Privacy and data

TraceLog records the conversion path, not the whole website. This page lists what that means in data, for a platform review or your own privacy policy to cite.

What is captured

Three things, and nothing else.

The session record. One row per visit, made on the first page of the visit where the visitor has consented, carrying its acquisition context: referrer, campaign parameters, the acquisition channel and AI platform where confirmed, device class, country, landing page, and the time it started. Conversion rates are calculated over these sessions.

The conversion path. Each declared conversion with its stable identifier, its optional value and currency, and the declared steps preceding it — each with whatever context you chose to send, and each conversion with the tag requests below. A conversion may also carry its items (items) — each with an ID, a name, an optional category, a quantity and an optional unit price — the day a booking is for (scheduledFor), and whether it recurs (recurring), as a subscription does, and whether it is the person's first of that type (first). Your site decides that from its own records and sends only true or false: no identifier or detail of the person reaches TraceLog. A step may carry the items it shows. An item is what your site offers — a product, a service, a plan — never who bought it.

TraceLog also counts the payments your store, its checkout or your server reports as failed, under the payment method's name where the platform gives one, and nothing else of the order.

Requests to GA4, Meta and Google Ads. Beside each conversion the browser reports, TraceLog notes which of those tags the page sent requests to just before and after it. TraceLog keeps the tag's kind, its ID — for Google Ads with its conversion label when the request carries one — and, for Meta, the event the request names. The ID is your site's own account, never a visitor's. Nothing else of the request is kept: not its URL, its other parameters or its body. TraceLog never knows whether the platform received it. Shopify reports none: its pixel runs in a sandbox that cannot see the page's requests.

Errors are captured only inside the conversion path. An error during checkout belongs to the conversion; one on a blog page does not.

What is not captured

• Page views, clicks, scroll depth, mouse movement, keystrokes
• Session replay, or any recording of the screen
• Cross-site or cross-device identity
• A click identifier's value (gclid, fbclid and the like): it is dropped when the event arrives, and only its name is kept. Raw events received up to 13 November 2026 may still hold it, until they are deleted at ninety days
• IP addresses in storage — the address is read once on arrival to resolve a two-letter country code, and never written down
• Special-category data, which the product has no field for
• Any other part of a request the page makes to another service

A conversion carries at most sixteen tag requests and a hundred items.

Cookies and consent

The capture code sets no tracking cookie, and no cookie of any kind. After consent has been granted, a session identifier lives in the browser's own local storage on your site, and nowhere else.

Before a consent decision the capture code creates no identifier, writes nothing to storage and sends no network request. Capture starts only when your consent setup allows it: you call TraceLog.consent.grant() from your own consent platform. A denial is remembered in one key and nothing else, so the capture code does not ask a visitor who refused again.

Where it lives

In the European Union. Events and account data are stored in an EU region, and the capture code is served from storage in the EU through a CDN.

How long it is kept

A late event still changes its day's totals for thirty days. After that the day is closed, and its raw events are kept until they are ninety days old.

Daily totals have no time limit on any plan. Paying does not create that history; it lets you compare it, segment it and follow it over time.

Verification traffic

Events produced while verifying an install are marked. The Path page shows them for thirty days; they are excluded from every analytical read and count against neither your quota nor your bill. The conversion record keeps, for good, that the order was verification traffic.

Google Sign-In

Google Sign-In is optional for customer accounts and the only sign-in method for TraceLog operators. When chosen, Google receives the authentication request and returns a stable account identifier, verified email, name and profile image. TraceLog requests no Gmail, Drive, advertising or analytics permission, and no measurement data is sent to Google. Customer and operator OAuth clients and account records are separate.

Where answers are computed

Asking a question in the product sends three things to Anthropic, which runs the model that reads the question and chooses the read: the question as you typed it, the project's conversion path, and what TraceLog's read-only queries returned — aggregate numbers, recorded findings, the changes TraceLog observed on your installation and, when the question needs them, your own notes on actions and changes. Raw events, sessions, identifiers and payloads are never sent — the model cannot reach storage at all, only those validated, read-only queries.

That inference runs on Anthropic's infrastructure in the United States. Storage does not move: every event, rollup and account record stays in the EU. A project that never asks a question sends nothing outside it. Anthropic is listed on the subprocessor page with everything else that processes data on TraceLog's behalf.

Questions and answers are kept

Every question asked in the product, and the answer TraceLog wrote for it, is stored with the project it was asked on and deleted with it.

TraceLog also keeps an index of the questions: the latest wording of each, when it was first and last asked, and whether the project saved it. A question can then be run again without retyping it. Each run asks it again over the current data; the old answer is not reused, shown again or sent to the model.

A project saves at most twenty questions. Saved questions belong to the project, not to a person: anyone who can ask on that project can save one and unsave another's.

Questions and answers are never used to train a model or to suggest anything to another customer. The export includes the questions but not the answers.

Export and deletion

A project's data leaves with you and goes when you say. In the project's Settings, Export this project downloads what it holds as one JSON file: its daily counts, every alert it has raised, the questions it remembers, the changes recorded and proposed on it, the tags it watches, the days it can no longer count and the requests it refused.

Delete this project, in the same place, removes its events, its daily counts, its conversion path, its alerts, its answers and everything else it holds. It asks you to type the project's name first, and it cannot be undone.

Your role and ours

For events captured on your site you are the controller and TraceLog is the processor, under the data processing agreement. You decide what to declare and on what legal basis capture runs.

The full statements are in the privacy policy and the subprocessor list.