Privacy policy

This policy covers the Trace website and the Trace application. It is operated by Trace Labs, Inc., a placeholder legal entity name that will be replaced on incorporation.

Two kinds of information are handled and they are treated differently throughout this document. Account information is data about you as a user. Workspace content is the research material you put into the product — manuscripts, identifiers, portfolios, query sets, and the measurements derived from them. Where the two are treated differently, this policy says so explicitly rather than using one word for both.

Account information

Your email address, your display name if you provide one, your workspace membership and role, and authentication records including sign-in times. This is the minimum required to give you an account and to attribute actions in an audit log.

Workspace content

Documents you upload, identifiers you enter, portfolios you define, query sets you create, annotations you write, and the measurements, diagnostics, and reports produced from them. Uploading a document asserts that you have the rights to process it.

Technical and usage information

Server logs including IP address, user agent, requested path, timestamp, and response status; error reports; and basic usage counts needed to operate the service and diagnose faults. There is no advertising tracking, no cross-site tracking, no sale of personal information, and no third-party advertising network embedded in the product.

Public bibliographic data

Metadata about publications is retrieved from public scholarly infrastructure. This is data about published works, not about you, though a published work naturally carries author names. Where a bibliographic record concerns you as an author, it originates from the public record rather than from anything you provided here.

Account information is used to authenticate you, to enforce roles, and to attribute actions in the audit log. Workspace content is used to produce the measurements and reports you asked for, within your workspace. Technical information is used to operate, secure, and debug the service.

Information is not used to build advertising profiles, is not sold, and is not shared with other customers. Aggregate operational statistics — how many measurements ran, how often a provider failed — may be used to improve the service, and these are computed without reference to the content of any workspace.

Customer manuscript content is not used to train models. This is the default, it applies on every plan, and it is not conditional on price or negotiated separately. Changing it requires an explicit, workspace-level opt-in that an administrator gives deliberately, that is recorded in the audit log, and that can be revoked.

Where a hosted language-model provider processes text on our behalf, zero-retention and no-training terms are configured before unpublished manuscript content is sent. A provider that cannot offer those terms is not used for manuscript content. Enterprise customers may instead point model calls at their own endpoint so that manuscript text never leaves an environment they already govern.

Service providers process data on our behalf under contract and only for the purposes we specify. The categories are cloud hosting and storage, managed database services, language-model providers, public bibliographic and availability sources, and operational tooling for error monitoring and transactional email. The specific vendor list is provided in full before any pilot processes customer content, and is described by category on the security page.

Data may be disclosed where legally required. Where we are permitted to notify you of a legal demand for your data, we intend to do so.

In a merger or acquisition, data may transfer to the successor entity, which would remain bound by this policy or a successor policy that is not materially less protective.

Retention windows are configurable per workspace. Where no window is set, workspace content persists until it is deleted by the workspace or the account is closed.

Deleting a manuscript removes the stored document and the text derived from it, including extracted sections and embeddings, and records the deletion in the audit log. Measurements that reference the deleted document are removed with it. Backups inherit the same encryption as primary storage, and deletion propagates to backups on the backup rotation schedule rather than instantly.

Audit log entries and minimal billing records are retained after content deletion, for security and accounting purposes respectively.

Data is encrypted in transit and at rest, access is scoped by workspace, roles separate analysts from reviewers and administrators, and sensitive actions are logged. The full control list, including the controls that do not yet exist, is on the security page.

No security or privacy certification is held. There is no SOC 2 report and no ISO 27001 certification. Trace is not a HIPAA covered entity or business associate. Do not upload protected health information or other regulated personal data.

You can access and export your workspace content as CSV or JSON at any time. You can correct account information from within the application. You can request deletion of your account and its content, and you can withdraw a model-training opt-in at any time.

Depending on where you live, you may have additional statutory rights to access, correction, deletion, portability, or objection. Requests can be sent to hello@trace.science. The mechanics of honouring statutory requests are part of what remains under legal review.

Material changes will be dated and, for account holders, notified by email. A change to this policy will never be used as the mechanism for granting a model-training permission that was not given explicitly.

Questions: hello@trace.science. Security reports: security@trace.science.