Data Processing Agreement

You (the Trace customer) are the data controller for visitor data collected via the Trace script on your sites. Trace Ltd (operating gettrace.uk) is the data processor, processing that data on your documented instructions to provide session analytics, heatmaps, and related features.

Processing covers behavioural analytics events, session identifiers, and optional session replay snapshots for the duration of your active license. When you delete a site or your account, associated event data and screenshots are removed from our systems within a reasonable period.

• Pseudonymous visitor and session identifiers (localStorage)
• Page URLs, interaction coordinates, scroll depth, viewport size
• Technical metadata (timestamps, device/browser signals in event payloads)
• Session replay DOM snapshots with all inputs masked by default

• Provide a lawful basis and privacy notice to your visitors
• Implement consent or legitimate-interest mechanisms where required
• Configure Trace only on sites you are authorised to monitor
• Do not use Trace to collect special-category data intentionally

• Supabase — database, event storage, screenshot storage (EU/US regions per project config)
• Vercel — website and API hosting
• Stripe — payment processing (customer purchase data only, not your site visitors)
• Resend — transactional email (license delivery, account deletion codes)
• Cloudflare R2 — protected Mac app downloads (optional)

We implement access controls, encryption in transit, and service-role isolation for administrative operations. We will assist with data subject requests you receive where feasible — contact hello@gettrace.uk. See also our Privacy Policy for retention and deletion.

Subprocessors may process data outside the UK/EEA. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses offered by our providers). Request details via email if you need them for your records.