This Privacy Policy describes how Scriptx, UAB (“Scriptx”, “we”, “us”), a company incorporated in the Republic of Lithuania, processes personal data in connection with the TraceItX website, the TraceItX ingest service, the TraceItX SDKs, and the admin console (together, the “Service”). We process personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”) and applicable Lithuanian law.
1. Two roles: controller and processor
Our role depends on whose data we are handling.
- For account and website data — the details of the people who sign up for and administer a TraceItX account, plus visitors to our website — Scriptx is the data controller.
- For bug-report (ingest) data — the reports your end users submit through an SDK you embed in your app — you, our customer, are the data controller and Scriptx acts as a data processor on your behalf. We process that data only to validate, briefly store, and deliver it to the receivers you configure, and according to our Data Processing Agreement.
2. Data we process as a controller
Account data
When you create and use a TraceItX account we process your name, email address, hashed password (or your identity-provider identifier), organisation name, billing details, and the configuration you create (registered apps, SDK keys, webhook subscribers).
Billing data
Payments are handled by our payment processor. We do not store full card numbers; we retain invoices, plan, and billing contact for tax and accounting purposes.
Website & product analytics
We process limited technical data (IP address, browser, pages viewed) to keep the site secure, measure interest, and improve the product. We keep this to a minimum and do not build advertising profiles.
Support communications
When you contact support@traceitx.com we process the contents of your message and your contact details to respond.
3. Data we process as a processor (bug reports)
A TraceItX report is an “AI-ready envelope.” Depending on how you configure your SDK, it may contain a screenshot, a screen recording, the UI tree of the screen, the focused component, console and network logs, device and app metadata, and — only if you choose to attach it — an end-user identifier, email, or display name. You decide what your SDK captures, and you are responsible for providing notice to and obtaining any consent from your end users, and for redacting sensitive fields before submission.
We process this data solely to provide the Service: validating the payload, storing it for the delivery and retry window, and forwarding it to the webhook receivers you configure. We do not use report contents to train models, and we do not sell or share them.
4. Why we process data (legal bases)
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing and operating the Service for account holders | Performance of a contract (Art. 6(1)(b)) |
| Processing bug reports on your instructions | Processing on behalf of a controller (Art. 28) under your legal basis |
| Security, fraud prevention, and service improvement | Legitimate interests (Art. 6(1)(f)) |
| Billing, accounting, and tax | Legal obligation (Art. 6(1)(c)) |
| Product updates and marketing email | Consent (Art. 6(1)(a)), withdrawable at any time |
5. Retention
Report artifacts (screenshots, recordings, logs, and the stored envelope) are retained for a maximum of 30 days — the window we need to deliver, retry, and dead-letter a webhook — after which they are deleted automatically. Lightweight event metadata may be retained longer for analytics and abuse prevention. Account, billing, and tax records are kept for as long as your account is active and afterwards as required by Lithuanian law.
6. Sub-processors
We rely on a small set of vetted infrastructure providers (cloud hosting, object storage, email delivery, and payment processing) to run the Service. Each is bound by a data-processing agreement with appropriate safeguards. A current list of sub-processors is available on request at support@traceitx.com.
7. International transfers
We aim to process data within the European Economic Area. Where a sub-processor transfers data outside the EEA, we rely on an adequacy decision or the European Commission’s Standard Contractual Clauses together with appropriate supplementary measures.
8. Security
Bug reports are delivered over TLS and signed with HMAC-SHA256 so receivers can verify authenticity. SDK keys and webhook signing secrets are stored encrypted, and access to production systems is restricted and logged. For more detail see our security practices.
9. Your rights
Subject to the GDPR you have the right to access, rectify, erase, restrict, and port your personal data, to object to processing based on legitimate interests, and to withdraw consent. To exercise these rights for data we hold as a controller, contact support@traceitx.com. Where TraceItX processes bug-report data on a customer’s behalf, please direct requests to that customer (the controller); we will assist them as required.
You also have the right to lodge a complaint with a supervisory authority. In Lithuania this is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija).
10. Children
The Service is intended for businesses and is not directed to children. We do not knowingly collect personal data from children.
11. Changes to this policy
We may update this policy from time to time. Material changes will be announced in the product or by email, and the “last updated” date above will change.
12. Contact
Scriptx, UAB · Lithuania
Privacy enquiries: support@traceitx.com
See also our Terms of Service and security practices.