Privacy notice

Version 6, 27 October 2026

This notice covers the Trace investor room at investors.usetrace.io. Trace Marketing Ltd (company number 17131688, registered office The Maltings, East Tyndall Street, Cardiff, Wales, CF24 5EA) is the controller. Contact: dominic@usetrace.io.

Trace's product measures journey patterns, not individuals. The investor room is different: it is how we run our fundraising and keep investors informed, so it knows who you are.

What we record

• Your email address and name, whether you invest as an angel or an institution, and your firm if you tell us it later.
• Sign in codes, stored only as a one way hash, and the time each was asked for and used.
• The investor statement you chose, your answers to it, the name you signed with and the date.
• Which documents you open, which pages you look at and for how long, and when.
• If you ask for the full data room: your request, any note you add, and our decision.
• The confidentiality undertaking you sign for the full room: its version, the name you signed with and the date.
• If we invite you: the invite, when you clicked its link and how many times, and whether you used it to sign in. We never record when you open our emails.
• If you share the room: who you shared it with, any note you added, and whether we approved it. The person you share with is told your name and sees your note; we use their email address only to send them the room.
• If someone shared the room with you: who shared it.
• Where you are in our fundraising: a stage (for example invited, meeting or committed), any amount we have discussed, and notes we keep about our conversations with you.
• Which investor updates we sent you, whether you clicked the link, and whether you read them, and whether you want update emails.
• One cookie, trace_investor_session, which keeps you signed in for 30 days. It is strictly necessary for the room to work, so it does not need your consent. We set no analytics or advertising cookies.

Every page you view carries your email address and the date as a watermark.

Why, and on what basis

• To run our fundraising and investor relations: giving you access, knowing who has read what, and following up. Our legitimate interests, which we have weighed against yours: you asked to see the room.
• To show that the room went only to investors who qualify under the Financial Promotion Order 2005: the statement records. Our legal obligations under the Financial Services and Markets Act 2000.
• To keep the room secure: sessions, the audit log and the watermark. Our legitimate interests.

Who receives it

• SendGrid (Twilio), which sends your sign in codes, invites, update emails and the emails about your access. In the United States, under its data protection addendum and the UK's transfer safeguards.
• DigitalOcean, which hosts the room, in London.
• The provider of the room's database, in London.

When you join the room or ask for the full room, the Trace team is told by email, with your name, firm and email address. We do not sell your details or share them with other investors.

How long we keep it

We keep your details while you are part of our investor relations: as a prospective investor, a shareholder or someone who receives our updates. If you ask us to remove you, we delete your details, except the statement you signed and records the law requires us to keep, such as the register of members if you become a shareholder. Those we keep only as long as that law requires.

Your rights

You can ask for a copy of your details, ask us to correct or delete them, object to how we use them, or ask us to restrict it. Email dominic@usetrace.io. You can also complain to the Information Commissioner's Office at ico.org.uk.