# Privacy Policy What we collect when you use PowerTraces, why, where it lives and the choices you have. ## Who we are PowerTraces ("we", "us") runs the website powertraces.com, the account portal and the PowerTraces observability service, which turns OpenTelemetry traces, logs and metrics into answers about your product and customers. For personal data about you as a visitor or account holder, we are the controller. For questions or requests, email contact@powertraces.com. ## What this policy covers This policy covers our website, the account portal, the PowerTraces app at your organization's address (for example acme.powertraces.com) and our emails. Telemetry your applications send to PowerTraces is handled differently: your organization decides what is sent and we process it on your behalf. See "Telemetry your applications send" below. ## Information we collect - Account details: your name, email address, when you joined and when you last signed in. - Sign-in and security: a one-way hash of your password (never the password itself), the public keys of passkeys you add and their names, your authenticator app's secret key, hashed recovery codes, and the account ID Google, Microsoft or GitHub gives us if you sign in with them. We receive your name and email address from those providers, never their passwords. - Organizations and teams: the organizations and workspaces you create, the people you invite and their roles. - Billing: Paddle handles payments as our merchant of record. We receive your plan, subscription status, billing country and Paddle's customer and subscription IDs. We never see or store card or bank details. - Messages you send us: what you write through the contact form or in support conversations, with your name, email address and company if you give them. - Email engagement: for sales, contact and on-prem emails we record whether they were delivered or bounced, when they were opened (through a small image in the email) and which links were clicked, with the browser type. Sign-in, password, invitation and alert emails are not tracked this way. Turning off images in your email app stops open tracking, and unsubscribing stops our sales emails. - Technical and security data: IP address, browser type, the time of requests and security events such as sign-ins, failed attempts and changes to your security settings. Portal admin actions are recorded in an audit log. ## How we use it - To create and run your account, sign you in and keep it secure, including two-step verification and detecting abuse. - To provide the service: store and analyze your organization's telemetry, run reports and alerts, and enforce plan limits. - To bill you through Paddle and manage your plan. - To send emails you need, such as confirming your address, password resets, invitations, alerts and replies to your messages. - To answer contact and support messages. An AI assistant may draft or send replies and sort incoming messages; a person can review every conversation. - To keep the service working and improve it, using aggregated operational data. ## Legal bases If the EU or UK GDPR applies to you, we rely on: performance of our contract with you (running your account and the service); our legitimate interests (security, fraud prevention, improving the service and answering messages); legal obligations (for example keeping billing records); and your consent where we ask for it, which you can withdraw at any time. ## Telemetry your applications send Your organization controls what its applications send to PowerTraces. For that data your organization is the controller and we act as its processor: we use it only to provide the service to you, under your instructions. Please don't send passwords, payment card data or special categories of personal data. Where telemetry contains personal data about your own users, you are responsible for having a lawful basis and informing them. Telemetry is kept for the retention period of your plan and then deleted automatically. If you connect your own AI provider to PowerTraces' AI agents, the data those agents read is sent to the provider you chose, under your agreement with them. A data processing agreement is available on request at contact@powertraces.com. ## Who we share it with We don't sell your personal data or share it for advertising. We use these service providers, only for the purposes described here: - netcup (Germany): hosts our servers, databases and backups in data centers in the EU. - Paddle: payment processing, invoicing and tax as our merchant of record. - Spaceship / Spacemail: sends and receives our email. - Cloudflare: DNS for our domain, and a bot check on sign-up and contact forms when it is turned on. - Anthropic: the AI model that helps answer contact and support messages. - Google, Microsoft and GitHub: only if you choose to sign in with them. ## International transfers Your account data and telemetry are stored in the EU. Some providers above (Paddle, Cloudflare, Anthropic and the sign-in providers) may process data outside the EU, including in the United States. Where they do, transfers are protected by the European Commission's Standard Contractual Clauses or an adequacy decision such as the EU-US Data Privacy Framework. ## Cookies and local storage We only use cookies the service needs to work. There are no advertising or third-party analytics cookies. - Session cookie: keeps you signed in, for up to 14 days. - Security cookie: protects forms against cross-site request forgery. - Two-step cookies: remember a sign-in that is waiting for its second step for a few minutes, and, if you choose "don't ask again", remember your device for 14 days. - Social sign-in cookie: holds the reply from Google, Microsoft or GitHub for up to 10 minutes while you sign in. - Your language and theme choices are saved in your browser's local storage on your device. ## How long we keep it - Account and security data: while your account exists. When you ask us to delete your account, we delete it unless we must keep something by law. - Telemetry: for your plan's retention period, then it is deleted automatically. - Billing records: as long as tax and accounting law requires, usually up to 10 years. - Contact and support messages: as long as needed to help you, and then up to 2 years. - Security and audit logs: as long as needed to protect the service. - Backups are overwritten on a regular cycle, so deleted data disappears from them over time. ## How we protect it All traffic is encrypted with TLS. Passwords are stored only as salted hashes. You can protect your account with passkeys and an authenticator app, and portal admins must use two-step verification. Access to production systems is limited to the people who run them. ## Your rights Depending on where you live, you can ask us to access, correct, delete or export your personal data, to restrict or object to how we use it, and to withdraw consent. Email contact@powertraces.com and we'll answer within one month. You can update your name, password and sign-in methods yourself on your account page. If you think we've handled your data wrongly, you can complain to your local data protection authority. We'd appreciate the chance to fix it first. ## Children PowerTraces is a service for businesses and isn't meant for anyone under 16. We don't knowingly collect data from children. ## Changes to this policy We'll update this page when our practices change and change the date at the top. If a change is significant, we'll tell account holders by email before it takes effect. ## Contact Questions or requests about privacy: contact@powertraces.com.