This describes what TracAssure—our traceability application, and this website—actually collects and how it's used.
Effective date: August 2026 · Last updated: August 2026
TracAssure is operated by 3Roots LLC ("we," "us"). Contact us at contact@3roots.net for any privacy question or request.
TracAssure is a business application used by food supply chain organizations to capture Critical Tracking Events (CTEs) and Key Data Elements (KDEs) required by the FDA Food Traceability Rule (FSMA 204). It's provided to organizations under a commercial agreement and used by their authorized personnel. It is not offered to consumers and is not directed to children.
Where we process business records on behalf of a customer organization, we act as a processor, and that organization is the controller of its own data.
This policy also covers tracassure.com itself—see "This website" below for what happens if you just fill out a form on our site.
Authentication is handled by Microsoft Entra. When you sign in, we receive your name, email address, a unique user identifier, and the organization your account belongs to. We never see or store your password.
The operational data you or your organization records in the app, including:
These records describe business activity. They may incidentally include the names of individuals acting in a business capacity.
To operate and support the service, we process request correlation identifiers, session tokens, timestamps, and server-side connection information such as IP address.
If you fill out the "Request a demo" form on tracassure.com, we collect your name, email, company, job title, phone number, industry, company size, and any message you enter. That submission is handled by Formspree and protected by Google reCAPTCHA; we use it solely to follow up about your interest in TracAssure.
The application contains no advertising, analytics, or third-party tracking software. Specifically, we do not collect:
The Android application requests only the INTERNET permission, required to communicate with our servers.
We do not sell personal information, and we do not use your business records to train machine learning models.
We share information only with:
We do not share your information with advertisers or data brokers.
Traceability records are retained for as long as your organization's account is active, and thereafter for the period required by applicable recordkeeping rules. FSMA 204 requires covered entities to retain traceability records for two years; we retain records accordingly unless your organization instructs otherwise.
Account and identity information is retained for the life of the account and deleted within 30 days of account closure, subject to the retention obligations above.
Data is encrypted in transit using TLS. Access to production data is restricted to authorized personnel. Authentication is delegated to Microsoft Entra, and access to records is scoped to the user's organization. We're continuing to formalize and document the fuller details of our security program—see our Security page for where things currently stand.
Depending on where you're located, you may have rights to access, correct, delete, or export personal information about you, or to object to or restrict its processing. Because most data in TracAssure belongs to a customer organization, please direct requests to your organization's administrator, or contact us at contact@3roots.net and we'll work with them.
TracAssure is a workplace application and is not directed to children under 13, and we do not knowingly collect information from them.
We'll post any changes on this page and update the "Last updated" date. Material changes will be communicated to customer organizations.
Questions? Contact contact@3roots.net.