Privacy Notice

Tracemarkai, trading as TraceMark AI, is the data controller for personal data processed through this service. That means we decide what data is collected and why. Contact us about anything in this notice at tracemarkai@gmail.com.

• Account data — name, email address, password credentials, workspace and role. Used to create and secure your account and to provide the service. Legal basis: performance of our contract with you.
• Content you submit — text, documents and images uploaded for analysis, plus derived results, flagged passages, case statuses and reviewer notes. Used solely to produce and store your analysis. Legal basis: performance of our contract.
• Support messages — what you send us by email or in-app. Used to answer you. Legal basis: legitimate interests in supporting customers.
• Usage and telemetry — scans run, features used, API key activity, audit log entries. Used for plan allowances, billing accuracy, product improvement and abuse prevention. Legal basis: contract and legitimate interests.
• Device and technical data — IP address, browser and device identifiers, timestamps. Used for security, fraud prevention and service reliability. Legal basis: legitimate interests and legal obligation.
• Marketing preferences — where you opt in to product emails. Legal basis: consent, withdrawable at any time.

• Service providers and subprocessors — hosting, database, email delivery and AI model providers that process data on our instructions to run the platform.
• Paddle.com — our Merchant of Record, for the sale of our products, subscription management, payments, tax compliance and invoicing.
• Professional advisers — legal and accounting, where necessary.
• Authorities — where we are required to disclose by law.

Members of your workspace can see scans, results and cases in that workspace, according to their role. We do not sell personal data, and we do not use your submitted content to train models for other customers.

Our providers may process data outside your country, including outside the UK and EEA. Where that happens we rely on appropriate safeguards such as UK/EU Standard Contractual Clauses or an adequacy decision.

Submitted content, results and reports are kept for the retention window configured in your workspace settings, then deleted automatically by a daily cleanup job. Audit logs follow their own configured window. Account records are kept while your account is active and for a short period afterwards; billing records are kept as long as tax law requires. When data is no longer needed it is deleted or anonymised.

Depending on where you live, you have the right to access your data, correct it, have it erased, restrict or object to processing, receive it in a portable format, and withdraw consent at any time. Email tracemarkai@gmail.com and we will respond within one month. If you are in the UK or EEA you also have the right to complain to your data protection supervisory authority.

We apply appropriate technical and organisational measures: encryption in transit and at rest, row-level access controls so workspaces are isolated from each other, hashed passwords and hashed API keys, role-based permissions and audit logging. No system is perfectly secure, but we work to keep risk low and will notify you of a breach affecting your data where required by law.

We use cookies and similar storage that are strictly necessary to run the service — keeping you signed in, remembering your active workspace and protecting against fraud. We do not use advertising cookies. Any analytics we add will be listed here first, and you can control cookies through your browser settings.

We will update this notice as the service changes and will tell you about material changes by email or in-app before they take effect.