privacy_policy 2026-08

Privacy Policy PEGTrace LLC | Last Updated: August 2026 This Privacy Policy describes how PEGTrace LLC, a New Jersey limited liability company (“PEGTrace,” “we,” “us,” or “our”), collects, uses, discloses, retains, and protects Personal Data through the PEGTrace website, public fraud-report intake, wallet-exposure and verification functions, authenticated Platform, evidence-packaging workflows, and related institutional, professional, and public-facing services. This Privacy Policy does not govern Personal Data collected through a separate consumer purchase flow, which will be governed by the consumer-facing privacy notice presented at or before checkout. It also describes the privacy choices and rights that may be available to individuals under applicable law. This Privacy Policy is a notice concerning PEGTrace’s data practices and does not independently create contractual warranties or a separate arbitration, liability, or entire-agreement regime. Authenticated institutional and professional use is also governed by the Terms of Service, and applicable order form, data processing agreement, or other negotiated agreement. 1. Scope and Key Terms 1.1 “Case Data” means identifiers, transaction hashes, notes, documents, analytical observations, metadata, and other case-related information submitted to or generated through the Platform by or for a user. 1.2 “Evidence Ledger” means the append-only, hash-linked chronological record of designated Platform events that is designed to make subsequent alteration detectable. 1.3 “Personal Data” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to an identified or identifiable individual. Depending on the context, Personal Data may include account and contact information, technical and usage information, payment and transaction information, Case Data, uploaded materials, communications, generated reports, audit and verification records, and other information described in this Privacy Policy. 1.4 “Platform” means the PEGTrace web application, public verification portal, cryptographic hashing engine, evidence-packaging workflows, and application programming interfaces operated by PEGTrace LLC. 1.5 “Technology Subprocessors” means third-party service providers engaged to support Platform operations, as identified in PEGTrace’s current Data Handling and Subprocessor Disclosure. 2. Scope, Privacy Roles, and Information Collected 2.1 Institutional Case Data. When an institutional or professional customer determines what Case Data is submitted to the Platform and the purposes for which that information is processed, the customer may act as the controller or business responsible for the Case Data, and PEGTrace may process the information on the customer’s behalf and according to its instructions. The customer remains responsible for its own privacy notices, legal authority, and responses to affected individuals. Any applicable data processing agreement or other negotiated agreement will govern the parties’ respective contractual data-processing obligations. 2.2 PEGTrace-Controlled Data. PEGTrace determines the purposes and means of processing Personal Data used for website and public-service operation, account administration, authentication, billing where applicable, fraud prevention, Platform security, support, legal compliance, dispute resolution, maintenance of business and audit records, and production of limited aggregate cross-case linkage signals. PEGTrace may therefore act as the controller or business responsible for those processing activities even where it otherwise processes institutional Case Data on a customer’s behalf. 2.3 Direct and Public-Site Data. When an individual interacts directly with PEGTrace through a public fraud-report intake, wallet-exposure check, verification page, public share or invitation function, support request, or other public-facing service, PEGTrace determines the purposes and means of processing the Personal Data collected through that interaction. A separate consumer purchase flow, if offered, will be governed by the consumer privacy notice and transaction terms presented for that purchase. 2.4 Information We Collect. Depending on how a person interacts with PEGTrace, we may collect: (a) account, contact, professional-affiliation, role, authentication, and account-permission information; (b) transaction and limited payment-related information where a payment function is enabled, while full payment-card or bank credentials are collected directly by the payment processor; (c) internet-protocol addresses, device and browser information, authentication events, rate-limit and CAPTCHA information, device-fingerprint signals, and other technical or security data; (d) Case Data, including wallet addresses, transaction hashes, email headers, internet-protocol addresses, phone numbers, device identifiers, domains, bank or wire information, notes, dictated notes, uploaded files, communications, and metadata; (e) third-party intelligence results and derived fraud, breach, device, domain, wallet, and transaction signals; (f) generated reports and packages, Evidence Ledger entries, hashes, timestamps, audit records, verification records, and acceptance records; (g) authenticated AI Coach inputs, outputs, case-scoped conversation turns, limited interface and route context, permitted aggregate case context, and any designated field text expressly authorized for transmission; (h) form drafts, public intake submissions, wallet-exposure and verification queries, share tokens, and invitation tokens; (i) support and business communications, email-delivery records, suppression entries, and unsubscribe information; and (j) attorney-directory listings, introduction messages, abuse reports, and institutional inquiries. 2.5 Data Segregation and User-Entered Information. PEGTrace stores Case Data and Evidence Ledger entries within the same managed database, but in separate tables subject to different access permissions and immutable-ledger controls. This is logical and privilege-based separation, not physical separation into customer-specific databases, schemas, or storage environments. Evidence Ledger payloads may contain event information in readable form, while associated hash values provide integrity evidence rather than confidentiality. Users are responsible for reviewing narrative fields and exported materials because information entered into free-text fields may appear in generated reports or evidence packages. 2.6 Cryptographic Hashes. PEGTrace may generate cryptographic hashes to support comparison of electronic files or designated Platform records without publishing the underlying file through the hash itself. A hash is not necessarily anonymous or outside the scope of privacy law merely because it does not independently reveal the underlying content. Its legal treatment may depend on associated records, accessibility, context, and reasonably available means of linking it to a user, case, report, wallet, transaction, document, or other information related to an individual. A public verification result may also display limited aggregate linkage information, such as a count of other records associated with the submitted identifier, without disclosing another customer’s identity, case number, tenant, or contributor. 3. Technology Subprocessors and External Providers 3.1 Technology Subprocessors. PEGTrace engages Technology Subprocessors supporting application hosting, database and object storage, authentication, transactional communications, security and bot prevention, authenticated text-to-speech functionality, authenticated artificial-intelligence functionality, and trust-anchor publication. If an institutional or professional payment function becomes operational, PEGTrace may also engage a payment processor for that function. PEGTrace’s current Data Handling and Subprocessor Disclosure identifies the applicable providers, distinguishes current from conditional functionality, and describes the categories of information processed through those services. The providers, functions, and technical architecture may change as the Platform evolves. 3.2 External Intelligence Providers. PEGTrace transmits selected identifiers or query information to external intelligence providers only when the applicable public or authenticated workflow invokes that provider. The public wallet-exposure check transmits the submitted wallet address and selected blockchain network to Bitquery. It does not transmit public fraud-report intake information to Bitquery. Authenticated analyst workflows may transmit wallet addresses, transaction hashes, blockchain-network identifiers, email addresses, domains, internet-protocol addresses, URLs, telephone numbers, device information, or other selected query identifiers to supported blockchain, breach, device-risk, domain, phishing, or related intelligence providers. The public fraud-report intake and consumer-facing services do not invoke the authenticated Have I Been Pwned, IPQualityScore, ElevenLabs, or blockchain-tracing workflows. Information transmitted to an external provider is not necessarily anonymous merely because a person’s name is omitted. Provider results may be preliminary, incomplete, delayed, or inaccurate and should be independently reviewed before reliance or external use. 3.3 Payment Processing. If PEGTrace enables an institutional or professional payment function, the designated payment processor will host the payment interface and collect payment-card or bank credentials directly under its own terms and privacy notice. PEGTrace may receive the buyer’s email address, payment status, amount, currency, session metadata, and processor-generated identifiers. Full payment-card or bank credentials are not provided to PEGTrace under the presently designed architecture. 3.4 Artificial-Intelligence Processing. The AI Coach is restricted to authenticated administrative surfaces and routes requests through the Lovable AI gateway. The underlying model provider is not independently verifiable from the reviewed codebase. PEGTrace therefore does not identify a particular underlying model vendor in this Privacy Policy. PEGTrace may transmit applicable system instructions; limited interface and route context; a static navigation-destination catalogue; prior conversation turns; text submitted by the authenticated user; limited aggregate case context consisting of the case number, identifier count, and attachment count; an on-screen form schema containing field names and types but not field values; and, when expressly authorized for the interaction, the literal text of a designated field. By code design, the server-assembled payload does not include identifier values, wallet addresses, attachment contents, victim statements, or evidence bytes. PEGTrace does not use artificial intelligence to generate consumer report output. Consumer output is produced through deterministic templates and canonical hashing. Consumer-submitted free text is not transmitted to the AI gateway. PEGTrace’s input controls do not, however, technically prevent every prohibited or unnecessary submission by an authenticated AI Coach user. 3.5 AI Retention and Training. PEGTrace stores user and assistant conversation turns in a case-scoped history for up to ninety (90) days, after which they are subject to an automated nightly purge. PEGTrace also records an audit event concerning the actor and message count without recording the message content in that audit event. Provider-side logging, retention, human review, safety monitoring, and model-training practices are governed by the terms applicable to PEGTrace’s implemented gateway and provider configuration and are described in the Data Handling and Subprocessor Disclosure only to the extent confirmed. PEGTrace does not represent that zero-data-retention treatment or any other particular provider-side practice applies unless confirmed for the implemented account and configuration. PEGTrace does not itself use institutional Case Data or AI Coach conversations for model training, benchmarking, analytics, or unrelated product development. 3.6 Third-Party Terms and Practices. Technology Subprocessors and external providers process information under their own contractual, privacy, retention, and security practices. PEGTrace evaluates providers according to its applicable operational and contractual requirements but does not control every aspect of a third party’s independent systems or services. 4. Cookies, Storage Technologies, and Analytics 4.1 Functional Cookie and Local Storage. PEGTrace currently uses a functional cookie to remember a user-interface preference. Browser local storage may be used for the authentication session, language and interface preferences, per-case workflow markers, form drafts, assistant-panel settings, and microphone or voice-input consent. Disabling or deleting these technologies may end an authenticated session, remove saved drafts or preferences, or impair portions of the Platform. 4.2 Technical, Security, and Fraud-Prevention Information. PEGTrace does not currently use a third-party analytics platform, session-replay provider, advertising pixel, retargeting tag, or third-party error-monitoring service. PEGTrace processes technical information reasonably necessary to authenticate users, maintain sessions, enforce rate limits, troubleshoot errors, protect Platform security, and prevent fraud or misuse. PEGTrace uses Cloudflare Turnstile on its public fraud-report intake and wallet-exposure-check functions. Turnstile receives the applicable challenge token and internet-protocol address and may process browser, device, interaction, and related technical information as necessary to evaluate the request and prevent automated abuse. An authenticated analyst workflow may also load an IPQualityScore device-fingerprinting script in the browser of the device being evaluated. That script generates a request identifier that PEGTrace uses to retrieve the resulting fraud or device-risk evaluation. This functionality is not called through PEGTrace’s public or consumer-facing services and is used for fraud and security purposes, not advertising. 4.3 Cookie and Privacy Choices. Browser settings may permit users to block or delete certain cookies or local-storage items. Disabling essential technologies may prevent authentication or impair portions of the website or Platform. Where applicable law requires additional consent or opt-out mechanisms for analytics, advertising, sale, sharing, or other regulated processing, PEGTrace will provide the applicable mechanism and describe it in this Privacy Policy or the relevant interface. 4.4 Current Advertising Position. PEGTrace does not currently use Personal Data for targeted or cross-context behavioral advertising. PEGTrace will update this Privacy Policy and implement any legally required choice or consent mechanism before materially changing that practice. 5. Data Retention, Deletion, and Verification Records 5.1 Retention Criteria. PEGTrace retains Personal Data for periods reasonably necessary to provide and secure the applicable services, maintain business and transaction records, comply with legal obligations, resolve disputes, enforce agreements, prevent fraud or misuse, and support authorized verification functions. Retention periods may vary according to the category of information, the applicable customer relationship, the sensitivity of the information, operational requirements, legal obligations, and the purposes for which the information was collected. 5.2 Category-Based Retention. Certain categories are subject to automated retention controls, including case-scoped AI Coach conversation turns for up to ninety (90) days, after which they are subject to an automated nightly purge. Other temporary or workflow-specific records are retained according to the applicable implemented configuration, operational purpose, and legal requirements. Other categories—including Case Data, notes, uploaded files and metadata, the encrypted sensitive-data store, Evidence Ledger entries, audit records, email-delivery and suppression records, institutional inquiries, directory records, and third-party signal records—do not currently have an automated expiration and may remain until manually deleted or otherwise addressed under an applicable agreement, legal requirement, or established retention process. Additional technical retention information is provided in the Data Handling and Subprocessor Disclosure. 5.3 Deletion Requests. Where applicable law provides a right to request deletion, an individual may submit a verified request using the contact method stated in Section 10 of this Privacy Policy. PEGTrace will evaluate the request under applicable law, including any permitted exceptions. If the request concerns Case Data controlled by an institutional customer, PEGTrace may refer the request to or coordinate its response with that customer. A deletion request does not necessarily require deletion of information that PEGTrace or its customer must retain for legal compliance, security, fraud prevention, dispute resolution, establishment or defense of legal claims, authorized recordkeeping, or another legally permitted purpose. 5.4 Effect and Limitations of Deletion. PEGTrace handles deletion requests manually using the administrative capabilities reasonably available within its systems. Individual notes and attachments may be deleted administratively, but an active case containing derived entities or Evidence Ledger entries may not be technically deletable through the current application architecture. Deletion of an attachment does not remove its filename, file type, size, or hash from an associated immutable record. Deletion also does not remove information previously written into an immutable Evidence Ledger payload or access-audit record and does not reach provider-managed backups or previously exported evidence objects. PEGTrace will evaluate any legally required deletion in coordination with the applicable institutional customer and subject to legally permitted retention. 5.5 Hashes, Ledger Entries and Verification Records. Evidence Ledger entries, cryptographic hashes, timestamps, package registrations, access-audit records, and related verification records currently have no automated expiration and are protected against ordinary update or deletion. Those records may remain associated with a user, case, report, wallet, transaction, document, or filename and are not necessarily anonymous or outside applicable privacy law. Deleting a note or attachment does not remove information previously included in an immutable ledger payload or audit record. Underlying Case Data may remain separately in accordance with Sections 5.1 through 5.4 of this Privacy Policy. 5.6 Customer and Recipient Copies. Deletion from PEGTrace’s systems does not delete copies previously exported, downloaded, or disclosed to customers, users, courts, agencies, financial institutions, custodians, insurers, or other authorized recipients. Those recipients may retain and process their copies under their own legal obligations and data practices. 6. Information Security and Incident Response 6.1 Security Measures. PEGTrace uses administrative, technical, and organizational measures designed to protect Personal Data against unauthorized access, acquisition, use, alteration, disclosure, loss, or destruction. These measures currently include role- and row-based access restrictions, private object storage, short-lived signed access links, provider-managed encryption in transit and at rest, field-level encryption for a designated sensitive-data table, and access logging. Hosting-provider backups and infrastructure controls are maintained by the applicable providers and are not independent PEGTrace backup or restoration systems. No system, transmission method, or storage environment can be guaranteed to be completely secure. Additional information concerning PEGTrace’s current data-handling and security practices as of the date of publication is provided in the Data Handling and Subprocessor Disclosure. 6.2 Security-Incident Response. PEGTrace does not currently maintain an automated incident-detection, escalation, or notification workflow. Suspected security incidents may be reported through the contact identified in Section 10.2 of this Privacy Policy and will be addressed manually. PEGTrace will provide notifications to affected individuals, institutional customers, regulators, or other parties when and as required by applicable law or an applicable written agreement. 6.3 Institutional Case Data. If a security incident affects Case Data processed on behalf of an institutional customer, PEGTrace will notify and cooperate with the customer as required by an applicable data processing agreement, other negotiated agreement, or law. 6.4 User Security Responsibilities. Authenticated users are responsible for maintaining the confidentiality of their passwords, session credentials, authorized access links, and other authentication information; complying with required authentication controls; restricting account access to authorized persons; and promptly notifying PEGTrace of suspected unauthorized access or credential compromise. 7. Use and Disclosure of Personal Data 7.1 Purposes of Processing. Depending on the applicable service and relationship, PEGTrace may use Personal Data to: (a) provide, operate, maintain, and support the website, public intake, wallet-exposure and verification functions, authenticated Platform, and related services; (b) establish and administer accounts, authenticate users, and manage permissions; (c) process institutional or professional transactions, orders, and billing if those functions are enabled; (d) process Case Data, perform requested analytical workflows, and generate reports or evidence packages; (e) maintain hashes, logs, timestamps, audit records, and verification records; (f) respond to support requests and communicate concerning services, transactions, security, or policy changes; (g) troubleshoot errors, maintain security, enforce rate limits, and prevent fraud, misuse, or unauthorized access; (h) comply with legal obligations and respond to lawful governmental or legal process; (i) establish, exercise, or defend legal claims and enforce applicable agreements; and (j) generate limited aggregate cross-case linkage signals as a customer-facing Platform function. 7.2 Restrictions on and Aggregate Use of Case Data. PEGTrace processes institutional Case Data only as reasonably necessary to provide, secure, and support the contracted services; comply with customer instructions; prevent fraud or misuse; and satisfy legal obligations. PEGTrace may also use submitted identifiers to generate limited aggregate cross-case linkage signals that report counts, category names, or combined loss information without identifying another case number, customer, tenant, or contributor. PEGTrace determines the purpose and means of that aggregate processing. PEGTrace does not use institutional Case Data for model training, benchmarking, analytics, or unrelated product development. 7.3 Technology Subprocessors and External Providers. PEGTrace may disclose or transmit Personal Data to Technology Subprocessors and external providers supporting the functions described in this Privacy Policy, including hosting, storage, authentication, security and bot prevention, transactional communications, authenticated artificial-intelligence and text-to-speech functionality, external intelligence services, and payment processing if enabled. The applicable provider categories, workflow limitations, and information involved are further described in the Data Handling and Subprocessor Disclosure. 7.4 Customer-Directed and Service-Related Disclosures. PEGTrace may disclose Case Data, generated reports, verification information, or other Personal Data at the direction of an authorized user or as reasonably necessary to provide the requested service. Customer-directed disclosures may occur through named per-case access grants, tokenized public share links, opt-in attorney introductions, or reports and packages generated and distributed by the customer. Depending on the transaction, recipients may include the applicable institutional customer, professional adviser, financial institution, government agency, law-enforcement authority, insurer, cryptocurrency custodian, or other recipient selected or authorized by the user. 7.5 Legal, Security, and Protective Disclosures. PEGTrace may disclose Personal Data when it reasonably believes disclosure is necessary to comply with applicable law or lawful legal process; investigate or prevent fraud, security incidents, misuse, or unlawful activity; protect the rights, property, or safety of PEGTrace or another person; enforce an applicable agreement; or establish, exercise, or defend legal claims. Where legally permitted and reasonably practicable, PEGTrace will provide notice to the applicable institutional administrative contact before disclosing customer-controlled Case Data in response to third-party legal process. 7.6 Business Transactions. PEGTrace may disclose or transfer Personal Data in connection with an actual or proposed merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar business transaction, subject to appropriate confidentiality and legal requirements. 7.7 Sale, Sharing, and Targeted Advertising. PEGTrace does not currently sell Personal Data or use Personal Data for targeted or cross-context behavioral advertising. PEGTrace will update this Privacy Policy and provide any legally required consent or opt-out mechanism before materially changing those practices. 8. Privacy Rights and Request Procedures 8.1 Rights That May Be Available. Depending on the applicable law and PEGTrace’s role in processing the information, an individual may have the right to request access to Personal Data; correction of inaccurate Personal Data; deletion of Personal Data; a portable copy of certain Personal Data; or information concerning the categories of Personal Data collected, used, or disclosed. Applicable law may also provide rights concerning certain sales, sharing, targeted advertising, profiling, or processing of sensitive data. 8.2 Submitting a Request. A privacy request may be submitted using the contact information in Section 10 of this Privacy Policy. The request should identify the requester, the nature of the request, the relevant interaction or account, and sufficient information to permit PEGTrace to locate the applicable records. PEGTrace will respond within the period required by applicable law. 8.3 Verification. PEGTrace may take reasonable steps to verify the requester’s identity and authority before granting access to, correcting, deleting, or providing Personal Data. Verification requirements may vary according to the sensitivity of the information, the type of request, the requester’s relationship to PEGTrace, and the risk of unauthorized disclosure or deletion. 8.4 Authorized Agents. Where permitted by applicable law, an authorized agent may submit a request on an individual’s behalf. PEGTrace may require evidence of the agent’s authority and may verify the individual’s identity or confirm that the individual authorized the request. 8.5 Institutional Case Data. If a request concerns Case Data controlled by an institutional or professional customer, PEGTrace may direct the requester to that customer or coordinate its response with the customer. PEGTrace may be unable to fulfill the request independently when it processes the information only on the customer’s instructions. 8.6 Exceptions and Limitations. Privacy rights are subject to applicable exceptions and limitations. PEGTrace may deny or limit a request when permitted by law, including when it cannot verify the requester; does not control the relevant information; must retain the information for legal compliance, security, fraud prevention, recordkeeping, or legal claims; or determines that another legally permitted exception applies. 8.7 Appeals and Complaints. Where applicable law provides a right to appeal a denied request, the individual may submit an appeal using the contact information in Section 10 of this Privacy Policy and should identify the original request and the reason for the appeal. An individual may also have the right to contact an applicable privacy or consumer-protection authority. 8.8 Nondiscrimination. PEGTrace will not unlawfully discriminate against an individual for exercising a privacy right provided by applicable law. 9. Policy Updates and Relationship to Other Documents 9.1 Updates to This Privacy Policy. PEGTrace may update this Privacy Policy to reflect changes in its services, data practices, providers, technology, or legal obligations. The updated version will be posted with a revised “Last Updated” date. PEGTrace will provide additional notice of a material change when required by applicable law or when reasonably appropriate under the circumstances. 9.2 Prospective Application. A material change to this Privacy Policy will apply prospectively from its stated effective date unless applicable law requires otherwise. If a change materially affects contractual data rights applicable to an existing institutional relationship, PEGTrace will address the change in accordance with the applicable agreement and Section 16 of the Terms of Service. 9.3 Relationship to Other Documents. This Privacy Policy provides notice of PEGTrace’s data practices. It does not replace the Terms of Service; separately applicable consumer privacy notices, consumer terms, conditions, or checkout disclosures; or any applicable order form, master services agreement, data processing agreement, or other negotiated agreement. If an applicable written agreement imposes different or additional data-processing obligations, that agreement governs the contractual relationship according to its order-of-precedence provisions. 10. Contact Information and Privacy Requests 10.1 Privacy Contact. Questions concerning this Privacy Policy and requests to access, correct, delete, or obtain Personal Data may be directed to PEGTrace’s business and correspondence address at: PEGTrace LLC 111 Town Square Pl Ste 1238 PMB #753961 Jersey City, NJ 07310-1810 or by email to support@pegtrace.com. 10.2 Security Reports and Legal Process. Reports of suspected security incidents and notices concerning subpoenas, court orders, or other legal process should be directed to: Email: support@pegtrace.com. Identification of an email or correspondence address in this Privacy Policy does not waive or modify any legal requirement governing formal service of process.

privacy_policy · 2026-08