Privacy policy

Data we process

We process account identity, workspace configuration, sites, checkpoints, schedules, inspections, issue records, audit events, payment provider references, subscription status and evidence files that customers choose to submit. PayPal or Stripe processes payment credentials on its own secure service; TraceNivo does not receive or store complete card numbers, PayPal passwords or wallet credentials.

Public QR scans may create security and operational logs including timestamps, truncated or hashed network identifiers and request metadata. First-party product measurement records tool actions, output format and item counts with a random session hash; it excludes QR content, CSV file names, scan results, IP addresses and User-Agent values. We do not sell personal information or use inspection content for advertising.

Browser storage details are listed in our Cookie Policy.

Purpose and legal basis

We use data to provide the contracted service, secure accounts, prevent abuse, process payments, support customers and meet legal obligations. Workspace customers determine the lawful basis and notices for data they collect from frontline users.

Retention and sharing

Operational records remain until a workspace owner deletes the workspace or an agreed retention policy applies. Expired staged uploads are removed automatically. Product measurement events are deleted after 13 months. Service providers receive only the data required for hosting, storage, email delivery, monitoring and billing under contractual safeguards.

When you choose PayPal or Stripe, that provider independently processes the account, device and payment data required to authorize and operate the subscription under its own privacy notice. TraceNivo stores limited provider identifiers, event records, billing interval and entitlement status for reconciliation, support, fraud prevention and legal obligations.

Your choices

Workspace admins can export data, manage members and request workspace deletion. Individuals may request access, correction or deletion through the workspace owner or the contact channel shown in the service. Legal requests are verified before action.

International transfers

Where data moves across borders, we use appropriate contractual and technical safeguards. The applicable hosting region and subprocessors are documented during production contracting.