Privacy Policy

1. Who is responsible for your information?

TraceSource is operated by FairTrack AB, registration number 559598-0250, Skogaingsvagen 21, Spanga, Sweden.

FairTrack AB is responsible for account administration, billing, service security, support and its own operation of TraceSource. When an organization uses TraceSource to collect or manage forms, employee information, schedules, bookkeeping records or other workspace content, that organization normally decides why the information is used and FairTrack AB processes it to provide the service.

Privacy questions and requests may be sent to admin@tracesource.co. If your information was supplied through an organization using TraceSource, you may also contact that organization directly.

2. Information we handle

Depending on the features used, we handle account and contact details; workspace memberships, roles and permissions; forms, questions, responses, records and attachments; employee profiles, onboarding information, sites, availability, time off and shifts; customer-entered bookkeeping and reconciliation records; support communications; and subscription and entitlement information.

When you deliberately use a supported device feature, TraceSource may handle photographs, camera scans, QR or barcode content, signatures, audio, print content or location with the permission requested by your device.

AI-assisted features handle prompts, selected workspace context, generated output, conversation history and usage information. Device and service information can include IP address, device and application identifiers, operating system, language, timestamps, authentication events, diagnostic logs, crash information and security signals.

TraceSource does not receive full payment-card details. Web and mobile billing providers process payment information under their own privacy notices and return the subscription, transaction and entitlement information needed to administer access.

3. Why we use information

We use information to create and authenticate accounts, provide workspace features, synchronize records and drafts, operate forms and schedules, administer subscriptions, deliver requested AI features, send service and security communications, respond to support, prevent misuse, diagnose faults and comply with legal, accounting and tax duties.

We rely on performance of a contract, steps requested before a contract, compliance with legal obligations, legitimate interests in operating and protecting the service, customer instructions and consent where consent is required. Consent may be withdrawn for future processing without affecting earlier lawful processing.

4. AI-assisted features

When you request an AI feature, TraceSource sends the prompt and the workspace context made available to that feature to configured infrastructure and model providers. AI output can be inaccurate or incomplete and should be reviewed by a person before it is relied upon.

Do not include confidential, sensitive or regulated information in an AI prompt unless your organization has authorized that processing. TraceSource does not use solely automated AI output to make legal or similarly significant decisions about individuals.

5. Sharing and service providers

Information is available to workspace owners, administrators and members according to configured permissions. A public form link permits access to that form and does not grant access to unrelated records.

We use providers for hosting, storage, authentication, communications, diagnostics, AI and subscriptions. We may also disclose information to an integration you direct us to use, professional advisers under confidentiality duties, authorities where legally required, or parties involved in a merger, financing or sale subject to appropriate safeguards.

We do not sell personal data or use it for third-party targeted advertising. Where information is transferred outside its country of origin, we use an applicable adequacy decision, approved contractual clauses or another lawful transfer mechanism when required.

6. Retention and deletion

We retain information only for as long as needed to provide and secure TraceSource, follow customer instructions, resolve disputes and meet legal, accounting and tax obligations. The period depends on the category and sensitivity of the information, customer configuration and applicable law.

An account-deletion request disables access and begins deletion or de-identification of personal account information. Information may remain for a limited period in backups, security logs, fraud-prevention records or records we must retain by law. Shared workspace records remain under the customer organization’s control, and an only owner must transfer workspace ownership before deleting the account.

Mobile drafts and locally saved responses can remain on a device until submitted or deleted, or until the user logs out, deletes the account, uninstalls the application or clears application data. Store subscriptions must be cancelled separately through the provider that bills them.

7. Security

We use measures intended to protect information, including encrypted transport, hashed passwords, token-based authentication, login throttling, role- and capability-based access controls, department restrictions, revocable access tokens and short-lived signed links for private files.

No service is completely secure. Customers are responsible for configuring permissions appropriately and protecting their credentials, users and devices.

8. Your rights and choices

Depending on applicable law, you may request access, correction, deletion or a portable copy of personal data; restrict or object to processing; withdraw consent; and complain to a supervisory authority. We may verify your identity and authority before acting.

Send requests to admin@tracesource.co. For customer-controlled workspace data, contact the relevant organization first. Individuals in Sweden may also contact the Swedish Authority for Privacy Protection (IMY). Device permissions can be managed through operating-system settings.

9. Cookies and local storage

The web application uses an HTTP-only session cookie for authentication and security, a short-lived navigation-preference cookie, and browser storage for preferences and supported in-progress work.

The mobile applications store supported forms, questions, drafts, responses, preferences, AI history and shift information locally so features can work offline or resume later. The applications include Firebase Analytics, Crashlytics and Remote Config. Release builds do not request Android advertising-ID or ad-attribution permissions.

10. Children

TraceSource is a business service and is not directed to children. A person creating an account must be at least 18 years old or otherwise old enough to enter a binding agreement in their country. Customer organizations are responsible for ensuring that any customer-directed processing involving younger people is lawful and appropriately authorized.

11. Changes and contact

We may update this Policy to reflect changes in TraceSource, applicable law or our practices. We will publish the new version and effective date and provide additional notice where required.

Privacy and support contact: admin@tracesource.co. Postal address: FairTrack AB, Skogaingsvagen 21, Spanga, Sweden.