TRACE Agree Privacy Policy

Effective date: October 16, 2026
Last updated: October 16, 2026

This Privacy Policy explains how ZECO CM LLC ("ZECO CM", "we", "us") collects, uses, shares and protects personal information when you use TRACE Agree: the e-signature service at traceagree.com, its signing pages, and the TRACE Agree apps for iPhone and Android (together, the "Service"). It applies to people with a TRACE Agree account ("account holders") and to people who receive a document to sign or a copy without an account ("signers" and "recipients").

TRACE Agree is part of the TRACE family of products by ZECO CM. The TRACE Management System at app.tracems.com has its own privacy policy.

1. Who is responsible for your information

ZECO CM LLC, 22765 Savi Ranch Parkway, Unit F, Yorba Linda, CA 92887, USA, is responsible for personal information about account holders and about how the Service itself runs (accounts, security, billing, logs). For the GDPR, UK GDPR and similar laws, ZECO CM is the controller of that information.

For the content of documents (the files a sender uploads, the people they add and what is filled in), the sender's organization decides why and how that information is used, and ZECO CM processes it on the sender's behalf as a processor (service provider). If you are a signer with questions about a document, please contact the sender first; we will help where we can.

Privacy contact. For any privacy question or request, wherever you live (including questions under the GDPR, UK GDPR, PIPEDA, Québec Law 25, LGPD or US state laws), contact us at support@tracems.com with "Privacy" in the subject, or call +1 877 387 2231. Your message will reach the person responsible for privacy at ZECO CM.

2. Information we collect

Account information. When you create an account we collect your full name, email address, organization name and type, and the password you set (stored only as a one-way hash). We record which version of our Terms you accepted and when. If you add team members, we collect their names and email addresses.

Email verification codes. To confirm an email address, sign a document, open a copy, or confirm an account-deletion request, we email you a one-time code. We store only a scrambled (hashed) form of the code. Signing codes expire after 10 minutes.

Documents and content you provide. PDFs and other files you upload or scan, document titles, the fields you place, text and dates entered into fields, drawn or typed signatures, notes (for example, the reason a signer gives when passing a request to someone else), and the names and email addresses of the signers and copy recipients you add.

Camera scans (app, optional). If you choose "Scan with camera", the app photographs paper pages, turns them into a PDF on your device and uploads the PDF. The app does not access your photo library or use the microphone.

Face ID / fingerprint (app, optional). If you turn on biometric unlock, your device checks your face or fingerprint. The app receives only a yes/no result. We never receive or store biometric data.

Signing audit trail. To make electronic signatures verifiable, we record events such as when a document was sent, opened, verified, passed on to another signer, signed, declined or completed, together with the signer's name and email address, the IP address, and the browser or device information (user agent) used. This audit trail appears on the certificate of completion attached to the finished document. Completed documents also carry a cryptographic fingerprint (SHA-256) that shows whether they were changed.

Device and technical information. Browsers and apps automatically send technical information such as IP address, browser or app type and version, operating system and request times, which we keep in server logs. The app keeps a sign-in token and your settings in secure storage on your device. The website uses only the cookies needed to sign you in and keep the Service secure; we do not use advertising or analytics cookies.

Billing information (website only). If you buy a paid plan on traceagree.com, Stripe or PayPal handles the payment. We receive your plan, billing status, the payment provider's customer and subscription identifiers and transaction records. We never receive full card numbers. The apps do not sell anything.

Support messages. If you contact us, we keep your messages and what you include in them.

We do not collect precise location, your contacts or address book, health information, or your browsing activity on other sites. The apps contain no advertising or analytics software. We do not send your documents or personal information to any third-party artificial intelligence (AI) service.

3. How we use information, and our legal bases

Purpose	Legal basis (GDPR / UK GDPR / LGPD)
Create and run your account, sign you in	Performance of a contract
Send, deliver, sign, pass on, complete and store documents, and send the related emails (invitations, codes, reminders, completion and reassignment notices)	Performance of a contract (with the account holder); for signers, our and the sender's legitimate interest in completing the transaction
Keep audit trails and certificates so that signatures can be proven later	Legitimate interests (proof of signature) and legal obligations (e-signature and record-keeping laws)
Take payment for web plans and enforce plan limits	Performance of a contract; legal obligations (tax, accounting)
Answer support requests	Performance of a contract; legitimate interests
Keep the Service secure and prevent fraud and abuse (for example, rate limits and blocking fake signing links)	Legitimate interests; legal obligations
Comply with the law and enforce our Terms	Legal obligations; legitimate interests (legal claims)

Where a law requires consent (for example under PIPEDA and Québec Law 25), we rely on the consent you give when you create an account or open a signing link and verify your email, or on implied consent where the law permits. You can withdraw consent at any time, subject to legal or contractual limits; we may then be unable to provide the Service.

We do not sell personal information, "share" it for cross-context behavioural advertising, use it for targeted advertising or profiling with legal effects, or make decisions about you based solely on automated processing. We do not use your documents to train AI models.

We share personal information only as needed to run the Service:

With the other people on a document. Senders, signers and copy recipients see the names, email addresses, field entries, signatures and audit-trail details (including IP address and browser information) shown on a document and its certificate. When a signer passes a request to someone else, the new signer and the sender are told who passed it on.
Within your organization. Administrators and team members in your organization can see documents and activity in your shared workspace.
Service providers that process data for us under contract:
DigitalOcean — hosting, database, file storage and DNS, in the United States.
Microsoft (Microsoft 365) — sending the Service's emails, including verification codes and signing invitations.
Stripe and PayPal — payments for paid web plans. They also act as independent controllers under their own privacy policies.
Legal and safety reasons. If the law, a court order or other legal process requires it, or to protect the rights, property or safety of our users, the public or ZECO CM.
Business transfers. As part of a merger, acquisition or sale of assets, subject to this Policy.

5. International transfers

The Service is hosted in the United States. If you use it from outside the US, your information is transferred to and processed in the US, where privacy laws may differ from yours and where it may be accessible to US authorities.

EU/EEA: where required we rely on the European Commission's Standard Contractual Clauses and, where our providers are certified, the EU–U.S. Data Privacy Framework.
UK: the UK International Data Transfer Addendum to the SCCs, or the UK Extension to the DPF.
Québec: we assess the protection given in the US before transferring, as Law 25 requires.
Brazil, Australia and other countries: we use contractual protections with our service providers.

You can ask us for a copy of the safeguards we use (see Section 13).

6. How long we keep information

Account information is kept while your account is open, then handled as described in Section 7.
Signed documents, certificates of completion and audit trails are kept as saved files after signing is complete, because they are legal records that the other parties rely on. They stay available to the other parties even if you delete your account.
Unsigned requests expire at the signing deadline the sender sets when sending (between 1 and 90 days; 14 days by default on the website and in the app). After the deadline the signing link stops working, the request is closed as expired, its uploaded file is removed from the sender's active workspace, and the sender has to send a new request.
Drafts you delete, and drafts left when an account is deleted, are removed from your workspace.
Email verification codes expire within minutes and stop working once used.
Billing and tax records are kept as long as the law requires.
Server logs are kept for a limited time for security and troubleshooting, then rotated.
Backups, where they contain your information, are protected in the same way and are used only to restore the Service after a failure.

7. Deleting your account

You can delete your TRACE Agree account at any time:

In the app: Account → Delete account.
On the web: sign in and go to Account settings → Delete account, or follow the steps at traceagree.com/account/delete.
If you can't sign in, email support@tracems.com from the address on the account.

To confirm it's you, we ask for your password or a code emailed to you. Your account is then scheduled for deletion 30 days later. If you sign in again during those 30 days, the deletion is cancelled.

When the 30 days end, we:

remove your name, email address, password and profile photo and replace them with anonymous placeholders, and switch off access;
cancel any documents you sent that were still waiting for signatures;
remove your unsent drafts and any uploaded documents that are not part of a signed or pending document.

We keep fully signed documents, certificates and audit trails for the other parties, and billing and tax records as the law requires. Your name and email may still appear inside documents and certificates that were already completed, because those are fixed legal records. Removed items are taken out of the Service and de-identified straight away. Some copies may remain in our systems or backups for a period afterwards; we keep them protected and do not use them except for security, legal or recovery purposes.

Deleting a TRACE Agree account does not delete a TRACE Management System account; those are managed separately.

8. Security

All traffic uses HTTPS. Documents stored for signing are encrypted at rest. Signing links and one-time codes are stored only as hashes, and completed documents carry tamper-evident fingerprints. We limit repeated requests, require email verification before a document can be opened, and restrict staff access. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affects your personal information, we will notify you and the authorities as the law requires (including within 72 hours to EU/UK authorities where applicable, and to the Commission d'accès à l'information in Québec and the Privacy Commissioner of Canada where there is a risk of serious injury).

9. Age requirement

The Service is only for people who are 18 or older. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has given us personal information, contact us and we will delete it.

10. Your privacy rights

Wherever you live, you can contact us to ask what personal information we hold about you, get a copy, correct it, or ask us to delete it. We will not discriminate against you for using your rights. We may need to verify your identity, and you may use an authorized agent where the law allows. We reply within the time the law requires (normally within 30 days, or 45 days in US states). If we can't do what you ask (for example, because a signed document must be kept as a legal record), we will explain why.

European Union / EEA (GDPR) and United Kingdom (UK GDPR). You have the right to access, correct and delete your data; to restrict or object to processing (including processing based on legitimate interests); to data portability; and to withdraw consent at any time. You may complain to your local data protection authority or, in the UK, the Information Commissioner's Office (ico.org.uk).

United States — California (CCPA/CPRA). You have the right to know the categories and specific pieces of personal information we collect, use and disclose; to delete it; to correct it; and to opt out of its sale or sharing and limit the use of sensitive personal information. We do not sell or share personal information and do not use sensitive personal information to infer characteristics, so there is nothing to opt out of; we honour Global Privacy Control signals as an opt-out request. In the last 12 months we collected these categories, for the purposes in Section 3, and disclosed them to the service providers in Section 4: identifiers (name, email, IP address, account IDs); commercial information (plan and billing records); internet or network activity (log and audit-trail data); audio/visual information (camera scans you choose to upload); account log-in credentials (sensitive personal information, used only to sign you in); and other information you put in documents.

Other US states (including Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah, Virginia and others with similar laws). You may have the right to confirm whether we process your data, access, correct and delete it, get a portable copy, and opt out of targeted advertising, sale and profiling (we do none of these). If we refuse your request, you can appeal by replying to our decision or emailing support@tracems.com with "Privacy appeal" in the subject; if we deny the appeal, you can contact your state Attorney General.

Canada (PIPEDA and provincial laws). You may access and correct your personal information, ask how it is handled, and withdraw consent, subject to legal or contractual limits. You may complain to the Office of the Privacy Commissioner of Canada or your provincial commissioner.

Québec (Law 25). In addition, you may ask to be informed about the personal information we hold, have it corrected, get it in a structured, commonly used technological format (portability), ask us to stop disseminating it or to de-index it, and be told about any automated decision made about you (we make none). You may complain to the Commission d'accès à l'information du Québec.

Brazil (LGPD). You have the rights in Article 18 of the LGPD, including confirmation of processing, access, correction, anonymization, blocking or deletion of unnecessary or excessive data, portability, information about who we share data with, information about refusing consent, and withdrawal of consent. For LGPD requests, contact us at support@tracems.com (see "Privacy contact" in Section 1). You may complain to the Autoridade Nacional de Proteção de Dados (ANPD).

Australia (Privacy Act 1988 and the Australian Privacy Principles). You may access and correct your personal information. If you are not satisfied with our response to a complaint, you may contact the Office of the Australian Information Commissioner (oaic.gov.au).

Everywhere else. If you live in a country not listed above, you can still use the rights described at the start of this section, and we will also respect any additional rights your local law gives you. You may complain to your local privacy authority.

Signers and recipients without an account. Documents you sign belong to the sender's organization. For requests about a document's contents, contact the sender; you can also contact us and we will help or pass your request on.

To make a request, email support@tracems.com with "Privacy request" in the subject.

11. Changes to this Policy

We may update this Policy. We will post the new version here with a new "last updated" date and, for important changes, tell you in advance by email or in the app.

12. Language

This Policy is written in English. If we provide a translation and there is a conflict, the English version applies unless local law requires otherwise.

13. Contact us

ZECO CM LLC
22765 Savi Ranch Parkway, Unit F, Yorba Linda, CA 92887, USA
Email: support@tracems.com · Phone: +1 877 387 2231