Privacy Notice — Traceo
Who we are
This notice explains how Devarno Ltd collects and uses personal data when you use Traceo. Devarno Ltd is the controller of that data. Our registered office is at Flat 29 New Caledonian Wharf, 6 Odessa Street, London, England, SE16 7TN.
For any privacy question or request, email support@devarno.cloud.
What we collect and why
| Data | What it is and why we use it | Lawful basis |
|---|---|---|
| Account identity | Your email address and name, to create and secure your account and send sign-in and account email; if you sign in with GitHub or Google, the name, email and avatar they share | Performing our contract with you |
| Requirement content | The requirements, tools and documents you create in Traceo, stored to provide the service | Performing our contract with you |
| Usage analytics | Cookieless, aggregate page-view statistics through Plausible; no cookies and no personal data stored | Our legitimate interests |
| Payment data | Handled by Polar as merchant of record; Traceo never sees or stores card details, only your subscription status | Performing our contract with you |
We do not sell your personal data, and we do not use it for advertising.
Cookies
Traceo uses only the cookies it needs to sign you in and keep your session secure. These are strictly necessary, so they do not need your consent. Our analytics are cookieless and do not track you across sites.
Who we share it with
We use a small number of service providers to run Traceo. They process personal data only on our instructions and under contracts that require them to protect it. The current list, with what each provider does and where it operates, is on our Subprocessors page, at /subprocessors on this site.
We may also disclose personal data where the law requires it, or to protect our rights, our users or the public.
International transfers
Some of our providers process data outside the United Kingdom: Polar (United States), Vercel (United States, with a global edge network), Railway (European Union (Netherlands)), Resend (United States), Plausible Analytics (European Union (Germany)), GitHub (United States), Google (United States). Where they do, we rely on safeguards recognised under UK data protection law, such as UK adequacy regulations or the International Data Transfer Addendum to the European Commission's standard contractual clauses.
How long we keep it
- Content you delete is removed from our systems within 30 days.
- When you delete your account, we delete your account data within 30 days.
- Polar, as merchant of record, keeps the payment and tax records it is legally required to keep.
Your rights
Under UK data protection law you can ask us to:
- give you a copy of the personal data we hold about you;
- correct data that is wrong or incomplete;
- delete your data;
- restrict or object to how we use it;
- give you your data in a portable format; and
- where we rely on your consent, withdraw it at any time.
Email support@devarno.cloud to make a request. We will reply within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at https://ico.org.uk, but we would appreciate the chance to put things right first.
Children
Traceo is not for anyone under 18. We do not knowingly collect data from them; if we learn we have, we delete it.
Security
We protect personal data with encryption in transit, access controls and the security measures of our hosting providers. No system is perfectly secure; if a breach puts your rights at risk, we will tell you and the regulator as the law requires.
Changes to this notice
We will update this notice when how we use personal data changes, and tell you about material changes by email or in Traceo. The date at the top of this page shows the latest version.