Privacy policy

ProcessTrace (processtrace.app) is operated by Andrzej Litwiński Consulting, Akacjowa 42c, 55-093 Kiełczów, Poland ("we", "us"). This policy explains how we process personal data when you visit the website or use ProcessTrace.

For account, organization and technical data we are the controller under the General Data Protection Regulation (GDPR). For the content your organization stores in ProcessTrace, such as process diagrams, change comments and the change register, your organization is the controller and we process that content on its behalf.

Depending on how you use ProcessTrace, we process:

• Account data: your name, e-mail address, password (stored only as a salted hash), preferred language, and the sign-in method you use.
• Organization data: the organizations you belong to, your role in them, and invitations, including the e-mail address of the invited person.
• Content: process diagrams and their versions, change comments, and change register entries, which can contain names of people (for example requesters or implementers) and links to tickets.
• Technical data: the IP address and browser information stored with your sign-in sessions, server logs, and counters used to limit repeated sign-in attempts.

We process this data to:

• provide ProcessTrace to you and your organization (performance of a contract, Art. 6(1)(b) GDPR);
• keep the service secure and prevent abuse, for example by limiting sign-in attempts (legitimate interests, Art. 6(1)(f) GDPR);
• send the e-mails the service needs: address confirmation, password reset and invitations (performance of a contract);
• meet legal obligations (Art. 6(1)(c) GDPR).

We do not use your data for advertising, do not sell it, and do not send marketing e-mails.

We use the following providers, who process data only on our instructions:

• Vercel: hosting of the application; our application servers run in the EU (Frankfurt).
• Neon: managed PostgreSQL database, hosted in the EU (Frankfurt).
• Resend: delivery of the e-mails described in Section 3.
• Google and Microsoft: only if you choose to sign in with them. They then share your name and e-mail address with us.

Some of these providers are based in the United States. Transfers of personal data outside the EU are covered by the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.

We use only what the service needs to work: a session cookie that keeps you signed in, and your language preference (a cookie and an entry in your browser's local storage). We use no analytics, advertising or tracking cookies, so we do not ask for cookie consent.

All connections are encrypted (TLS), and our providers encrypt stored data. Passwords are stored only as salted hashes. Each organization's data is separated in the database, access to production systems is limited, and repeated sign-in attempts are rate-limited.

We keep:

• account data for as long as your account exists;
• your organization's content for as long as the organization exists (versions are kept as history by design);
• sign-in sessions until you sign out or they expire;
• database backups for the limited restore period offered by our database provider, after which they are overwritten.

To delete your account or organization, contact us. We then delete the related data within 30 days, unless the law requires us to keep it.

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted;
• restrict how we process it;
• receive your data in a structured, machine-readable format;
• object to processing based on our legitimate interests.

To exercise these rights, write to [email protected]. We reply within one month. Requests about content your organization controls are passed on to your organization. You can also lodge a complaint with a data protection supervisory authority: in Poland the President of the Personal Data Protection Office (UODO, uodo.gov.pl), or the authority in your country.

ProcessTrace is a business service and is not intended for children under 16.

We update this page when the way we process data changes, and inform account holders of significant changes by e-mail.

Questions about this policy or your data: [email protected].