Privacy Policy

1. Who we are and what this policy covers

Traista, Inc. ("Traista", "we", "us") runs a lost-and-found platform. Hotels, airports, venues and other organizations use it to log items they find, and people who lost something use it to file a claim, talk to the organization, and get their item back by pickup or shipping.

This policy explains what personal information we handle, why, who we share it with, and the choices you have. It is written for people and organizations in the United States. It covers:

• traista.com, our public website;
• the Traista portal, where you file and track a claim, message an organization, and pay for shipping; and
• organization accounts — the staff of organizations that use Traista.

We do not sell personal information, and we do not use it for advertising profiles.

2. Our role: when we decide, and when an organization does

Two different parties can be responsible for the same claim:

• When you file a claim yourself, Traista decides how that information is used to run the service, as described in this policy.
• When we create a claim on your behalf for shipping, we use the information supplied to obtain shipping rates, arrange a label and manage the return, as described in this policy. If an organization supplies the information on your behalf, we process that information as its service provider under the Data Processing Addendum.
• When an organization puts information into Traista — the items it found, photos, notes and its staff's messages — we handle that information as the organization's service provider, on its behalf and on its instructions, under our Data Processing Addendum. The organization is responsible for having the right to share it with us, and its own privacy notice also applies.

Organizations that hold your item also make their own decisions about it (for example, whether to release it, and what they keep about you). For those decisions, the organization's own privacy notice applies.

3. Information we collect

3.1 When you file a claim, request shipping rates, track a claim, or pay for shipping

We receive this information from you or from someone authorised to arrange the return, including the organization holding your item. If shipping rates are requested from Traista or a shipping label is purchased through Traista for your item, we may create a lost-item recovery claim on your behalf using the contact, item and shipping details supplied. The record supports the quote, label, shipment tracking and related communications; it is not an insurance claim.

• Contact details: first and last name, email address, phone number. Traista doesn't text or call you: your phone number goes to the carrier for delivery, and the organization holding your item can see it to contact you about your claim.
• Your lost item: description, where and when you lost it, which organization and location, and any photo you upload.
• Shipping: delivery address, chosen carrier and service, package details, declared value and optional insurance.
• Payment: handled by Stripe. We receive the amount, the payment status and a payment reference — never your full card number.
• Messages you exchange with the organization through your claim.
• Pickup records: if you collect an item in person, the organization's note and, where the organization requires it, your signature signed on their device, kept as proof that the item was released to you.
• Anything else you choose to tell us, for example when you contact support.

3.2 Information organizations add about found items

Organizations log the items they find, with descriptions, locations, dates and photos. A found item can itself contain personal information — a name on a luggage tag, or an ID card inside a wallet — and may appear in a photo. Organizations also record notes, status changes, who handled an item, and how it was returned or disposed of (a "chain of custody"). We store this for the organization (section 2).

3.3 Organization users

If you use Traista as a member of an organization:

• Account details: name, email, phone number, username, a hashed password (we never store your password itself), your role, and which locations you can access.
• Activity records: what you did in the portal — items logged, claims matched, closed or released, notes and messages written — with the time and your user ID. Organizations rely on these records for accountability and their chain-of-custody reports.
• Support requests you send from the portal: your name, email, organization and message, which go to our help desk.
• Usage analytics: when you are signed in, our analytics records your internal user ID and organization ID so we can understand how the portal is used (section 7). It does not record your name or email.

3.4 When you contact us or request a demo

Our contact and demo forms collect your name and email, and, depending on the form, your company, phone number, claim ID, how you heard about us, and your message. We use them to answer you and, for demo requests, to follow up about Traista.

3.5 Collected automatically

• Device and usage data: browser and device type, operating system, IP address and approximate location, pages viewed, actions taken, referring page, and date and time.
• Security checks: our forms use Google reCAPTCHA to tell people from bots. reCAPTCHA collects device and interaction data, which Google processes under its own Privacy Policy and Terms.
• Cookies and similar technologies: see section 7.

4. How we use your information

• Run the claim and return process: file, match and update claims; let you and the organization message each other; send claim emails; arrange pickup or shipping.
• Ship and take payment: validate your address, get carrier rates, buy labels, track parcels, process payments and refunds.
• Verify ownership and prevent fraud: check that a claim is genuine, investigate disputes and duplicate claims, keep audit records.
• Keep the service secure: detect bots and abuse, protect accounts, investigate incidents.
• Support: answer questions, fix problems with a claim or shipment.
• Improve Traista: measure how features are used, fix bugs, plan new features — using aggregated or de-identified data where we can.
• Ask for feedback: invite guests and organization users to give feedback or review their experience with Traista, through automated invitations or emails sent manually by our team (section 6).
• Meet legal obligations: tax and accounting records, responses to lawful requests.

We use claim information for the purposes described above, including optional feedback and review invitations. You can ask us to stop review invitations and unsubscribe from any marketing emails; necessary service emails about your claim or account will continue.

5. AI-assisted features

To make logging and matching faster, Traista uses AI services:

• What is processed: the text of claim and item descriptions, and photos of found items that organizations upload.
• What it does: suggests item details (type, colour, brand, and so on), writes a draft description from a photo, estimates the package size needed to ship an item, and ranks which found items might match a claim.
• Who processes it: our AI service provider receives this content to return results to us. It does not use it to train its models, and may keep it for up to 30 days to check for abuse before deleting it.
• Humans decide: AI suggestions help staff; they don't decide anything on their own. Staff confirm every match and every package size, and decide whether to release an item.

6. Who we share your information with

Organizations. The organization you filed a claim with sees your claim, contact details, messages, pickup records and shipping status. Every staff member of that organization with access to the relevant location can see them, and organizations can export claim and item records for their own records and reports.

Organizations not yet on Traista. You can file a claim with an organization that doesn't use Traista. To help, we may contact that organization and share the details of your claim with it.

Service providers who work for us under contracts that limit their use of your data:

Review invitations. We may ask guests and organization users to give feedback or review their experience with Traista. Invitations may be automated, sent through a third-party review service, or emailed manually by our team. We use contact details and information about your experience to send these requests. For guest invitations after delivery, if the organization does not use its own review page, our delivery email may be copied to a review invitation service. That service receives the email's contents, including your name, email address, claim reference, the organization's name and the link to track your claim. That link can provide access to the claim, including its messages and shipping address. For organization invitations, we may use an organization user's name, work email address and organization name.

Leaving feedback or a review is optional and does not affect your claim or use of Traista. You can ask us to stop review invitations at support@traista.com or use any opt-out included in the invitation; necessary claim and account emails will continue. If you choose to use a third-party review site, its own terms and privacy policy apply to the information you submit there.

Legal and safety. We may disclose information when the law requires it, to respond to valid legal process, or to protect people, property, carriers or Traista — including investigations of fraud, theft, chargebacks or ownership disputes.

Business transfers. If Traista is involved in a merger, acquisition or sale of assets, information may transfer as part of it. We will tell you if that changes how your information is handled.

We do not sell or rent personal information, and we do not share it for cross-context behavioural advertising.

7. Cookies, analytics and your choices

We use cookies and similar technologies to:

• Keep you signed in (organization users) and keep the portal secure — these are necessary and always on.
• Understand usage, with Google Analytics, and measure our own advertising, with Google Ads conversion tags (for example, when someone requests a demo).

In the portal, our cookie banner asks whether to allow analytics and advertising cookies on your first visit and remembers your choice in your browser; to change it later, clear Traista's site data in your browser and choose again. On traista.com, and anywhere else, you can block cookies in your browser settings, install Google's Analytics opt-out add-on, and use Google's ad settings.

8. How long we keep information

• Open claims are kept while they are open.
• Claims close automatically when nothing happens for a while: after the period the organization chooses (30, 60, 90 or 365 days, or never), and after 28 days for organizations that aren't on Traista or for a paid label that wasn't shipped.
• Closed claims are kept for the organization's records and so we can handle support requests, disputes and chargebacks. You can ask us to delete your information (section 10).
• Transaction records — amount, date, carrier, tracking number and payment reference — are kept for tax, accounting and chargebacks. Stripe keeps its own payment records under its own policy.
• Found-item records, photos and chain-of-custody history are kept as part of the organization's records.
• Organization user accounts are kept while the account is active. When a user is removed, their activity records stay attached to the actions they took, because organizations need them for accountability.
• Contact and demo requests, and support requests from organization users, are kept so we can answer you and have a record of the conversation.
• Analytics data at the level of individual visits is kept by Google for the retention period we set in Google Analytics, at most 14 months. Aggregated reports, which don't identify you, may be kept longer.

9. Security

• Traista uses cloud hosting and database service providers for hosting and storage in the United States. A provider's audit or certification does not certify Traista itself.
• Data is encrypted in transit (TLS) and encrypted at rest in our database and file storage.
• Card payments are processed by Stripe, which is PCI DSS Level 1 certified. Traista never sees or stores your full card number.
• Photos, labels and signatures are stored in private storage and only served to people allowed to see them.
• Passwords are stored as one-way hashes.
• Organization staff see claims and items only for the locations they are assigned to; an organization's administrators see all of its locations.

Keep your claim ID private. Anyone who has both your claim ID and your last name can view your claim, including its messages and your shipping address.

No system is perfectly secure. If we learn of a breach affecting your personal information, we will notify you as the law requires.

Report a security issue to security@traista.com.

10. Your rights and choices

Claimants don't have a Traista account: you reach your claim with its claim ID and your last name. You can update your contact details and address from the claim page. For anything else, email support@traista.com. Depending on where you live — for example California, or another US state with a privacy law — you can ask us to:

• tell you what personal information we hold about you and give you a copy;
• correct it;
• delete it;
• stop or limit certain uses; or
• withdraw consent you gave (for example, for analytics cookies).

We will confirm your identity (usually by asking for the claim ID and the email on the claim) and respond within 45 days, or tell you if we need the extra time the law allows. We won't treat you differently for exercising these rights.

Appeals. If we decline your request, you can appeal by emailing support@traista.com with "Appeal" in the subject. We will explain our decision within the deadline required by applicable law, and no later than 60 days unless the law permits an extension. If you are still not satisfied, you can contact your state attorney general.

Claims themselves aren't deleted: the organization keeps a record of the item and what happened to it. If you ask us to delete your information, we will tell you what we can remove and what we have to keep, and why — for example, transaction records we need for tax and chargebacks, and the organization's found-item and custody records.

For information an organization put into Traista, we may pass your request to that organization, since it decides what happens to it.

11. Children

You must be at least 16 to file a claim yourself; if you are under the age of majority where you live (18 in most places), a parent or guardian must agree for you. A parent or guardian can file a claim for a younger child's lost item. We don't knowingly collect personal information directly from children under 16. If you think a child has given us their information, contact us and we will delete it.

12. Where your information is stored

Traista is based in the United States. Our database, files and emails are hosted by service providers in the United States, and our other service providers may process data in the United States and other countries where they operate.

13. Additional information for California residents

In the last 12 months we collected: identifiers (name, email, phone, address, IP address); commercial information (shipping purchases); internet activity (usage and device data); approximate geolocation; audio/visual information (item photos, pickup signatures); and inferences limited to item matching. We collect these from you, from organizations, from our service providers, and automatically, for the purposes in section 4, and disclose them only to the recipients in section 6. We do not sell or share personal information as defined by the CCPA, and we do not use sensitive personal information for anything beyond providing the service. You can use the rights in section 10, or have an authorised agent do so for you.

14. Changes to this policy

When we change this policy, we update the date at the top. If a change materially affects how we use your information, we will tell you before it takes effect — by a notice on the site, or by email if we have it.

15. Contact us

Questions or requests: support@traista.com

Traista, Inc. — Attn: Privacy Officer
3075 W Ray Rd Suite 200, Chandler, AZ 85226, USA