Privacy Policy

Account and identity data: When you create an account, we collect your name, work email address, company name, job title, and password (handled by our authentication provider and stored as a salted hash, so we never see your plaintext password). This information is necessary to provide you with access to the Platform.

Operational data: We collect the supply chain data you submit through the Platform, including facility information, production metrics, emissions data, worker welfare indicators, product traceability records, and compliance documentation. This data is submitted voluntarily and belongs to you.

Usage data: Our hosting providers keep logs of the requests made to our website and the Platform, and those logs can contain IP addresses and, for logged-in users, account identifiers. Separately, if you click Accept on the cookie banner of our public website, we record how you use that website: the pages you view, where you came from, a coarse location taken from your IP address, your browser and device, a random identifier for your browser tab, and your clicks and scrolling. Section 8 lists exactly what is stored. The visitor counter and Vercel Web Analytics do not run inside the logged-in product, on the sign-in pages, on shared passport pages or in the demo sandbox. We use this to improve the website and diagnose technical issues.

Website enquiries: If you contact us, request a demo, claim a Founding Mill place, book a call, join a waitlist, or send us a security report, we collect what you enter (name, work email, company, role, a phone or WhatsApp number where the form asks for one, and your message) and store it so we can respond.

Communications: If you contact our support team or respond to our emails, we retain records of those communications to resolve issues and improve our service.

Cookies and similar technologies: We use essential cookies to keep you signed in and to remember your cookie choice. Nothing else starts on our public website until you click Accept on the banner. If you do, we also start the visitor counter, web analytics, product analytics and advertising-measurement tools described in section 8.

Providing the service: We use your data to operate, maintain, and improve the TraceLoom Platform, to authenticate you, to process your supply chain data as instructed, and to generate reports and analytics you request. Features that read documents you upload, write the daily brief, or answer questions in Ask send the relevant content to our AI provider, Anthropic, to produce the result.

Communications: We use your email address to send you product updates, security alerts, billing notices, and responses to your support requests. You can opt out of non-essential communications at any time.

Legal and compliance: We may use and retain your data as necessary to comply with legal obligations, resolve disputes, enforce our agreements, or respond to lawful requests from public authorities.

Improvement and research: We may use aggregated, anonymised usage data (with no ability to identify individuals or organisations) to improve the Platform and develop new features.

We do not sell or rent your personal data. If you accept marketing cookies, our advertising-measurement tool sends visit and conversion events to Meta, as described in section 8.

For users in the European Economic Area (EEA) and UK, our legal bases for processing personal data are:

Contract performance: Processing necessary to deliver the services you have contracted for, including account management and operational data processing.

Legitimate interests: Processing for the purpose of improving the Platform, ensuring security, and preventing fraud, where these interests are not overridden by your rights.

Legal obligation: Processing required to comply with applicable laws and regulations.

Consent: Where we rely on consent (for example, for analytics and advertising-measurement cookies, or marketing communications), you have the right to withdraw consent at any time.

Your account: We keep your account data while your account is active. If you ask us to delete your account, a 30-day window starts in which you can cancel. After it, we permanently delete your sign-in record, and your name is removed from the records you created, which stay with your organisation without your name on them.

Your organisation's data: When an organisation's subscription ends, we make its data available for export for 30 days, and then delete it within a further 30 days, unless the law requires us to keep it. Section 9 of our DPA sets out the same schedule.

Backups: Backup copies of the database that we hold are kept for no more than 30 days and then expire, so deleted data can persist in a backup for up to 30 days after deletion.

Enquiries: We keep website enquiries for as long as we need to respond and to keep a record of the conversation.

Anonymised, aggregated usage data may be retained indefinitely for product improvement purposes.

We do not sell your personal data. We share it with the service providers that help us run TraceLoom, and with the optional analytics and advertising-measurement tools in section 8 only if you accept them. The providers that process customer data, with their regions and what each one receives, are listed in section 4 of our DPA. In short:

Supabase (Supabase, Inc.): Authentication, database and file storage. Data is stored in AWS us-east-2 (Ohio, USA). This includes the records of our own visitor counter, described in section 8.

Vercel (Vercel, Inc.): Application hosting and serverless functions and, only after you accept cookies on our website, web analytics.

Anthropic (Anthropic, PBC): The AI provider for document extraction, daily briefs and Ask. It receives the content of the documents you upload to those features, summaries of your operating data, and the questions you ask.

Resend: Sends our transactional and notification emails, so it receives recipient addresses and message content.

GitHub (GitHub, Inc.): Where our backup job runs. It stores copies of the database, which include personal data, in a private repository for up to 30 days.

Cal.com: Schedules the founder call. When you book through the Founding Mill claim flow, or through a booking page we link to or embed on the website, Cal.com receives the name and work email address you entered and the time you pick. If we configure a Calendly booking page instead, Calendly receives the same details.

PostHog and Meta: Product analytics and advertising measurement. On our website they start only after you accept cookies. Section 8 explains the demo sandbox, which treats PostHog differently.

The Platform does not collect payment card details. If we add a payment processor, we will list it here and in the DPA. Our primary infrastructure is in the United States. For transfers of personal data from the EEA or UK we rely on the safeguards described in section 5 of our DPA, such as Standard Contractual Clauses.

Under GDPR and applicable privacy laws, you have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete personal data.
• Right to erasure ("right to be forgotten"): Request deletion of your personal data, subject to legal retention obligations.
• Right to data portability: Request your personal data in a structured, machine-readable format (JSON or CSV).
• Right to restriction: Request that we restrict processing of your data in certain circumstances.
• Right to object: Object to processing based on legitimate interests.
• Right to withdraw consent: Withdraw consent at any time where processing is based on consent.

Users of the factory (mill and garments) portal can download their personal data as a JSON file and request deletion of their account from Settings. Everyone else, and anyone who prefers, can exercise any of these rights by email to privacy@traceloom.co. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection supervisory authority.

We protect your data with the measures described on our Security page: encryption in transit and at rest provided by our infrastructure providers, row-level security that separates each organisation's data, role-based access, and an audit log of changes to key records. Staff access to customer data is protected by authentication and logging. The Security page lists what we have not yet added, including separation-of-duty controls on that access.

In the event of a data breach that affects your personal data, we will notify you and, where required, the relevant supervisory authority, within 72 hours of becoming aware of the breach, in accordance with GDPR requirements.

No method of transmission over the internet is completely secure. While we strive to protect your data, we cannot guarantee absolute security, and we encourage you to use a strong, unique password.

Strictly necessary: We use session and authentication cookies that keep you signed in, and a first-party cookie called tl-consent, kept for one year, that remembers your cookie choice. These do not need consent and cannot be disabled without breaking sign-in.

Nothing starts before you choose: On our public website, our visitor counter, Vercel Web Analytics, PostHog and the Meta Pixel all wait for you to click Accept on the cookie banner. While you have not chosen, and after you click Decline, none of them runs. If you decline after accepting, they stop straight away, and we remove the visitor counter's tab identifier, PostHog's stored data and cookies, and the _fbp and _fbc cookies that Meta sets. The banner appears when you first scroll, click or press a key, and it is hidden on the legal pages, including this one, so it does not cover the text.

Our visitor counter (only if you click Accept): This is a small tool of our own, and its records sit in our database. For each page you view it stores the page path, with any query string or fragment removed and with private-token addresses such as passport links reduced to a template like /p/[token]; the page you came from, without its query string; any campaign tags in the address (source, medium, campaign, term and content); a coarse location that our host works out from your IP address, where it provides one (country, region, city, postal code, time zone, and approximate latitude and longitude); your browser, operating system, device type and browser language; a random identifier for your browser tab, kept in the tab's session storage and cleared when the tab closes; and a visitor hash. The hash is built from your IP address, your user agent and a secret, and it changes every day, so it recognises repeat visits within one day but not across days. We do not store your raw IP address or user agent. The counter also records clicks on links and buttons (the label, shortened to 60 characters with email addresses and long numbers masked, and the target, reduced to an internal path, a bare website name, or for email, phone and text message links just the scheme, such as mailto:) and the moments you scroll 50 percent and 90 percent down a page. Each of those events is stored with the page path, the daily hash, the tab identifier and your country and city.

Vercel Web Analytics (only if you click Accept): This Vercel service does not use cookies. It records page views with the page address, the referrer, and your country, browser, operating system and device type. Before the address leaves your browser we drop the query string except campaign tags, drop the fragment, and replace private-token addresses with their template.

PostHog and the Meta Pixel (only if you click Accept): PostHog gives us product analytics. We have switched off its automatic page view and click capture, so it receives only specific funnel events, such as viewing Founding Mill pricing, submitting a request, using the WhatsApp link or booking a call, along with the device and approximate location PostHog works out from your connection. It may set its own cookie or use local storage. If you then enter your work email in the form on our homepage, PostHog also receives that email address, as the identifier that ties your later events to you. In our configuration it sends data to PostHog's US cloud by default. The Meta Pixel loads a script from Meta and sends Meta page views and conversion events, such as viewing pricing or submitting a Founding Mill request, which we use to measure our advertising. Meta may set cookies and uses that data under its own policies. To change your choice later, clear cookies and site data for traceloom.co and the banner will appear again.

Where they run: The visitor counter, Vercel Web Analytics, the Meta Pixel and the website PostHog setup do not run inside the logged-in product. Our demo sandbox records usage events with PostHog without waiting for the cookie banner, because visitors there have first given us their contact details. If you have clicked Decline on the banner, PostHog does not load in the sandbox either. The sandbox does not run the visitor counter, Vercel Web Analytics or the Meta Pixel.

You can also manage cookies through your browser settings. Disabling cookies may affect your ability to use certain features of the Platform.

The Platform is intended for use by businesses and their employees. It is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately and we will delete it.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of material changes by email or by posting a notice on the Platform at least 30 days before the changes take effect. Your continued use of the Platform after the effective date constitutes acceptance of the revised policy.

For privacy-related enquiries, requests to exercise your rights, or concerns about our data practices, contact the controller: