Privacy policy

Tracix (“we”, “us”) provides an observability platform for applications, infrastructure, networks and security. This policy explains how we collect, use, share and protect personal data when you visit tracix.io, contact us, create or use an account in the Tracix console at cloud.tracix.io, or use a Tracix workspace.

For account, billing, website and sales information, Tracix decides how and why the data is used and is the controller of that data. For the telemetry and other data our customers send to their workspaces (“Customer Data”), Tracix processes the data on the customer’s behalf, under our agreement with that customer and our data processing agreement. If your personal data is in a customer’s Customer Data, that customer’s own privacy notice applies, and requests about it should go to them.

We collect the following information:

• Account information. Your name, email address, password (stored only as a one-way hash), the organizations and workspaces you create or join, your role, invitations, and your two-factor authentication settings.
• Information from Google or GitHub. If you sign in with Google or GitHub, the profile information described in the next two sections.
• Security and usage information. When you use the console, we record sign-ins and sessions, the IP address and browser they came from, and an audit record of administrative actions in your organization.
• Billing information. If you buy a paid plan, billing contact details and subscription records. Payments are handled by Stripe; we do not receive or store full card numbers.
• Information you send us. When you fill in our contact form, we collect your first and last name, work email, company, company size, the topics you are interested in, and your message. We also keep the emails and support requests you send us.
• Website usage. Aggregate visit statistics and page performance measurements, as described under “Cookies and similar technologies” below.
• Customer Data. The logs, metrics, traces, profiles, real-user monitoring data, network and security data, and configuration that customers send to their workspaces. Customers decide what this contains. It can include personal data, such as user identifiers or IP addresses in logs.

If you choose “Sign in with Google”, Google shares the following with us, with your permission: your name, your email address, whether Google has verified that email address, your Google account identifier, and your profile picture. We ask only for this basic profile information (the “openid”, “email” and “profile” scopes). We do not request access to your Gmail, Google Drive, Calendar, contacts or any other Google data.

• How we use it. Only to create your Tracix account, sign you in, show your name and picture in the console, and send you account and security emails at that address.
• How we share it. We do not sell Google user data, use it for advertising, or share it with anyone except the service providers that host and operate the console (Amazon Web Services), as needed to provide the service, or when the law requires it.
• How we store and protect it. It is stored in the console database in Amazon Web Services’ us-east-1 region (United States), encrypted at rest, sent only over encrypted connections, and accessible only to the people at Tracix who operate the service.
• How long we keep it. For as long as your account exists. When you ask us to delete your account, we delete it within 30 days. You can also remove Tracix’s access at any time in your Google Account under Security, “Your connections to third-party apps and services”.
• AI models. We do not use Google user data to develop, improve or train artificial intelligence or machine learning models.

Tracix’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

If you choose “Sign in with GitHub”, GitHub shares your public profile (name, username, profile picture and account identifier) and your email addresses with us (the “read:user” and “user:email” scopes). We use them only to create your account and sign you in, and we handle them as described for Google above. Sign-in does not give us access to your repositories. If you separately connect a code host to a workspace, the access you grant there is part of that workspace’s Customer Data.

We use personal data to:

• Provide, operate and maintain the console and your workspaces, including authentication and account management.
• Process Customer Data on our customers' instructions, as set out in our agreements with them.
• Keep the service secure: detect and prevent abuse, fraud and unauthorized access, and investigate incidents.
• Answer your questions, provide support, and send service, security and billing messages.
• Bill for paid plans and keep the records the law requires.
• Understand how our website is used and improve it, using aggregate statistics.
• Send product news and marketing to business contacts who asked for it or where the law allows. You can opt out at any time.
• Comply with legal obligations and enforce our terms.

The assistant in the Tracix console runs on Amazon Bedrock. What you ask it, and the console details it reads to answer, are processed by Amazon Bedrock in the United States to produce the answer. AI features inside a workspace use the model provider and credential the customer configures. Anomaly detection in a workspace learns from that workspace’s own data, and what it learns stays in that workspace. We do not use Customer Data to train models for other customers or for general-purpose artificial intelligence.

Where the EU or UK General Data Protection Regulation applies, we rely on these legal bases for the data we control:

• Contract: to provide the service you or your organization signed up for.
• Legitimate interests: to secure and improve the service, answer inquiries, and market to business contacts, balanced against your rights.
• Consent: where we ask for it, which you can withdraw at any time.
• Legal obligation: for tax, accounting and other records the law requires.

We do not sell personal data, and we do not share it for cross-context behavioral advertising. We share it only:

• With service providers that process it for us under contract: Amazon Web Services (hosting, storage, email and the console assistant) and Stripe (payments). The current list, with what each does and where, is on our subprocessors page.
• With the provider of our customer relationship management system, for contact form submissions and sales conversations, and with Plausible Analytics for aggregate website statistics.
• Within your organization: administrators of an organization you belong to can see your name, email address and role, and the administrative actions you take in it.
• When the law requires it, or to protect the rights, property or safety of Tracix, our customers or others.
• With a buyer or successor if Tracix is involved in a merger, acquisition or sale of assets, subject to this policy.
• With your consent or at your direction.

We store and process data in the United States. If you are outside the United States, your data will be transferred there. Where the law requires it, we protect those transfers with safeguards such as the European Commission’s Standard Contractual Clauses.

• Account information: for as long as your account exists. When you ask us to delete your account, we delete it within 30 days, except what the law requires us to keep.
• Customer Data: for the retention period of the workspace's plan, and permanently deleted when the customer deletes the workspace.
• Security and audit records: for as long as the organization's account exists, and after that for as long as we need them to investigate security incidents, resolve disputes or meet legal obligations.
• Billing records: for as long as tax and accounting law requires.
• Contact form submissions and sales correspondence: for as long as the conversation is active and for up to 24 months after our last contact, unless you ask us to delete them sooner.

Each workspace runs in its own isolated environment with its own database. Data is sent over encrypted connections, the console database is encrypted at rest, access to production systems is limited to the people who operate them, and accounts can use two-factor authentication. No system is perfectly secure; if a breach affects your personal data, we will tell you and the authorities as the law requires. To report a security issue, see our disclosure policy.

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict how we use it, and to withdraw consent. California and other US state residents may also have the right to know what we collect and to opt out of sale or sharing, which we do not do. We will not treat you differently for exercising these rights.

You can update your name and sign-in settings in the console. For anything else, including deleting your account, email privacy@tracix.io. We may need to verify your identity, and we will answer within the time the law requires. If your data is part of a customer’s Customer Data, we will pass your request to that customer. If you are in the EU or UK, you can also complain to your data protection authority.

• tracix.io sets no cookies. Our website statistics come from Plausible Analytics, which counts visits without cookies and without storing personal data.
• We measure the website's own performance and errors with Tracix real-user monitoring. Its session identifier lives only in the page's memory and ends when you reload or leave the page; nothing is stored on your device.
• The integrations page remembers whether you hid its filters, in your browser's local storage. That preference never leaves your device.
• The Tracix console uses a strictly necessary session cookie to keep you signed in. It expires after seven days.

More detail is in our cookie policy.

Tracix is a service for businesses. It is not directed to children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.

We will update the date at the top of this page when we change this policy. If a change is significant, we will tell account owners by email or in the console before it takes effect.

Questions about this policy or your personal data: email Tracix at privacy@tracix.io.