Legal

Privacy Policy

Last updated: 21 September 2026Effective: 21 September 2026Version 1.0

In plain language

TracePath is operated by AtlasAPX Kamil Krawczyk, a sole proprietorship registered in Poland. We are the data controller for your account, billing, support and website data.

For the telemetry your applications send us — logs, traces, metrics, exceptions, session replays, profiles — you are the controller and we are your processor. We only handle that data to run the Service for you, under the Data Processing Addendum.

All production data is stored on servers in Helsinki, Finland (EU). We do not sell personal data, and we do not use your telemetry to train models or to build advertising profiles.

You can reach us about anything in this policy at [email protected].

This summary is for orientation only. The numbered sections below are the binding text.

1.Who we are

TracePath is an OpenTelemetry-native observability platform operated by the entity below (“TracePath”, “we”, “us”, “the Operator”). This policy explains how we handle personal data in connection with the websites at tracepath.dev, the application and API at app.tracepath.dev, the telemetry endpoint at ingest.tracepath.dev and the documentation at docs.tracepath.dev (together, the “Service”).

Operator: AtlasAPX Kamil Krawczyk
Legal form: Sole proprietorship (jednoosobowa działalność gospodarcza) registered in CEIDG, Poland
Address of record (CEIDG / VAT register): Poland (address of record: public CEIDG entry for NIP 8291758710)
NIP / EU VAT: 8291758710 / PL8291758710
REGON: 543625923
Privacy contact: [email protected]

We have not appointed a Data Protection Officer. Polish and EU law do not require one for an operation of our size and processing profile. Privacy questions go to a monitored mailbox and are answered by the Operator personally. Full company details are on the legal notice page.

2.Our two roles: controller and processor

TracePath handles two very different categories of data, and the law treats them differently. Reading this section first makes the rest of the policy much shorter.

We are the controller for our own data

When you visit our website, create an account, pay us, contact support or receive our service emails, we decide why and how that data is processed. We are the controller, and section 3 is the Article 13/14 notice for it.

You are the controller for the telemetry you send

When your applications send logs, traces, metrics, exception reports, session replays, profiles or synthetic monitor results to TracePath, we store and process that content on your instructions only. You decide what your applications transmit. If it contains personal data about your own users or employees, you are the controller and we are your processor.

Note

Telemetry is not a safe category by default. Request URLs, log lines, headers, exception messages and session replays routinely carry IP addresses, user identifiers, email addresses and sometimes free-text content. Decide deliberately what your SDKs send, use the masking and scrubbing options in the documentation, and record that decision in your own records of processing.

Our obligations as your processor are set out in the Data Processing Addendum, which forms part of your contract with us and incorporates the European Commission’s Standard Contractual Clauses where they are needed.

3.Personal data we process as controller

The table below is our notice under Articles 13 and 14 of the GDPR. “Legitimate interests” entries state the interest we rely on; you can object to those under section 11.

Personal data processed by TracePath as controller.
What	Why	Legal basis	Kept for
Account data Name, email address, hashed password, email verification status, organisation name, role and team memberships, avatar URL, time zone preference.	Creating and running your account, authenticating you, showing you the right projects and permissions.	Performance of a contract (Art. 6(1)(b)).	For the life of the account, then deleted as described in section 9.
Authentication and security data Two-factor authentication secrets and recovery codes, session and refresh tokens, personal access token hashes, sign-in attempt counters and lockout state, password-reset tokens, OAuth provider identifiers when you sign in with Google or GitHub.	Signing you in, keeping your account secure, detecting and blocking credential-stuffing and brute-force attempts.	Performance of a contract (Art. 6(1)(b)) and our legitimate interest in the security of the Service (Art. 6(1)(f)).	For the life of the account; short-lived tokens expire automatically and are purged.
Billing data Billing contact name and email, company name, VAT identification number, billing country and address, chosen plan, subscription status and period, invoice history, Stripe customer and subscription identifiers.	Charging for paid plans, issuing invoices, handling refunds and disputes, meeting our tax and accounting duties.	Performance of a contract (Art. 6(1)(b)) and compliance with a legal obligation (Art. 6(1)(c)) for accounting records.	Invoices and accounting records: as required by Polish tax law, currently five years from the end of the tax year in which the tax fell due.
Usage and quota data Ingest volume per organisation and billing period, project and seat counts, monitor counts, quota warning and suspension events.	Enforcing plan limits, warning you before you run out of quota, billing and capacity planning.	Performance of a contract (Art. 6(1)(b)).	For the life of the account plus the current and previous billing periods.
Support and sales correspondence Your messages to our mailboxes, our replies, and any context you choose to include.	Answering your questions, investigating incidents you report, and handling complaints.	Performance of a contract (Art. 6(1)(b)) where you are a customer; otherwise our legitimate interest in responding to enquiries (Art. 6(1)(f)).	Up to three years from the last message, unless a dispute or a legal claim requires longer.
Service email Email address and delivery metadata for verification, password reset, invitations, alerts, on-call notifications and quota warnings.	Sending the transactional messages the Service depends on.	Performance of a contract (Art. 6(1)(b)).	Delivery metadata is kept for troubleshooting for a short period; content is not retained beyond delivery except in your own account records.
Operational logs of the Service itself IP address, user agent, timestamps, requested endpoints and status codes for requests to our websites, API and ingest endpoint; records of administrative actions taken by the Operator.	Keeping the Service available, diagnosing faults, rate limiting, detecting abuse, and creating an audit trail of administrative access.	Legitimate interest in operating and securing the Service (Art. 6(1)(f)).	Operational logs are kept for no longer than needed to run and secure the Service; administrative audit records are retained for the life of the account.
Website analytics Pseudonymous usage statistics for tracepath.dev and marketing attribution parameters (utm_*).	Understanding which pages and campaigns are useful.	Consent (Art. 6(1)(a)), given through the banner and withdrawable at any time.	See the Cookie Policy. Attribution parameters expire after 30 days.

Providing account and billing data is necessary to enter into and perform the contract. If you do not provide it, we cannot give you an account or a paid plan. Everything else is optional.

We do not knowingly process special categories of personal data (Article 9) about our own users, and we ask you not to send such data as telemetry unless you have a lawful basis for it and have agreed the necessary safeguards with us.

4.Customer telemetry: our role as processor

The Service accepts OpenTelemetry data over OTLP at ingest.tracepath.dev and through our SDKs. Depending on what you instrument and what you choose to send, telemetry may include:

Traces and spans — operation names, timings, service and resource attributes, and any span attributes your code sets, which can include user identifiers, request paths and query parameters.
Logs — log bodies and attributes exactly as your application emits them.
Metrics — numeric series and their label sets.
Exceptions and stack traces — error messages, stack frames, source context, and breadcrumbs or request context attached by the SDK.
Session replay — recordings of DOM mutations and user interaction in your application’s front end. This is the highest-risk category: unless you configure masking, replays can capture text that users type and content displayed to them.
Profiles — CPU and memory profiling samples and stack information.
Synthetic monitor results and status pages — the responses of endpoints you ask us to check, and any incident or post-mortem text you write.
AI and LLM traces — model call metadata and, if you choose to record them, prompt and completion content.

We process this content solely to provide the Service to you: storing it, indexing it, making it searchable and visualisable in your dashboards, evaluating your alert and monitor rules, delivering notifications you configure, and deleting it when the retention period for your plan expires.

What we do not do

We do not sell your telemetry or any personal data in it.
We do not use your telemetry to train machine-learning models, ours or anybody else’s.
We do not use your telemetry for advertising or profiling.
We do not access the contents of your projects except when you ask us to help with a specific problem, or when it is strictly necessary to keep the Service running or to respond to a security incident. Administrative access is recorded.

Retention of telemetry

Telemetry is deleted automatically when the retention period for your plan expires. See section 9 and the plan comparison.

Requests from your users

If one of your end users asks us directly to access or delete data held in your projects, we will not act on it ourselves. We will tell them to contact you, and we will let you know. As controller, the decision is yours, and we will assist you as set out in the DPA.

5.Website, cookies and analytics

Our marketing website is a static site. It does not require an account and does not place any advertising or cross-site tracking technology.

We store a small amount of information in your browser: a record of your choice in the consent banner, and — only if you accept analytics — marketing attribution parameters and the cookies set by the analytics provider we have enabled. Nothing beyond the consent record is stored or read until you accept.

The Cookie Policy lists every item by name, says what it is for, how long it lasts and how to withdraw consent.

6.Where the data comes from

From you — when you fill in a form, create an account, write to us or configure the product.
From your use of the Service — server logs, usage counters and security events generated automatically as you use it.
From your applications — telemetry your systems transmit to us.
From a colleague — if someone invites you to their organisation, we receive your email address from them in order to send the invitation. This is the Article 14 case: the source is the inviting organisation.
From an identity provider — if you sign in with Google or GitHub, we receive your account identifier, email address, name and avatar URL from that provider.
From Stripe — subscription and payment status, and the billing details you gave to Stripe.

We share personal data only with the service providers we need to run TracePath, and only to the extent each one needs. Every one of them acts as our processor (or, for your telemetry, as our sub-processor) under a written agreement containing the terms required by Article 28 GDPR.

The current list — name, purpose, data, location and transfer mechanism — is published and kept current on the subprocessors page. We give customers at least 30 days’ notice before a new subprocessor starts processing customer data, and you may object as described in the DPA.

All production systems that hold account data and telemetry run on infrastructure provided by Hetzner Online GmbH in Helsinki, Finland (EU).

We may also disclose personal data:

to professional advisers (accountant, lawyer) bound by confidentiality, where necessary for our own tax, accounting or legal purposes;
where we are legally required to, such as in response to a valid, binding order from a competent authority. We assess every request, disclose no more than is required, and notify the affected customer unless we are legally prohibited from doing so;
to an acquirer, if the business is sold or reorganised — in which case we will tell you before your data becomes subject to a different privacy policy, and you may terminate.

We do not sell personal data and we do not share it with data brokers.

8.International transfers

Account data and telemetry are stored in the EU. Some of the providers listed on the subprocessors page — notably Cloudflare, Stripe, Resend and, if you use them, Google and GitHub sign-in — are established in or operate from the United States.

Where personal data is transferred outside the EEA, we rely on:

the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914), in the module appropriate to the relationship; and/or
the European Commission’s adequacy decision for the EU–US Data Privacy Framework, where the recipient is certified under it.

The Data Privacy Framework adequacy decision is in force, but its foundations have been litigated and criticised. For that reason we do not rely on it alone: our subprocessor arrangements also carry Standard Contractual Clauses, so a transfer mechanism remains in place if the adequacy decision is suspended or annulled. You can request a copy of the transfer documentation for any subprocessor at [email protected].

9.How long we keep personal data

Data	Retention
Account and organisation data	For as long as the account exists.
Telemetry (logs, traces, metrics, exceptions, replays, profiles)	Automatically deleted when the retention period of your plan expires. Retention is enforced by the storage layer itself, not only by the application; its clean-up runs in the background, so removal follows expiry within hours rather than to the second.
Session replay recordings	Deleted on the same schedule as other telemetry; stored recordings are also swept from disk by a scheduled cleanup job.
Invoices and accounting records	As required by Polish tax law — currently five years from the end of the tax year in which the tax became due. These survive account deletion because we are legally required to keep them.
Support correspondence	Up to three years from the last message, unless needed longer for a dispute.
Security and administrative audit records	For the life of the account, and afterwards only where needed to establish, exercise or defend a legal claim.
Consent record in your browser	Until you clear your browser storage, or 30 days for attribution parameters.

After you terminate, you have 30 days to retrieve your data or to ask us for an export. We delete customer telemetry and account data within 60 days of the end of the contract, except for the records we are legally required to retain.

10.How we protect personal data

We apply technical and organisational measures appropriate to the risk, including encryption in transit, hashed credentials, multi-factor authentication, role-based access control, tenant isolation enforced at the query layer and verified by an automated test suite, rate limiting, and an audit trail of administrative actions.

The security page describes the controls that are actually implemented, in detail and without marketing claims. The same list appears as the technical and organisational measures annex to the DPA.

If we become aware of a personal data breach, we will notify the supervisory authority within 72 hours where the GDPR requires it, notify affected customers without undue delay, and give them the information they need to meet their own notification duties. Report a suspected vulnerability or breach to [email protected].

11.Your rights

Where we are the controller, you have the following rights under the GDPR. They are free to exercise, and we answer within one month — extendable by two further months for complex requests, in which case we will tell you.

Access — a copy of the personal data we hold about you and the information in this policy.
Rectification — correction of inaccurate or incomplete data. Most account fields you can change yourself in the dashboard.
Erasure — deletion, where we no longer need the data, you withdraw consent, or you successfully object. This does not extend to records we must keep for tax or legal reasons.
Restriction — to have processing paused while a dispute about accuracy or legitimate interests is resolved.
Portability — the data you provided to us, in a structured, machine-readable format, where processing is based on consent or contract.
Objection — to processing based on our legitimate interests, on grounds relating to your situation. We will stop unless we can show compelling legitimate grounds that override your interests.
Withdrawal of consent — at any time, without affecting the lawfulness of what we did before. For analytics, withdraw it in the consent banner or by clearing the stored choice as described in the Cookie Policy.

Write to [email protected]. We may need to verify your identity before acting, and we will only ask for what is necessary to do so.

If your data is in a customer's project

If you are an end user of a company that uses TracePath, that company is the controller of the telemetry about you. Send your request to them. If you send it to us, we will forward it and tell you we have done so — we cannot decide it on their behalf.

12.Complaints

If you think we have handled your personal data wrongly, please tell us first at [email protected] — we would rather fix it than argue about it.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your residence, place of work or the place of the alleged infringement. Our lead supervisory authority is:

Authority: President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO)
Address: ul. Stawki 2, 00-193 Warsaw, Poland
Website: uodo.gov.pl

Contractual complaints about the Service itself — rather than about personal data — follow the complaint procedure in the Terms of Service.

13.Automated decision-making

We do not make decisions producing legal effects about you, or similarly significantly affecting you, based solely on automated processing.

The Service does apply automated rules to your own account: quota counters trigger a warning email at 80% of your monthly ingest allowance and pause ingest at 100% until the next period or an upgrade; repeated failed sign-ins temporarily lock an account; and automated abuse controls may rate-limit requests. These are contractual and security measures with a human reachable at [email protected], not profiling.

14.Children

TracePath is a business tool. It is not directed at children and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, write to [email protected] and we will delete it.

15.Changes to this policy

We will update this policy when the Service or the law changes. The version and dates at the top always reflect the current text. If a change materially affects your rights or how we use your personal data, we will notify account holders by email at least 30 days before it takes effect.

16.Contact

Privacy: [email protected]
Security: [email protected]
Support: [email protected]
Post: AtlasAPX Kamil Krawczyk, Poland (address of record: public CEIDG entry for NIP 8291758710)

More legal documents: Legal & trust centre.