Privacy Policy

Traceten ("Traceten", "we", "us") provides an analytics service that detects AI-referred traffic on our customers' websites and attributes that traffic to revenue. This Privacy Policy explains what data we collect, why we collect it, how we protect it, and the rights you have over it.

This policy covers two distinct relationships:

• Customers who sign up for a Traceten account. We act as a data controller for the limited account information we collect from them.
• Visitors to websites that have installed the Traceten tracking snippet. We act as a data processor for these visitors on behalf of our customers, who are the controllers.

1. What we collect from website visitors

When the Traceten snippet runs on a customer's website, we collect behavioral signals that help classify whether a visit originated from an AI tool such as ChatGPT, Claude, Perplexity, Gemini, or Copilot.

Data we collect by default

• Page views: URL, page title, referrer, and timestamp.
• Behavioral signals: scroll depth, click events, time on page, and rough mouse-movement timing patterns. We also count copy and form interactions on the page (counts only; we never read what was copied or typed). These signals are how we tell humans apart from automated traffic.
• Browser and device: user-agent string, screen resolution, language, timezone, and a coarse device memory class (the browser's reported JavaScript heap limit, where available).
• Approximate location: country and city, derived from the IP address at our edge ingestion layer and stored alongside the visit. We use it to show site owners which regions their AI-referred traffic comes from, and as one signal in telling human visits apart from automated ones. We never store the postcode, street address, or GPS coordinates, and we never derive a location more precise than the city. City is kept for the same period as the visit it belongs to: 90 days for the raw event, and between 90 and 120 days for the session-level record. Our lawful basis is legitimate interests; the assessment behind that is summarised at docs.traceten.com/privacy/gdpr.
• IP address (hashed only): the raw IP is hashed with HMAC-SHA-256 using a per-site salt at our edge ingestion layer (Cloudflare Workers). Only the resulting hash is forwarded to storage. The raw IP never reaches our analytics database, our logs, or disk.

Data we collect only with explicit consent

Two coarse device-capability signals are collected only after a visitor grants consent through the site's consent management platform (or an equivalent opt-in): whether WebGL is available (true/false), and a single entropy score derived from a small canvas rendering test. We use them to distinguish real browsers from automated ones. The raw canvas image never leaves the browser, and neither signal is used to identify a visitor or to link activity across sites.

Data we do not collect by default

• The analytics snippet does not collect names, email addresses, phone numbers, payment details, or any other personally identifiable information by default. (Email is collected only if you choose to join our early-access waitlist — see section 2.)
• We do not read form input, password fields, or page text content.
• We do not maintain a cross-site identity graph. Cookies are first-party only and scoped to the customer's own domain, and we never use browser or device signals to link a visitor's activity on one customer's site to their activity on another.

Cookies set by the snippet

• _traceten_sid — first-party session cookie, 30-minute sliding window, SameSite=Lax. Used to group page views into a single session.
• _traceten_vid — first-party visitor cookie, 1-year lifetime, SameSite=Lax. Used to identify returning visitors on the same site.
• _traceten_cart — first-party checkout cookie, 24-hour lifetime, SameSite=Lax (so it survives the redirect to Shopify's checkout domain and back). Set only when a Shopify checkout is detected; holds the checkout's cart token so the resulting purchase can be attributed to the visit.
• _traceten_optout — first-party opt-out preference, 30-day lifetime, SameSite=Strict. Set when you opt out of tracking. While it is present, the snippet stops writing the visitor cookie, stops collecting the higher-entropy device signals, and stops exit, click, and in-app navigation tracking. The initial page view is still sent. See section 7 for what opting out does and does not stop.

All of these cookies are set with the Secure flag on HTTPS sites, and all are strictly first-party: they are never read by any domain other than the one that set them. The snippet also reads (but never sets) a _traceten_consent cookie, which the site’s consent management integration may set to record your consent choice for the consent-gated signals described above.

All of these cookies use SameSite=Lax except _traceten_optout, which uses SameSite=Strict. Lax is what lets a visitor’s session and visitor ID survive their first hit after clicking a link inside an AI answer (ChatGPT, Perplexity, and similar), which is a top-level cross-site navigation. The cookies are still never sent on cross-site subresource requests or inside embedded iframes. Opt-out stays Strict because it never needs to ride a cross-site navigation.

2. What we collect from customers

When a customer creates a Traceten account, we collect:

• Name and work email, supplied through our authentication provider (Clerk).
• Company name and billing address, for invoicing.
• OAuth tokens for integrations the customer chooses to connect (Stripe, Shopify). These tokens are encrypted at rest with envelope encryption (KMS) and used only to fetch revenue events for attribution.
• API keys generated by the customer. We store only an Argon2id hash of the key, never the plaintext. Once issued, an API key cannot be retrieved again from us.
• Standard server logs (request timestamps, status codes, error traces).

Early-access waitlist

If you ask to join our early-access waitlist, we collect the email address you submit, with your consent, so that we can contact you about early access. We also store a salted, one-way hash of your IP address (never the raw IP) purely to rate-limit abuse of the signup form. We use the email only to email you about early access — we do not sell it, share it with advertisers, or add it to unrelated marketing. We keep it until we launch or until you ask us to remove you, whichever comes first. To be removed at any time, email legal@traceten.com and we will delete your signup.

3. How we use the data

• To classify each visit as AI-referred or not, score its confidence, and attribute it to a source (e.g., ChatGPT, Perplexity).
• To match visits against revenue events from connected billing systems (Stripe, Shopify), so customers can see what their AI traffic is worth.
• To produce aggregated analytics in the customer's Traceten dashboard.
• To operate, secure, and improve the service.

We do not sell visitor data. We do not share visitor data with advertisers. We do not use visitor data to train machine learning models that benefit anyone other than the customer whose site the data was collected from, except for our internal AI-classification model, which is trained on aggregated, non-identifying behavioral signals.

4. Where data is stored

• Raw behavioral event records (90 days): ClickHouse Cloud. Used for dashboard queries. Raw event records are permanently deleted after 90 days by an automatic database retention policy (TTL).
• Conversion and revenue-attribution records (1 year): ClickHouse Cloud, permanently deleted after 1 year by the same automatic retention mechanism. These records reference the pseudonymous visitor identifier, never a name or email.
• Session summaries (90 to 120 days): ClickHouse Cloud. One compact record per session, keyed by the pseudonymous visitor and session identifiers, holding the session’s entry page, attributed source, and the country and city of the first event. Deletion runs on monthly storage partitions, so a given session is removed at least 90 and at most about 120 days after it started.
• Lifetime-revenue totals (life of the account): per-visitor revenue totals derived from the records above, keyed by the pseudonymous visitor identifier. These are retained while the customer’s account is active so that lifetime-value reporting keeps working, and they are removed through the deletion process described in section 7.
• Account metadata: Postgres (Neon), encrypted at rest.
• Sessions and rate-limit counters: Upstash Redis, with TTLs that match the cookie lifetimes above.

Raw event records are deleted after 90 days and conversion and revenue-attribution records after 1 year, as described above; only the per-visitor summaries and aggregated, non-identifying counts (used for service-wide capacity planning) are kept beyond those windows. We plan to add an encrypted cold-storage archive (Amazon S3, Parquet format, SSE-KMS) for historical reporting; if we do, we will update this policy before it launches.

You select a data residency region when you create a site, and we record it against the site. Region-based storage routing is not yet in place: all behavioral data currently lands in one region regardless of the region selected, listed on our sub-processors page. Transfers are covered by the standard contractual clauses in our DPA. We will update this policy and notify affected accounts before region routing goes live.

5. Sub-processors

We use a small number of vetted sub-processors to operate the service. The current list, with each sub-processor's location and role, is published at /legal/sub-processors. We notify customers at least 30 days before adding a new sub-processor that processes personal data.

6. Security

• All traffic between the snippet, our edge, and our backends is TLS 1.3.
• Data at rest is encrypted (ClickHouse Cloud, Postgres).
• OAuth tokens are encrypted with envelope encryption using a customer-managed KMS key where supported.
• API keys are hashed with Argon2id; we never store plaintext keys.
• Access to production systems requires SSO and hardware-key MFA.
• Logs are scrubbed of known secret patterns before they leave the originating service.

7. Visitor rights (GDPR, CCPA, and similar laws)

If you are a visitor to a website that uses Traceten and you want to exercise your rights of access, correction, or deletion, your first point of contact is the operator of the site you visited; they are the controller of your data. They can use the Traceten deletion process to remove your data from our systems.

You can also contact us directly at legal@traceten.com. We will route the request to the relevant customer and confirm completion within 30 days.

Because we do not collect names, emails, or other direct identifiers from visitors by default, identifying your records may require you to provide the website you visited and, where available, your _traceten_vid cookie value. We cannot identify visitors without one of these.

Opting out. Setting the _traceten_optout cookie, or sending a DNT: 1 header, puts the snippet into opt-out mode. This stops the persistent _traceten_vid cookie (a transient in-memory ID is used instead, so visits cannot be joined across sessions), the higher-entropy device signals (WebGL support, canvas entropy, approximate JavaScript heap size, timezone offset, paste detection), the Shopify cart token, and exit, click, and in-app navigation tracking. It does not stop the initial page view: that is still sent, and it still carries the page URL, referrer, user agent, screen size, language, and timezone, and we still derive an approximate country and city from the request IP as we would for any page view. The _traceten_sid session cookie is also still written. If you want collection to stop outright, the site operator must gate the snippet behind their consent tool, which we enforce on our side. To remove data already collected, use the deletion route described above.

The _traceten_vid visitor identifier is stored alongside pageview events and, when a site operator records a conversion event via the Traceten server SDK, alongside that conversion record. This linkage allows customers to attribute revenue to the AI traffic that drove it, and it is required to fulfil Art. 17 deletion requests: a deletion request keyed on _traceten_vid removes the corresponding pageview events, session data, and conversion records from our systems.

8. International data transfers

Where data is transferred from the European Economic Area, the United Kingdom, or Switzerland to a country that has not received an adequacy decision, we rely on the EU Standard Contractual Clauses (Module 2: controller to processor), incorporated into our Data Processing Agreement at /legal/dpa.

9. Children

Traceten is a B2B analytics product and is not directed to children under 16. We do not knowingly collect data from children. If you believe a child's data has reached our systems, contact legal@traceten.com and we will delete it.

10. Changes to this policy

We will update this policy as the product evolves. Material changes are announced to customers by email at least 30 days before they take effect. The "Last updated" date at the top of this page reflects the most recent change.

11. Contact

Privacy and legal questions: legal@traceten.com
Traceten, [address]