Privacy policy

Who processes what

For visitors to tracelog.io, TraceLog is the controller of the limited data this site processes: request logs retained by its hosting provider, your language preference, your answer to the cookie banner, the measurement of your visits with Google Analytics if you accept analytics cookies, the click identifier of a TraceLog ad if you accept advertising cookies, and, if you submit one, your demo request.

When the site measures itself, it does so with its own TraceLog project, under the same rules it offers customers: one session record per visit — referrer, campaign, device, country and landing page — and the steps of its own declared conversion path, and nothing else. TraceLog is the controller of that record too. It is first-party capture served by this site alone, and it is never shared with an advertising or analytics platform.

For events captured on a customer's website, the customer is the controller and TraceLog is the processor. The customer decides what to declare and on what legal basis capture runs; TraceLog processes it under the data processing agreement.

What is processed

TraceLog collects three categories of data from a customer's website. First, one session record per visit with its acquisition context: referrer, campaign parameters, confirmed acquisition channel or AI platform, device class, country, landing page, and start time. Second, the conversion path: each declared conversion with its stable identifier and, optionally, its value and currency, its items — each with an ID, a name, an optional category, a quantity and an optional unit price — the day a booking is for, whether it recurs and whether, by the site's own records, it is the person's first, sent as a yes or no with no identifier or detail of the person; and the preceding declared steps, with any context and items the customer chose to send. An item describes what the site offers, never the person who bought it. Third, beside each conversion the browser reports, which GA4, Meta and Google Ads tags the page sent requests to just before and after it: the tag's kind, its ID and, for Meta, the event the request names. The ID is the site's own account, never a visitor's, and nothing else of the request is kept.

Errors are captured only inside the conversion path. An error during checkout belongs to the conversion; one on a blog page does not.

For an account, TraceLog keeps the name, email address, authentication records and organization membership. If you sign up from tracelog.io, it also keeps how you arrived: the channel, such as paid search or the AI assistant that sent you; the source named in the link's campaign parameters or, without one, the domain of the site you came from; and the campaign's name and the keyword the link names. These details never include an ad's click identifier, and they are deleted with the account. If you choose Google Sign-In, Google provides the stable account identifier, verified email, name and profile image used for that sign-in. TraceLog does not request access to Gmail, Drive or another Google service. When an account is created with email and password, Cloudflare Turnstile checks that a person is signing up; TraceLog keeps nothing from that check.

If you request a demo, TraceLog is the controller of the site address, email address, relationship to the site, and chosen language that you provide. A person uses them to reply and agree a time for the demo. If you arrived from a TraceLog ad and accepted advertising cookies, the request also carries the click identifier described under Cookies.

What is not processed

• Page views, clicks, scroll depth, mouse movement, or keystrokes on a customer's site; visits to tracelog.io are measured only by Google Analytics, and only if you accept it, as described under Cookies
• Session replay or any recording of the screen
• Cross-site or cross-device identity
• Any visitor's advertising identifier, with two exceptions: the click identifier of TraceLog's own ad described under Cookies, and one that an ad platform added to the URL of a customer's page. That one never reaches the session record, the daily aggregates or anything derived from them, but the raw event keeps the URL as it arrived for the time stated under How long it is kept
• Stored IP addresses: an address is read once when the event arrives to determine a two-letter country code, then discarded
• Special-category data, which the product has no field for

Where it lives

In the European Union. Events and account metadata sit in one PostgreSQL database in an EU region, and the runtime is served from EU-region object storage behind a CDN. Residency is a product property, not a configuration option.

How long it is kept

Raw events are retained for ninety days, grouped by the date on which they occurred. They provide the evidence behind the product's findings.

Daily aggregates — events and sessions for each project and day, sessions and conversions for each hour of it, the items each day's conversions and steps carried, together with the evidence derived from them that decides each installation's state — are kept for every account, including Free. They require little storage, and deleting them would break the Free plan's promise.

Account and project data is kept while the account exists and deleted with it.

A demo request is deleted ninety days after it was created. Demo requests are never linked to a TraceLog account.

An invitation to join an organization holds the email address it was sent to, the role it offers, and who sent it. It expires after seven days and is deleted thirty days after it is accepted, withdrawn, or expires, whichever comes first. An invitation that is never accepted creates no account.

Cookies

This public site uses cookies in three categories. Technical and functional cookies are first-party and need no permission. NEXT_LOCALE lasts up to twelve months, remembers whether you chose English or Spanish, contains only that language code, and is not used for analytics, advertising, or tracking. tracelog_cookie_consent is technical: it lasts twelve months and keeps only your answer to the cookie banner for each category. Analytics and advertising cookies are set only with your permission, as described below.

The cookie banner asks every visitor on a first visit, until you answer; scrolling or browsing the site is not an answer. Accept and Reject answer for every category, and Settings lets you choose each one. Your answer is kept in tracelog_cookie_consent for twelve months; after that, or if a category's purpose changes, you are asked again. Cookie settings, in the footer of every page, reopens the banner so you can change your answer. The legal basis for analytics and advertising cookies is your consent.

The analytics cookies are Google Analytics': _ga and one beginning _ga_ followed by the property's identifier. They are set only if you accept analytics, only tracelog.io can read them, and they last up to thirteen months. They measure which pages of this site are visited and how they are used: the page, the referrer, the device, the browser, an approximate location and interactions with the site, tied to a random identifier. Google keeps that data for fourteen months. Google signals, ad personalization and the link to Google Ads are off, and Google Analytics receives nothing from the application or from a customer's site. Google may process this data in the United States; Google LLC participates in the EU-U.S. Data Privacy Framework. If you withdraw analytics, the site stops sending data and deletes these cookies.

The advertising cookie, tracelog_ads_click, is first-party. It is set only if you accept advertising and arrive from a TraceLog ad on Google Ads. It holds the click identifier Google adds to the ad's link, only tracelog.io can read it, and it lasts up to 90 days.

If you open sign-up from the site in that time, the link carries the identifier to app.tracelog.io, which keeps it in its own cookie for up to one day. If you create your account within that day, sign-up sends the identifier to TraceLog, which stores it with your account and, once you create your organization, with the organization and tells Google Ads that the click led to a sign-up: the click identifier, the time and the organization identifier, never your name or email address. TraceLog deletes the stored identifier once Google Ads has received it, or 90 days after sign-up if it was never sent.

If you request a demo while the cookie lasts, the form sends the identifier with your request and TraceLog tells Google Ads that the click led to a demo request: the click identifier, the time and the request's identifier, never your name, email address or website. TraceLog deletes the stored identifier once Google Ads has received it, and at the latest when the request is deleted, ninety days after you sent it. If you do not accept advertising, no click is stored, and withdrawing it later deletes this cookie.

To learn which channel each sign-up comes from, the site keeps a record of how you arrived, under the key tracelog_arrival in your browser's session storage: the page you landed on, its campaign parameters, the names but never the values of its other parameters, and the site you came from. It is not a cookie and does not depend on your answer to the cookie banner; it is read by this site alone and ends when the tab closes. If you open sign-up from the site, the link carries it to app.tracelog.io, which keeps it in its own cookie, tracelog_arrival, for up to one day and reads it only when your account is created.

When the site measures itself with its own TraceLog project, the capture runtime also keeps a session identifier in your browser's local storage. It is not a cookie, it is read by this site alone, it identifies the visit rather than you, and it expires with the session.

The capture code installed on a customer's site sets no tracking cookie, and no cookie of any kind. After consent is granted, a session identifier is stored in that site's browser storage. Before consent, the code creates no identifier, writes nothing to storage, and sends no network request.

Your rights

You may exercise the GDPR rights of access, correction, deletion, restriction, objection, and portability. A customer can export or delete a project's data from the application. A visitor to a customer's site should contact that customer as the controller; TraceLog will help the customer respond.

You can ask us to delete a demo request before ninety days by emailing info@tracelog.io. Otherwise it will be deleted according to the schedule above.

Email info@tracelog.io and a person from TraceLog will reply.