Privacy Policy

TrustTrace operates a fraud reporting and victim-support platform for people in Canada. This policy explains what personal information we collect, why, how long we keep it, and the choices you have. We handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, substantially similar provincial legislation.

1. Who we are

TrustTrace is a private agency. We are not a government department, a regulator, or a law enforcement agency, and we have no special legal access powers. For the purposes of applicable privacy law, TrustTrace is the organization responsible for the personal information described in this policy. Contact details for our privacy office are in section 10.

2. What we collect

Information you give us when filing a report

• Contact details: full name, email address, and optionally your phone number, country, preferred language (English/French), preferred contact method, and best contact time.
• Report content: your description of the incident, dates, the website, platform, company or individual involved, scammer contact points (emails, phone numbers, social accounts), payment and loss details you choose to provide, and any files you upload.
• Account information, if you create one: name, email, password (stored only as a salted bcrypt hash), and preferences.

Information collected automatically

• A one-way hashed form of your IP address with the report, kept solely to detect spam and duplicate submissions. We do not store the raw IP.
• Browser user-agent string, for abuse analysis.
• Cookieless, aggregated page-view counts (path and day only). See our Cookie Policy.

What we never ask for

We never request passwords, wallet seed phrases, private keys, or full payment-card numbers. Our systems actively detect and block submissions containing material that appears to be such credentials. If you accidentally include one, contact us immediately so we can purge it from the record.

3. Why we use it (lawful purposes)

• To review and follow up on your report, and to communicate with you about it (consent, given when you submit the form).
• To detect fraud patterns, prevent abuse of the platform, and identify duplicate reports (legitimate interests; minimal data).
• To publish public warnings about scam contact points — without your identity or personal details (legitimate interests; see section 4).
• To comply with legal obligations where validly required by Canadian authorities.

4. Public information

Only scam indicators (websites, company names, emails, phone numbers, wallet addresses, transaction hashes, social accounts), the fraud category, general dates, and a review status are ever shown publicly. We do not publish your name, contact details, description text, loss amounts tied to you, or evidence files. Entries begin as user allegations and are labelled accordingly; only entries our analysts verify carry the “Verified Warning” label. Dispute and correction mechanisms are available on every public entry.

5. Sharing

We do not sell personal information. We share it only: (a) with your explicit consent or request; (b) with appropriate organizations such as a financial institution involved in your case, when you ask us to assist with a recall or dispute; (c) with law enforcement or regulators under valid legal process; (d) with service providers bound by contract who help us operate the platform (e.g., email delivery), under confidentiality obligations.

6. Security

• All traffic is encrypted in transit (HTTPS/TLS).
• Evidence files are stored outside the public web root with access only through authorized, audit-logged routes.
• Staff access is role-based, requires authentication, and every case view, file download, export, and status change is recorded in an audit log.
• Passwords are stored as salted bcrypt hashes; sessions use signed, HttpOnly cookies.
• We apply rate limiting, same-origin enforcement, input validation, and upload scanning hooks. See our public security notes for more detail.

7. Retention

Reports and evidence are retained while a case is active and for a further period needed for legal, dispute-resolution, and statistical purposes, after which they are securely deleted or irreversibly anonymized. Account data is deleted upon verified account-deletion requests, subject to minimum retention required for dispute resolution and legal compliance. Audit logs are retained for security purposes and then rotated.

8. Your rights

• Access & a copy: request a copy of the personal information we hold about you (account holders can export it directly from their dashboard).
• Correction: ask us to correct inaccurate information.
• Withdrawal of consent / deletion: ask us to delete your personal information; we will explain any legal exceptions that require limited retention.
• Complaints: you may complain to our privacy office or to the Office of the Privacy Commissioner of Canada.

9. Cookies & analytics

We use a single essential session cookie for sign-in security and aggregated, cookieless page-view statistics. No advertising, cross-site tracking, or social pixels are used. Details are in our Cookie Policy.

10. Contacting our privacy office

Privacy requests: use our contact form and select “Privacy / data request”. We respond within 30 days. This document is provided for transparency and does not constitute legal advice; we review it against applicable Canadian privacy legislation as our operations evolve.