--- title: "Privacy policy - Tracwell" description: "What we collect, why we use it, and how to exercise your rights." canonical: "https://tracwell.app/privacy" markdown: "https://tracwell.app/privacy.md" --- Last updated September 10, 2026 # Privacy policy What we collect, why we use it, and how to exercise your rights. ## Who this covers Tracwell is operated by Saurabh Chauhan, an independent operator based in India. References to Tracwell, we, or us mean Saurabh Chauhan operating the service. Tracwell controls personal data used to operate its website, accounts, billing, and support. For analytics collected on a customer’s website or app, that customer controls the purposes of processing and Tracwell processes data on their instructions. Read our [service provider list](https://tracwell.app/subprocessors) and [data processing agreement](https://tracwell.app/dpa) . ## Data and purposes We use your name, email, sign-in details, workspace settings, subscription references, support messages, and security records to provide and secure the service. Account administration relies on our contract with you; abuse prevention relies on legitimate interests; legally required records rely on legal obligations. Where consent is required, we must obtain it before processing. Customer analytics may include URLs, referrers, campaign tags, event properties, timestamps, pseudonymous visitor or user IDs, approximate location, device information, and backend payment events. Customers choose what they send and their lawful basis. Do not send passwords, card details, health information, or unnecessary personal data. IP addresses are processed at collection for location and Private-mode identity. Raw IPs are not stored in analytics events by default. We do not automatically capture form values or page text, sell personal data, or use customer analytics for advertising profiles. ## Collection and consent Private mode uses no cookies or browser storage for analytics identity and rotates its pseudonymous visitor identifier daily. This reduces linkability; it does not make every event anonymous. Product mode can store persistent first-party identifiers and link activity to a customer-supplied user ID. Customers must provide appropriate notices, choose a lawful basis, and obtain consent where required, including for identity and revenue attribution. The SDK supports consent changes and Do Not Track. Cookie-free collection does not guarantee that a site is exempt from consent requirements. Tracwell uses its own Product-mode SDK on its production website and dashboard to measure visits, signup, activation, and payment conversion. It uses first-party browser storage and links signed-in activity to an internal user ID. Authentication also uses essential session cookies. ## Providers and processing locations We use Cloudflare for application hosting, delivery, collection, queues, account storage, email, backups, and exports; Scaleway for analytics database hosting; Google for optional sign-in; and Dodo Payments for billing. Infrastructure providers process data for us; sign-in and payment providers may also act independently for their own purposes. Processing may occur outside your country, including through globally distributed infrastructure and provider support access. We do not offer an EU-only processing guarantee. Applicable international-transfer safeguards must cover the actual providers and processing locations; this policy is not itself a transfer agreement. ## Retention, exports, and deletion Analytics retention follows the workspace plan and website settings. Settings offers report CSVs; workspace owners can request all available retained events and receive an email when the export is ready. Full-export downloads require authorized access and expire seven days after the request. Account deletion removes the account, owned workspaces, and associated analytics through an asynchronous deletion workflow. Account, billing, support, and security records may be retained where needed for legal obligations, disputes, or security. Deleting an account is distinct from cancelling a subscription; manage billing separately. Backups are isolated recovery copies. The documented analytics backup lifecycle is 30 days for daily copies and 40 days for weekly bases, plus storage-provider expiry delay. Deleted records can remain in those copies until expiry. The recovery procedure requires reapplying recorded deletions before restoring customer access. ## Your rights Where applicable, you can request access, correction, deletion, portability, restriction, or object to processing. You can withdraw consent without affecting processing that was lawful before withdrawal. We respond within the applicable legal deadline, normally one month for GDPR requests; if an extension is permitted, we explain it within that month. Visitors should contact the website operator first. We assist that customer with requests for analytics we process on their behalf. We may need proportionate identity verification and enough information to locate the records; we do not promise that pseudonymous data can always be found or that it can never be found. You may complain to your local data protection authority. Required account details are needed to provide the service. We do not use the service to make automated decisions with legal or similarly significant effects about you. ## Security and updates We use scoped access, authenticated connections, encryption, and audit records to protect data. No service can guarantee absolute security. Tracwell is not intended for children; customers must not collect children’s data without appropriate legal authority. We update this policy when practices change and communicate material changes through the service or email as appropriate. ## Contact For questions or requests, contact .