Privacy Policy

1. Who we are

TraccoAI (“TraccoAI”, “we”, “us”, or “our”) operates the website at traccoai.comand the related software service that tracks brand visibility across AI assistants (the “Service”).

TraccoAI is currently operated by its founder as an individual sole operator while a formal commercial entity is being established in the United Arab Emirates. Once that entity is registered, this Policy will be updated with the registered legal name, trade licence number, and licensing authority, and that entity will become the “Data Controller” responsible for your personal data.

For any privacy matter, you can contact us at support@traccoai.com.

2. Scope

This Policy applies to personal data we process about visitors to our website, registered account holders, and people who contact us. It should be read together with our Terms of Service, Cookie Policy, and Refund & Cancellation Policy.

3. Personal data we collect

We limit collection to what we need to provide the Service:

• Account data. Your email address, and authentication metadata generated when you sign in using a magic link (for example, sign-in timestamps and session identifiers).
• Service content. The brand names, competitor names, and prompts you choose to add, together with the scan results, snapshots, and reports we generate for you. Please do not enter personal data of third parties into prompts unless you are permitted to do so.
• Billing data. Payments are processed by our payment provider acting as Merchant of Record (see Section 6). We do not receive or store your full card number. We receive limited billing metadata such as your name, billing country, the last four digits of your card, plan, and subscription status.
• Technical data. IP address, browser and device type, and similar technical information collected automatically through essential cookies and server logs. See our Cookie Policy.
• Communications. Any information you provide when you email us or respond to our messages, and your preferences for the weekly email digest.

We do not intentionally collect special categories of personal data (such as data revealing health, religious beliefs, or political opinions) and ask that you do not submit such data through the Service.

4. How we use your data and our legal bases

Under the UAE PDPL we process personal data only where we have a lawful basis. We rely on the following bases:

• Performance of a contract — to create and manage your account, run scans, generate reports, and provide the Service you have subscribed to.
• Your consent — to send you the optional weekly email digest and any marketing messages. You may withdraw consent at any time.
• Our legitimate interests — to secure and improve the Service, prevent abuse and fraud, and communicate important service notices, provided these interests are not overridden by your rights.
• Legal obligation — to comply with applicable UAE law, including tax, accounting, and lawful requests from competent authorities.

5. Cookies and similar technologies

We use a small number of essential cookies that are necessary to keep you signed in and to keep the Service secure. We do not use advertising cookies. Full details are in our Cookie Policy.

6. Service providers and disclosures

We share personal data with trusted service providers (data processors) who process it on our behalf and under contract. These currently include:

• Supabase — database hosting and authentication.
• Vercel — application hosting and content delivery.
• Upstash — scheduling of background scan jobs.
• Resend — sending sign-in, transactional, and digest emails.
• Dodo Payments — our payment provider, acting as Merchant of Record, who processes your payment and handles billing, invoicing, and applicable taxes.
• AI / large language model providers (currently OpenAI, Anthropic, and Perplexity) — the prompt text you configure is sent to these providers so we can measure whether your brand appears in their responses. We do not send your account or billing data to these providers.

We do not sell your personal data. We only disclose it to third parties as described here, with your consent, or where required to comply with the law or protect our legal rights.

7. International transfers

Some of our service providers store and process data on servers located outside the UAE. Where we transfer personal data across borders, we do so in accordance with Articles 22 and 23 of the UAE PDPL — either to jurisdictions recognised as providing an adequate level of protection, or subject to appropriate contractual safeguards that require the recipient to protect your data to a standard consistent with UAE law.

8. Data retention

We keep personal data only for as long as necessary for the purposes described in this Policy. Account and Service content is retained while your account is active. If you close your account, we delete or anonymise your personal data within a reasonable period unless we are required to retain certain records (for example, billing and tax records) for the period required by UAE law.

9. Data security

We apply appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, and row-level data isolation between accounts. No method of transmission or storage is completely secure, but we work to protect your data and to notify you and the relevant authority of a personal data breach where required by the PDPL.

10. Your rights

Subject to the UAE PDPL, you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request deletion of your data in certain circumstances;
• restrict or object to certain processing;
• request a portable copy of data you provided to us;
• withdraw consent at any time, without affecting prior lawful processing; and
• stop the processing of your data for direct marketing.

To exercise any of these rights, email support@traccoai.com. We will respond within the timeframes set out in the PDPL. If you are not satisfied with our response, you may lodge a complaint with the UAE Data Office.

11. Children

The Service is intended for business users and is not directed to anyone under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us so we can delete it.

12. Changes to this Policy

We may update this Policy from time to time. We will post the updated version here and change the “Last updated” date above. Material changes will be communicated by email or an in-product notice where appropriate.

13. Contact

Questions about this Policy or our handling of your personal data can be sent to support@traccoai.com.