1Lawful basis
Trace processes journey data on the basis of the consent your visitors give through your banner. Account data is processed on the basis of contract.
2Data processing agreement
The data processing terms are part of the Terms of Service, in the sections headed “Data processing”. They apply to every customer from the day it accepts the Terms. Enterprise customers may request a signed copy.
3Erasure requests
You can pass a visitor’s erasure request to Trace through the DSAR API or by email. We complete erasure within 72 hours and confirm in writing.
4Sub-processors
Trace uses these processors. Supabase: sign in, the database and file storage, in London. DigitalOcean: hosting, in London. Anthropic: Ask Trace answers; it receives the questions customers ask and site analytics context with journey ids aliased, and may process them in the United States, Europe, Asia or Australia. SendGrid, which is Twilio: transactional email, in the United States. Stripe: billing and payments, and Trace Earn bank payouts and Trace credit through Stripe Connect, in the United States. Wise: Trace Earn payouts; it receives a partner’s bank details, which go straight to Wise without Trace keeping them, and the amount. PostHog, which is PostHog Inc.: error tracking and session recording in the Trace app, on its EU Cloud in Frankfurt. Slack, which is Slack Technologies: help conversations people start from the Help panel, in the United States. Google Analytics, which is Google Ireland Limited with Google LLC in the United States: measuring visits to usetrace.io, only for a visitor who allows analytics cookies. For visits to usetrace.io, if you allow marketing cookies, Google (Google Ireland Limited) and Meta (Meta Platforms Ireland Limited) receive ad measurement data as separate controllers under their own terms, not as our processors. We give 30 days’ notice of changes, and the Terms of Service explain how a customer can object. The ad platforms a customer chooses to send conversions to are not our sub-processors: they receive the data on the customer’s instruction, under their own terms.
5International transfers
Journey data is stored in London, on Supabase and DigitalOcean. Five providers process data outside the UK and EU. Stripe (billing, United States) relies on the EU standard contractual clauses, the UK International Data Transfer Addendum and its EU-US Data Privacy Framework certification. SendGrid (email, United States) relies, in order, on the EU-US Data Privacy Framework and its UK Extension, Twilio’s Binding Corporate Rules, the EU standard contractual clauses and the UK International Data Transfer Agreement. Anthropic (Ask Trace, wherever it runs) relies on the EU standard contractual clauses and the UK Addendum. Slack (help conversations, United States) relies on the EU-US Data Privacy Framework and its UK Extension, with the standard contractual clauses as a fallback. Google Analytics (visits to usetrace.io, United States) relies on the EU-US Data Privacy Framework and its UK Extension. Google's and Meta's own transfers to the United States for usetrace.io's ad measurement rely on the EU-US Data Privacy Framework and its UK Extension. Where Supabase or DigitalOcean staff or sub-processors process data outside the UK or EU, Supabase relies on the EU standard contractual clauses and the UK Addendum, and DigitalOcean on the EU-US Data Privacy Framework and its UK Extension, with the standard contractual clauses as a fallback. If a customer switches on sending to an ad platform, the conversions go to that platform, and any transfer outside the UK or EU is the customer’s, under the platform’s own terms.
6Contact
Our data protection officer: privacy@usetrace.io. Trace is registered with the ICO.
Write to privacy@usetrace.io. We reply within one working day.