Privacy policy
Last updated 19 October 2026 (version 1.0)
01Who we are
Trace (trace.expert) is operated by Human Oversight Laboratories OÜ, registry code 17617561, registered at Tartu mnt 67/1-13b, 10115 Tallinn, Estonia. We are the controller of the personal data described in this policy.
General contact and privacy contact: contact@trace.expert
02Who this policy is for
- Visitors to trace.expert.
- Business contacts: people who contact us, request access or a demo, or represent a customer or prospect.
- Users: people who use the Trace platform on behalf of an organisation that has signed up.
If you may have been searched through Trace, read our GDPR Safeguards Notice. When an organisation uses Trace to investigate a case, the case contents belong to that organisation and are governed by its own privacy notice; we process them only on its behalf.
03What data we collect and where it comes from
| Category | Examples | Source |
|---|---|---|
| Identity and role | Name, job title, organisation, work email, phone | You, or the organisation that invited you |
| Verification data | Identity document, professional licence, insurance certificate, authority to represent the organisation | You, your organisation, public business registers and licensing bodies |
| Account and security data | Login details, two-step sign-in settings, IP address, login times | You and your device |
| Platform activity | Cases opened, purposes recorded, searches run, exports, credits bought and spent, AI analyst usage, acceptance of the User Agreement, confirmations that you read this policy, and each case’s lawful-purpose confirmation (version and fingerprint of the text, the words ticked, time, IP address and browser) | Your use of the platform |
| Billing data | Billing contact, company details, payments and receipts | You or your organisation, our payment provider |
| Communications | Support requests, emails, feedback, privacy requests | You |
| Marketing data | Name, work email, company, role, interactions with our emails | You, events, or public professional sources such as association directories and company websites |
We do not ask for, and ask you not to send us, special category data about yourself (such as health or religion). If an identity document shows it, we use the document only to confirm your identity.
04Why we use your data and our legal basis
| Purpose | Data used | Legal basis |
|---|---|---|
| Providing the platform and managing your account | Identity, account, activity | Our and your organisation’s legitimate interest in providing the service it signed up for (Art. 6(1)(f)); where you are the contracting party yourself, contract (Art. 6(1)(b)) |
| Checking that only eligible professionals get access | Identity, verification | Legitimate interest in preventing misuse of an investigation tool (Art. 6(1)(f)) and in meeting our own accountability duties |
| Preventing, detecting and proving misuse; keeping an abuse log | Activity, account and security data | Legitimate interest in protecting people who may be searched, enforcing our terms and defending legal claims (Art. 6(1)(f)) |
| Answering requests from people who may have been searched | Activity (search records) | Legal obligation to answer data protection requests (Art. 6(1)(c), with Art. 15 to 21) |
| Security of the platform | Account, security, activity | Legitimate interest in keeping the service and its data secure (Art. 6(1)(f)); legal obligation under Art. 32 (Art. 6(1)(c)) |
| Billing and accounting | Billing data, credits | Contract (Art. 6(1)(b)) and legal obligation under the Estonian Accounting Act (Art. 6(1)(c)) |
| Support | Communications | Contract or legitimate interest in helping our customers (Art. 6(1)(b) or (f)) |
| Business marketing | Marketing data | Legitimate interest in promoting our service to professionals (Art. 6(1)(f)); consent where electronic marketing rules require it (Art. 6(1)(a)) |
| Legal claims and cooperation with authorities | Any of the above, as needed | Legitimate interest in establishing, exercising or defending legal claims (Art. 6(1)(f)); legal obligation when an authority lawfully requires it (Art. 6(1)(c)) |
Our legitimate interests. Where we rely on legitimate interest, the interests are: running a secure investigation service for verified professionals; making sure it is used only for lawful purposes; protecting people who may be searched; growing our business among professional users; and defending our legal position. We have weighed these against your interests. You can ask us for more detail, and you can object (section 9).
05What happens if you don’t give us your data
Verification, identity and account data are required by our contract with your organisation. Without them we cannot give you access. Logging of platform activity is a condition of using Trace and cannot be switched off. Marketing is optional; refusing it has no effect on your access.
06Who receives your data
We share data only with the following categories of recipients, and only as far as each needs it:
- Cloud infrastructure and AI model provider, which hosts the platform and runs our AI models on servers in Frankfurt, Germany, and acts on our instructions.
- Email provider, which hosts our mailbox, including support conversations, and sends account and service emails.
- Payment provider, which handles payments for credits.
- Professional advisers such as lawyers, auditors and accountants, bound by confidentiality.
- Courts, supervisory authorities and law enforcement, when the law requires it or to establish, exercise or defend legal claims.
- People who may have been searched, limited to the dates, purpose categories and types of searches, as described in our GDPR Safeguards Notice. We do not name the User or organisation to them unless a court or authority orders it.
- A buyer or successor, if all or part of our business is sold or merged, under the same protections.
Your own account shows your activity on the platform. You can ask us for the name of any recipient of your data (section 9).
07Transfers outside the EEA
We store platform data in the European Union. Some service providers may process limited data, or access it for support, from outside the European Economic Area. When they do, we rely on a European Commission adequacy decision (including the EU-US Data Privacy Framework for certified US companies) or on the Standard Contractual Clauses adopted by the Commission (Art. 45 and 46(2)(c)). You can get a copy of the safeguards by writing to contact@trace.expert.
08How long we keep your data
| Data | How long |
|---|---|
| Account and identity data | Until the account is deleted, then deleted at once |
| Verification records | End of your organisation’s contract plus 3 years, to defend legal claims |
| Platform activity and abuse log | 24 months from each event, including after the account is deleted |
| Case contents (held for your organisation) | 12 months after the case’s last activity, or sooner if your organisation decides |
| Billing and accounting records | 7 years, as required by the Estonian Accounting Act |
| Support conversations | 24 months after the request is closed |
| Privacy request files | 3 years |
| Marketing data | Until you object or unsubscribe, or after 24 months without contact |
| Backups | Overwritten within 35 days |
We may keep data longer only if a legal claim, investigation or authority request requires it, and only for that purpose.
09Your rights
You have the right to:
- access your data and get a copy (Art. 15);
- correct inaccurate data (Art. 16);
- erase your data (Art. 17), except what we must keep, for example to defend legal claims (Art. 17(3)(e)) or under accounting law;
- restrict our use of your data (Art. 18);
- receive data you gave us in a portable format (Art. 20);
- object at any time to processing based on legitimate interest (Art. 21(1)), and at any time without reasons to direct marketing (Art. 21(2));
- withdraw consent at any time, for marketing, without affecting earlier processing (Art. 7(3));
- not be subject to a decision based solely on automated processing with legal or similarly significant effects (Art. 22; see section 10);
- complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), www.aki.ee, or to the supervisory authority where you live or work.
How to exercise them. Write to contact@trace.expert or use the settings in your account. We may ask you to confirm your identity. We reply within one month; for complex requests we may extend this by two months and will tell you within the first month (Art. 12(3)). Requests are free unless they are manifestly unfounded or excessive.
If your request concerns data your organisation controls, such as case contents, we pass it to your organisation and tell you.
10Automated decisions
We do not use your data to make decisions about you based solely on automated processing that have legal or similarly significant effects. The AI analyst suggests searches; a person decides whether to run them. To protect people who may be searched, the platform refuses some cases automatically (for example searches on children) and records the refusal. Any action on an account is decided by a member of our team, and you can ask for a review by writing to contact@trace.expert.
12Security
We protect your data with encryption in transit and at rest, optional two-step sign-in with an authenticator app, restricted staff access, and hosting in the EU. No system is completely secure; if a breach is likely to put you at high risk, we will tell you without undue delay (Art. 34).
13Children
Trace is a professional service for adults. We do not knowingly collect data from anyone under 18.
14Changes to this policy
We will publish any change here with a new version date. If a change materially affects how we use your data, we will tell Users by email or in the platform before it takes effect.
15Contact
Human Oversight Laboratories OÜ, Tartu mnt 67/1-13b, 10115 Tallinn, Estonia. Privacy contact: contact@trace.expert.