This policy explains what personal information Tracecat collects about you, why we collect it and what you can do about it. Tracecat is the trading name of IndexHub, Inc., a Delaware corporation. “We” and “us” mean Tracecat.
The short version
- Tracecat is a security product sold to organizations. We collect business contact and account details, and ordinary website analytics. That is most of it.
- We do not advertise to you, we do not sell or share your information, and we do not use it to train AI models.
- If your employer uses Tracecat Cloud, the security data inside the product is not covered by this policy. Your employer controls that, and we handle it for them under a separate contract.
- You can email privacy@tracecat.com at any time with a question or a request.
1. What this policy covers
This policy covers personal information we handle when you visit www.tracecat.com and our documentation site, when you contact us or sign up for marketing, and when you register for or use a Tracecat Cloud account or free trial (our Terms of Service call this the Cloud Service). It also covers the information we hold about people at our customers, suppliers and prospects.
Our services are for business use. They are offered to organizations and the people who work for them, not for personal, family or household use.
What this policy does not cover
It does not cover the content inside Tracecat Cloud. Alerts, cases, logs, workflow configurations and anything else your organization puts into the product belong to your organization. We handle that content on its instructions, as a processor (a service provider, under United States state privacy laws), under our customer agreement and our data processing addendum. If you want to see or delete information held there, ask your organization. Our Terms of Service, at www.tracecat.com/terms, explain how the two documents fit together.
It does not cover the open source Tracecat software. If you download it and run it yourself, we do not see your data at all.
It does not cover other companies’ websites that we link to. Their policies apply, not ours.
2. Information we collect
Information you give us
- Contact details, such as your name, work email address, employer, job title and phone number.
- Account details, such as your username, sign-in credentials, organization name and the hosting region you choose.
- Things you write to us, including support tickets, sales conversations and anything you send by email or through a form on the site.
- Marketing preferences, such as whether you have asked to hear from us and whether you opened an email.
- Billing details, such as your billing contact and address and the record of invoices and payments. We do not receive or store full payment card numbers.
Information we collect automatically
- Device and connection details, such as your IP address, browser, operating system and referring page.
- How you use the site, such as which pages you look at, when and which links you follow.
- Approximate location, meaning the city, state or country your IP address suggests. We do not collect GPS or other precise location.
Information from other sources
- Your employer or the organization whose Tracecat account you use, when it sets you up as a user.
- Our service providers, which collect information on our behalf as described below.
- People involved in a possible corporate transaction, such as an investor or an acquirer.
What we do not collect
We have no mobile app, no public forum, no user profiles or avatars and no chat widget. We do not collect precise location or device advertising identifiers. We do not ask for sensitive information such as health, biometric or government identifier data, and we ask you not to send it to us.
3. Cookies and similar technologies
A cookie is a small file a website stores on your device. Here is every kind we use.
| Type | What it does | Who sets it | How to control it |
|---|---|---|---|
| Essential | Keeps you signed in, remembers which organization you are working in, and protects your account. | Tracecat | These cannot be switched off. You can block them in your browser, but the service will not work. |
| Analytics | Tells us how people find and use our website and documentation, so we can improve them. We do not use analytics cookies inside the product. | Google Analytics and Reo.dev | Block or delete them in your browser settings. |
| Marketing | Remembers whether you reached us through a partner link, so we can show you the right pricing. It lasts 30 days. | Tracecat | Block or delete it in your browser settings. |
| Booking and forms | Runs the meeting booker on our contact page and sends your demo request to the tool we use for email. | Cal.com and Loops | These only run when you book a meeting or send us a form. |
If you visit from Europe, we ask for your consent before we set any cookie that is not essential.
We do not serve advertising, we do not use advertising or retargeting cookies, and we do not allow anyone to use what they collect on our site to build a profile of you for advertising. Our contracts with Google and Reo.dev let them use what they collect only to provide their service to us.
Browser signals
Because we do not sell or share personal information and do not use it for targeted advertising, there is no opt-out for us to apply. Some browsers send a “Do Not Track” signal. There is no agreed standard for what a website should do with one, so we do not act on it. You can block or delete cookies in your browser settings at any time.
4. How we use information
- To run the service: creating and administering your account, setting up and operating a free trial and providing support.
- To talk to you: service announcements, security notices and answers to your questions.
- To keep things secure: authenticating users, investigating suspicious activity, and preventing abuse of the service.
- To improve the service: understanding how the site and the product are used so we can fix and improve them.
- To market to you: sending information about our products and events, where you have asked for it or where we are otherwise allowed to.
- To meet our obligations: complying with law and lawful requests, enforcing our terms, and protecting our rights and other people’s.
- For corporate transactions: evaluating and completing a financing, merger, acquisition or sale of assets.
We do not train models on your information
We do not use your personal information, or any customer content in Tracecat Cloud, to train, fine-tune or improve any artificial intelligence or machine learning model, whether ours or anyone else’s. Our Terms of Service say the same thing for customer data.
AI and agent features
Tracecat Cloud includes AI and agent features. What you type into them, and what they produce, is customer content belonging to your organization, not information we use for our own purposes. Section 1 explains how that content is handled.
5. Who we share information with
- Service providers that help us run the business, such as cloud hosting, email, analytics, scheduling and support tools. They may use it only to provide their service to us.
- Professional advisers, such as our lawyers, accountants, auditors and insurers.
- Authorities and others, where we believe in good faith that we have to disclose it to comply with the law, respond to lawful process, or protect someone’s rights or safety.
- People involved in a corporate transaction, such as a prospective investor, acquirer or successor.
- Anyone you tell us to share it with.
We do not sell your personal information and we do not share it for cross-context behavioral advertising. We never have.
6. How long we keep it
- Free trial and account information: deleted within 30 days after the trial or account ends.
- Contact, correspondence and marketing information: kept for 24 months after we last hear from you.
- Website and security logs: kept for 90 days.
- Records we need for legal, accounting or tax reasons: kept for as long as the law requires.
Copies in routine backups are deleted on our ordinary backup cycle, which does not exceed 30 days.
7. Your choices
- See or change your details. Sign in to your account, or email us.
- Stop marketing emails. Use the unsubscribe link in any marketing email, or email us. We will still send you service and security messages about your account.
- Control cookies. Use your browser settings. Essential cookies are needed for the service to work.
- Close your account and have your data deleted. Email privacy@tracecat.com.
- Decline to give us information. Some of it we need in order to provide the service, and we will tell you when that is the case.
8. Security
We use administrative, technical and physical safeguards designed to protect personal information against unauthorized access, loss and disclosure. We hold a SOC 2 Type II report and we have the service tested by independent security testers. You can see our current controls and certifications at trust.tracecat.com. No system is perfectly secure, and we cannot guarantee that our safeguards will never be defeated.
9. International transfers
We are based in the United States and our marketing, contact and account information is processed there. For Tracecat Cloud, customers choose a hosting region and customer content stays in that region.
Where we move personal information out of Europe, we rely on the European Commission’s and the UK’s standard contractual clauses, together with the additional measures those clauses require. We are not certified under the EU-U.S. Data Privacy Framework. You can ask us for a copy of the clauses we use by emailing privacy@tracecat.com.
10. Children
The service is not for anyone under 18 and we do not knowingly collect information from children. If you think a child has given us information, email privacy@tracecat.com and we will delete it.
11. United States state privacy laws
Several U.S. states give residents rights over their personal information. Those laws apply to businesses above revenue and volume thresholds that Tracecat is below, so they do not apply to us today and we do not run a formal rights program under them. If that changes, we will update this policy.
What we do in any event: we do not sell personal information, we do not share it for cross-context behavioral advertising, we do not use it for targeted advertising, and we do not profile people in a way that produces legal or similarly significant effects. If you are a U.S. resident and you want to know what we hold about you, or want it deleted, email privacy@tracecat.com and we will deal with your request.
California
Under California’s “Shine the Light” law (Cal. Civ. Code § 1798.83), California residents may ask a business about personal information it disclosed to third parties for those third parties’ own direct marketing. We do not make disclosures of that kind.
Nevada
Nevada residents may tell a business not to sell certain personal information for money. We do not make sales of that kind. You can still write to privacy@tracecat.com if you want to submit a request.
12. If you are in Europe
This section applies if you are in the European Economic Area, the United Kingdom or Switzerland. IndexHub, Inc. is the controller of the personal information described in this policy. For content inside Tracecat Cloud we are a processor acting for our customer, and the customer is the controller.
Why we are allowed to use your information
- To perform a contract with you, or take steps you ask for before entering one: running your account and your free trial, and providing support.
- For our legitimate interests in running and securing the business: keeping the service safe, improving it, marketing to business contacts, and handling corporate transactions. We have considered your interests and rights in each case.
- With your consent: non-essential cookies, and marketing emails where consent is required. You can withdraw consent at any time.
- To comply with a legal obligation: keeping records the law requires and responding to lawful requests.
Your rights
You can ask us for a copy of your personal information, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form. You can withdraw consent at any time, and object at any time to direct marketing. Email privacy@tracecat.com. We will respond within one month, which is the period the GDPR allows. We will not charge you or treat you differently for asking.
Complaints
You can complain to your local data protection authority. In the UK that is the Information Commissioner’s Office. We would rather you came to us first so we can put things right.
Transfers and automated decisions
Section 9 explains how we move information out of Europe. We do not make decisions about you by automated means that produce legal or similarly significant effects.
13. Changes to this policy
We may update this policy. If a change matters to you, we will give you at least 30 days’ notice by email or by a prominent notice on the site before it takes effect. This version replaces the policy dated 19 March 2024. It removes references to mobile apps, forums, precise location and advertising that never described what Tracecat does. We keep prior versions of this policy and will send you any of them on request.
14. How to contact us
Our privacy officer is Christopher Lo. You can reach us as follows.
- Email: privacy@tracecat.com
- Mail: IndexHub, Inc., 115 West 30th Street, New York, New York 10001, United States