Your data, handled with care.

Who this applies to

This policy covers tracexpro.com, the TraceX app at app.tracexpro.com, the TraceX CLI and our integrations (together, the “Service”). If your organization uses TraceX, your organization controls the systems it connects, and we process that information on its behalf.

What we collect

We collect only what we need to run the Service:

• Account information: your name, work email, organization, role and sign-in details (including single sign-on and two-factor settings).
• Connection details: the credentials your admins provide to connect databases, repositories and other tools. They are encrypted at rest and used only to read from those systems.
• What TraceX looked up: for each investigation or answer, a record of which sources were checked and what was found (for example “34 rows in refunds”), the root cause, and the answer itself.
• Usage information: how many investigations and messages your workspace runs and how much AI usage they take, so we can apply plan limits and bill correctly.
• Messages to us: what you send when you contact us or request early access.

What we don't keep

• We don't copy or index your databases or code. TraceX reads them live, when it investigates or answers.
• Evidence excerpts gathered during an investigation are removed when the investigation finishes.
• Files you export (spreadsheets, CSV, PDF) are deleted after 24 hours.
• We never use your data, or your connected systems' data, to train AI models.

How we use information

• To provide the Service: run investigations, answer questions, draft replies and fixes, and show you the evidence.
• To keep it secure: authenticate users, prevent abuse, and keep an audit log of actions in your workspace.
• To support you and tell you about changes to the Service.
• To understand and improve the Service, using usage counts rather than the content of your systems.

Who we share it with

We don't sell personal information. We share it only with service providers who help us run TraceX, under contracts that limit their use of it:

• AI model providers (such as Anthropic, AWS Bedrock and Google Gemini) process the context of an investigation or question to produce an answer. If you bring your own model key, this happens under your own agreement with that provider.
• Cloud infrastructure providers host and operate the Service.
• Email and communication providers deliver notifications you ask for.

We may also disclose information if the law requires it, or to protect the rights and safety of our users and TraceX.

How long we keep it

We keep account and workspace information for as long as your workspace is active. When your organization closes its workspace or asks us to delete it, we delete its information, except where we must keep some records to meet legal obligations.

Your choices and rights

Depending on where you live, you may have the right to access, correct, export or delete your personal information, or to object to how we use it. To make a request, email hello@tracexpro.com. If your account belongs to an organization, we may pass the request to its admins.

Security

Connections to TraceX are encrypted in transit, and stored credentials are encrypted at rest. Database connections are read-only, and every query is checked before it runs. Workspaces support single sign-on, two-factor sign-in, role-based permissions, revocable sessions and an audit log. See Security for more.

Changes to this policy

If we make material changes, we'll update the date above and let workspace admins know before they take effect.

Contact

Questions about privacy? Email hello@tracexpro.com.