TitleTrace
Legal

Privacy Policy

Effective: June 2026

1. Scope and our role

This policy explains how TitleTrace, Inc. (“TitleTrace,” “we”) handles personal information. Our role depends on the data:

  • Account & contact data (the information you give us to create and run an account) — we are the controller.
  • The documents and data you upload for examination — we act as a processor on behalf of your firm, handling that content only on your instructions and under your customer agreement (and Data Processing Addendum, where applicable).

2. Information we collect

Account information — name, email address, organization name, role, and billing information when you create an account.

Uploaded content — the documents and data you submit for processing, and the findings and work product generated from them.

Usage data — logs and minimal analytics needed to operate, secure, and improve the service.

3. How we use information

We use information to provide, maintain, secure, and improve the service; to process your documents and generate cited findings; to handle billing; and to communicate with you about your account. We do not use the documents you upload for our own marketing or product analytics.

4. Your document data

Documents you upload are processed solely to provide the services you request, on your firm’s instructions. Your document data is never used to train, fine-tune, or improve any AI model — ours or a provider’s. Document data is encrypted at rest and in transit and is isolated to your organization.

5. Connected cloud accounts (Google Drive and Microsoft OneDrive)

A workspace administrator may connect a Google Drive or Microsoft OneDrive account so that documents in folders they choose are kept in sync with their firm’s knowledge base. When an account is connected:

  • What we access. We request read-only access to files (Google: drive.readonly; Microsoft: Files.Read) and basic profile information (email address) used only to label the connection. We list and download files only from the folders the administrator explicitly connects.
  • What we do with it.Copies of those files are stored in the firm’s own isolated knowledge base and processed as described in Section 4. Synchronization is one-way: we never create, modify, or delete anything in the connected account.
  • Credentials. Access tokens are encrypted at rest in a credential vault, are never exposed to the browser, and are deleted when the connection is removed (for Google, we also revoke the grant with Google). Access can additionally be revoked at any time from your Google security settings or Microsoft account portal.
  • Limited Use.TitleTrace’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained through Google APIs is not used for advertising, is not sold, is not read by humans except with your permission or as necessary for security, support, or legal compliance, and is not used to develop, improve, or train generalized AI or machine-learning models.

6. Cookies and analytics

We use essential cookies needed to sign you in and run the application, plus minimal first-party analytics to understand and improve usage. We do not use third-party advertising or cross-site tracking cookies. Where required by law, we ask for consent to non-essential cookies.

7. How we share information

We do not sell, rent, or trade your personal information or document data. We share data only with the sub-processors listed below (under data processing agreements), when required by law, or in connection with a merger or acquisition (subject to this policy).

8. Sub-processors

We rely on a small set of vetted infrastructure providers to operate the service. Each is bound by a data processing agreement; the current list is:

  • Supabase — database, document storage, authentication (US).
  • Vercel — application hosting and AI request routing (US).
  • Railway — background processing and document-processing workers (US).
  • Anthropic — AI model provider for reading, extraction, and cited analysis; does not train on data submitted through its commercial API (US).
  • Resend — transactional and notification email (US).

We’ll provide notice of material changes to this list on request.

9. International data transfers

The service is operated in the United States, and data is stored and processed there. If you access the service from outside the US, you consent to that transfer; where required, we rely on appropriate transfer mechanisms (such as Standard Contractual Clauses).

10. Data retention

We retain account data for as long as your account is active. The documents you upload are retained per your customer agreement and your settings; on account termination, customer data is available for export for 30 days and then permanently deleted. Operational logs and backups are kept for a limited period and then expire.

11. Security

We use AES-256 encryption at rest, TLS encryption in transit, and per-organization data isolation, on infrastructure that is itself SOC 2 and ISO 27001 certified. We describe what we do — and what we don’t yet claim — plainly on our security page.

12. Your rights

Depending on where you live, you may have rights to access, correct, delete, export, or object to the processing of your personal information, and (under U.S. state laws such as the CCPA) to know what we collect and to opt out of any “sale” — which we do not do.

For account data, contact privacy@titletrace.io. For uploaded documents, requests are directed through the firm whose account holds them, since we process that content on the firm’s behalf.

13. Automated decision-making

TitleTrace uses AI to read documents, extract values, and surface cited findings. It does not make final determinations on your behalf — every finding is reviewed and decided by a person. We do not engage in automated decision-making that produces legal or similarly significant effects without human review.

14. Data incidents

If we become aware of a security incident affecting your personal information or documents, we will notify affected customers without undue delay and provide the information you need to meet your own obligations.

15. Children

The service is intended for businesses and is not directed to children under 16. We do not knowingly collect personal information from children.

16. Changes to this policy

We may update this policy from time to time. We will post the updated version with a new effective date and, for material changes, provide additional notice. Your continued use after an update constitutes acceptance.

17. Contact

Questions about this policy? Contact privacy@titletrace.io.