This document is a carefully prepared draft and will be reviewed by legal counsel before the platform launches. If the final version differs, the change is listed in the changelog and customers are informed by email.
01Who we are and what this policy covers
Traze ('we') is responsible for the processing of personal data through the website traze.io, the free tools, the forms and the newsletter. For those processing activities we are the controller within the meaning of the General Data Protection Regulation (GDPR).
This policy does not cover data that customers process in the Traze platform about their own visitors, such as Search Console data or CMS content. For that data the customer is the controller and we are the processor; see 'Traze as processor'.
You can reach us at hello@traze.io.
02Which data we collect
We only collect what is needed for the purpose you contact us for.
- Forms (contact, demo, start, open application, Traze for Good): name, work email address, company or organisation name, website, phone number (optional), your message and the choice you make in the form, such as topic, plan or role.
- Newsletter: your email address and the language you subscribed in.
- Free tools: the URL, domain, keyword or brand name you enter, and the result that follows from it. If you request the full report by email, we link that result to your email address.
- Technical data: IP address, browser type, timestamp and the requested page, in server logs and for limiting abuse of the tools.
- Communication: emails you send us and our replies.
We do not collect special categories of personal data and do not target people under 16.
03What we use data for and on which legal basis
- Answering your question, scheduling a demo or setting up an account: necessary for (the preparation of) the contract, Article 6(1)(b) GDPR.
- Assessing an application or a Traze for Good request: legitimate interest, Article 6(1)(f) GDPR, and your consent where required.
- Running the free tools and preventing abuse: legitimate interest, Article 6(1)(f) GDPR.
- Sending the newsletter: your consent, Article 6(1)(a) GDPR; you can unsubscribe in every email.
- Keeping the website secure and working and finding errors: legitimate interest.
- Complying with legal obligations, such as retention periods for accounting records.
We do not use your data for automated decision-making with legal effects and never sell it.
04The free tools
The tools fetch public pages from the website you specify, with an identifiable user agent (Traze-Tools) and respecting robots.txt. The result is shown in your browser and not linked to a profile, unless you request the full report by email yourself.
Entered values and results are kept for at most 30 days in technical logs to detect abuse and fix errors. After that they are deleted or anonymised.
05Traze as processor (platform customers)
If you use the Traze platform, we process data from connections such as Google Search Console, your CMS, GA4 or your store on your behalf. You determine the purpose and means; we are the processor. The arrangements are set out in the data processing agreement that comes with every subscription and is available on request beforehand.
Content that Traze generates may be processed by AI model providers. We do not send personal data of your customers along, unless you include it yourself in the brand profile or in instructions. Which providers we use is listed in the sub-processor list attached to the data processing agreement.
07Transfers outside the EU
Where possible we choose processing within the European Economic Area. Some providers, in particular AI model providers and search data providers, process data in the United States. For those transfers we rely on the European Commission's standard contractual clauses and, where applicable, the EU-US Data Privacy Framework.
08How long we keep data
- Contact, demo and start requests: 24 months after the last contact, or for the duration of the customer relationship plus the statutory retention period for accounting records.
- Open applications: at most 12 months after receipt, unless you ask for deletion sooner.
- Traze for Good applications: 12 months after the decision.
- Newsletter: until you unsubscribe; after that we keep only proof of the unsubscribe.
- Tool inputs and results in logs: at most 30 days.
- Server logs: at most 30 days.
- Invoices and accounting records: 7 years (statutory retention obligation).
09Security
Connections are encrypted (TLS), access to systems is limited to those who need it and is logged, and connections to your CMS and Search Console use tokens with the least privileges possible, which you can revoke at any time. In the event of a data breach that poses a risk to data subjects, we notify the Dutch Data Protection Authority within 72 hours and you without undue delay.
10Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and the right to object to processing based on legitimate interest. Consent you have given can be withdrawn at any time; this does not affect the lawfulness of earlier processing.
Send your request to hello@traze.io. We respond within one month. To make sure the request comes from you, we may ask for additional verification. If we cannot resolve it together, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or the supervisory authority in your own country.
12Changes
We update this policy when our service or the law changes. The version and date are always shown at the top. For material changes we inform customers and newsletter subscribers by email.
Changes
- Version 1.0: first draft, published ahead of the platform launch.