements, and similar documents. These commonly contain: your business name, service address, account or meter numbers, billing periods, consumption figures, and amounts charged. Some of this may be personal information if you operate as an individual or sole proprietor.

Report data Values extracted from your documents, the corrections and confirmations you make, the emission factors applied, and the reports you generate.

Payment information Payments are processed by Stripe. We do not collect or store your full payment card number. We receive limited transaction records — amount, currency, status, date, and an internal reference — so we can show your billing history and confirm your entitlements.

Usage and technical information Log data such as IP address, browser and device type, pages visited, and timestamps, used for security, troubleshooting, and improving the Service.

3. Why we collect it

We use personal information to:

• create and administer your account;
• extract data from documents you upload and generate your reports;
• process payments, manage subscriptions, and provide billing history;
• provide support and respond to your enquiries;
• maintain the traceability and audit trail that reports depend on;
• secure the Service, prevent fraud and abuse, and troubleshoot problems;
• send service communications (receipts, security notices, important changes);
• comply with legal obligations.

We do not use your information for advertising, and we do not sell it.

4. Automated processing of your documents

To extract consumption data from uploaded documents, Tracido transmits those documents to a third-party artificial intelligence service for automated processing. The provider we currently use for this is Google Gemini, accessed through our platform provider's AI gateway. Processing takes place outside Canada.

This means the content of the bills you upload — including business name, service address, account numbers, and consumption data — leaves our systems and is processed by that provider.

A human step always follows. Extracted values are presented to you for review and correction. No report is generated until you confirm the data. Automated processing does not produce legal or similarly significant decisions about you.

If you do not wish your documents to be processed this way, do not upload them; you may enter consumption data manually instead.

5. Use of your data for AI model training

We do not permit your uploaded documents to be used to train artificial intelligence models. Specifically:

• The AI provider that performs extraction operates under paid-service terms that prohibit the provider from using your prompts or uploaded files to train or improve its models.
• We have separately opted our account out of any use of customer data for AI or machine-learning model training, fine-tuning, evaluation, or benchmarking by our platform provider. This exclusion took effect on 20 July 2026 and applies from that date forward.

For completeness: our platform provider may process de-identified, aggregated operational and usage data (which does not identify you, your business, or the contents of your documents) for its own service-improvement purposes, including machine learning, and this is not covered by the opt-out above.

6. Service providers

We share information only as needed to run the Service:

Our platform provider engages its own sub-processors to deliver its services. It publishes and maintains a current list of these sub-processors, which is available on request or via its public trust page.

We require our providers to protect information consistent with this policy and to use it only to provide services to us. We may also disclose information where required by law, to enforce our Terms, or to protect our rights, safety, or property.

We do not sell personal information, and we do not share it with advertisers.

7. Where your information is stored

Your information — including the documents you upload, your report data, and your account information — is stored and processed on servers located in the United States (Amazon Web Services, US West / Oregon region). Automated extraction and payment processing also take place outside Canada.

Emails we send you are transmitted through email infrastructure located outside Canada, including in the European Union.

While information is outside Canada, it is subject to the laws of the country where it is held, and may be accessible to courts, law enforcement, and government authorities in that country under those laws.

By using the Service, you consent to this transfer, storage, and processing.

8. How long we keep it

• Account information, uploaded documents, and report data — retained while your account is open, so that reports remain traceable to their source documents. If you close your account, this information is deleted 90 days after closure.
• Finalized reports — retained as immutable records while your account is open, since they may be relied on by third parties. Deleted on the same 90-day schedule after account closure.
• Payment and tax records — retained as required by Canadian tax and accounting law (generally six years).
• Logs — retained for a limited period for security and troubleshooting.

We recommend you download and retain your own copy of any report you rely on.

9. Security

We use technical and organizational safeguards including encryption in transit, access controls, row-level database security so users can only access their own data, hashed password storage, and payment handling delegated to a PCI-compliant processor.

Our application platform provider maintains SOC 2 Type II and ISO 27001 certifications for the infrastructure on which the Service runs. These are the platform provider's certifications; Tracido itself is not separately certified.

No system is perfectly secure. We cannot guarantee absolute security, and you use the Service at your own risk. If a breach occurs that creates a real risk of significant harm, we will notify affected individuals and the Privacy Commissioner of Canada as required by law.

10. Your rights

You may:

• access the personal information we hold about you;
• correct inaccurate or incomplete information;
• delete your account and associated data, subject to legal retention requirements;
• export your reports and data;
• withdraw consent to certain processing, subject to legal or contractual limits — note that withdrawing consent to document processing means we cannot generate reports for you;
• complain if you believe we have mishandled your information.

To exercise any of these, email hello@tracido.com. We will respond within 30 days as required by PIPEDA. We may need to verify your identity first.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada (priv.gc.ca, 1-800-282-1376).

11. Cookies and similar technologies

We use cookies and local browser storage that are necessary for the Service to function — keeping you signed in, maintaining your session, and remembering preferences such as dismissed notices.

We do not use advertising or cross-site tracking cookies. If we introduce analytics or any non-essential tracking in future, we will update this policy and, where required, obtain your consent first.

12. Children

The Service is intended for businesses and is not directed at children. We do not knowingly collect personal information from anyone under the age of majority in their province or territory.

13. Changes to this policy

We may update this policy from time to time. If changes are material, we will notify you by email or in-product notice. The current version is always posted at tracido.com/privacy, with the effective date at the top.

14. Contact

Questions, requests, or complaints about privacy: hello@tracido.com