Privacy Policy

1. Who we are & what this policy covers

The Tracehold browser extension and this website are operated by TraceHold B.V. ("Tracehold", "we", "us"), formerly Verifia, established in the European Union at Werfkade 25, 1033 TA Amsterdam, Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 97572896, VAT number NL868118278B01.

This policy covers:

• the free Tracehold browser extension distributed through the Chrome Web Store and other browser stores;
• this website, tracehold.com, including its contact forms; and
• the managed Tracehold service that organisations buy under our paid Insight and Governance plans.

Our role depends on the data:

• Tracehold is the controller of the personal data from this website, our business contacts, the usage statistics of the free extension and the optional uninstall survey.
• Tracehold is a processor of the data an organisation processes through its managed deployment, including the accounts of the people who use its console. In that case the organisation is the controller, your employer's privacy notice applies, and our Data Processing Agreement governs. Section 4 describes what the managed product sends so that you have the full picture.

For the paid (enterprise) browser extension, which is installed and configured by your organisation, see the dedicated Privacy Policy for the TraceHold Browser Extension (Enterprise).

Our data protection contact can be reached at dpo@tracehold.com.

2. What the extension does

Tracehold helps prevent sensitive information, such as passwords, API keys, source code, personal data, financial details and confidential documents, from being shared with AI tools such as ChatGPT, Claude, Gemini and Copilot. When you are about to send something to an AI tool, the extension checks it in your browser, before it is sent, and can warn you, redact the sensitive part, or block the action according to the active policy. If nothing sensitive is found, the message goes through unchanged.

3. Data the extension accesses in your browser

To do its job, the extension needs to read certain things locally, in your browser. Reading is not the same as collecting: the items below are analysed in your browser, and their content is not transmitted to us by the free extension (except for the fragments you choose to send in a report, see section 4). Only the limited statistics described in section 4 are sent (they include, for example, the domain of the AI tool you are using, but never the content itself).

• Text you enter into AI tools: the prompts, messages and text fields you are about to submit. This is inspected in the browser to detect sensitive content. The text itself is not sent to Tracehold, apart from the reports you choose to send (section 4).
• Files you choose to scan: if you ask the extension to check a file (for example a document or image), it is read locally to detect sensitive content and then discarded. The file is not kept or uploaded.
• The website you are on: the extension needs to know when you are on an AI tool so that it can activate. It uses this only to decide whether and how to run; it does not build a browsing-history profile.
• Your local settings: your preferences (for example which warnings you have dismissed) are stored in your browser using the extension storage.

4. What we collect, and what we don't

Free extension

The free Tracehold extension does not require an account and does not transmit the content of your prompts, messages or chats, the contents of files you scan, or your browsing history (except for the fragments you choose to send in a report, see below). It does not ask for your name or email; the only place where you can type an email address is the optional survey shown when you uninstall (see below).

Usage statistics. The free extension talks to our server at app.tracehold.com. It sends a statistics ping at most once every 12 hours and, only if there was activity, batches of scan events about every 2 minutes. Each request carries a randomly generated installation identifier (created at install; it identifies the installation, not you; it is kept across reinstalls), the date, the extension version and the browser type. Scan events also carry the domain of the AI tool, the action (allowed, detected only or blocked), the name, category and severity of the detection rule that fired, the detection layer and counts of findings. Like any web request, a request reaches our server together with your IP address; we do not store the address itself but a cryptographic hash of it. Because the installation identifier and the hash are stable, we treat this data as pseudonymous personal data, not as anonymous data. It never contains the text of your prompts, messages or files, or the value that was detected.

False-positive reports. If you press the false-positive button, we also receive the rule that fired, the AI domain, a masked fragment of the detected value (never the full text), an optional note you may write, your browser type and the IP hash.

Missed-detection reports. If you open the highlight panel and press "Is anything missing?" (shown in the extension, in Spanish, as «¿Falta algo por detectar?»), select words from your text and press Send, we receive the words you selected (up to 200 characters, not masked), the AI domain, your browser type and the IP hash. Nothing is sent unless you press Send, so select only text you are happy for us to see.

Service configuration. On install and at browser start the extension fetches its service configuration (it only discovers service addresses and sends no identifiers).

Uninstall. When you uninstall, your browser opens a page on app.tracehold.com with an optional short survey (rating, reason, free comment and, if you wish, an email address). Nothing is stored unless you submit it; if you do, we store your answers together with the IP hash (the free extension sends no browser type or identifier with the survey).

Managed deployments (Insight / Governance)

When an organisation deploys Tracehold centrally, the product sends event data to that organisation's Tracehold backend, which Tracehold hosts, so that its security and compliance teams can act on risk. By default this is:

• the type of sensitive data found (for example "an API key"), its severity, the action taken and the time;
• the AI tool or site involved, including the page address, and the browser;
• the identifiers of the user and device that the organisation has enrolled, for example work email, operating-system user name, computer name, directory domain and installation identifiers; for endpoint agents also the device's IP address and the name of the process;
• a masked sample of the detected value: values of up to 12 characters are masked completely; longer values show only the first 8 and the last 4 characters; and
• for endpoint agents, an excerpt of the text with the sensitive values masked.

The console derives risk scores per user and per organisation from these events. The organisation, as controller, is responsible for informing its staff about this monitoring and, where required, its works council.

The text of a prompt reaches Tracehold only if an optional feature has been switched on for your organisation. All of them are off by default and Tracehold never switches one on on its own initiative: they are switched on at the organisation's request, with its data protection impact assessment confirmation, by its administrators or by Tracehold staff acting on its documented instruction, and every change is recorded in the activity log.

• LLM classifier (Governance plan, beta): the text, the recent context of the conversation and, to keep that context short, older messages of the same conversation for summarising, travel in transit to the classifier operated by OVHcloud; where the organisation has also enabled endpoint interception, the text extracted from files and images is sent too. Tracehold does not store it.
• Keeping the content of findings: the original text around a finding, a fragment of the conversation (browser extension) or of the request or response (endpoint agents), is stored encrypted at the application level and deleted after 90 days. A version with the sensitive values masked is stored with it, which authorised console users can see without the reveal permission. The original is revealed only through a specific permission (or, for an incident reported as a false positive, to administrators and managers), and every reveal is logged.
• File fallbacks: a file is sent to the Tracehold backend, which reads it, returns the findings and does not store it.

A further optional feature, third-party extension management, lets the organisation see which other browser extensions are installed in its monitored browsers. It is also off by default.

These features are decided by the organisation, as controller; Tracehold only switches them on on its documented instruction.

5. Browser permissions we request, and why

The extension requests only the permissions it needs to function. Each is used solely for the purpose described, never to collect data for any unrelated reason. The exact permissions are listed on the store page and in the extension's manifest; they are:

• Access to websites (host and content-script permissions): the extension is loaded on every website you visit so that it can recognise AI tools, including new ones that are not yet in its catalogue; your browser may describe this as "read and change your data on all websites". The detection engine only starts when the site address matches a recognised AI tool; on any other site the extension stops immediately and does not read the page. Requests to *.tracehold.com carry the statistics described in section 4.
• Storage: to keep your settings and counters in your browser.
• Notifications: to tell you when a send is blocked and to warn you about risky downloads.
• Alarms: to schedule the statistics ping and the batches of scan events.
• Downloads (Chrome only): a read-only notice when you download a file from a recognised AI site; the extension never pauses, cancels or deletes a download.
• Offscreen (Chrome only): runs the local analysis in a background page, as Chrome requires.

We do not request permissions for advertising, tracking, or any purpose unrelated to data-loss prevention.

6. This website, contact forms & cookies

Contact forms. You can write to us through the contact form (name, work email, company, role, company size, country, optional phone number, reason, plan of interest, channels and message) or through the short form shown at the foot of many pages, which asks only for your email address. We use these data only to answer your enquiry and to manage the commercial relationship that may follow. Our legal basis is taking steps at your request before a possible contract (Article 6(1)(b) GDPR) or, otherwise, our legitimate interest in answering business enquiries (Article 6(1)(f) GDPR).

Where it goes. A submission is sent by email to our own mailbox, on our own mail server (Mailcow), which is hosted by Contabo in the European Union. It is not saved in any database. We keep the email for as long as it is needed to answer your enquiry and manage any resulting commercial relationship. The contact-form service's server logs (which include your IP address and email address) are kept for up to 90 days. Our mail server also keeps its standard delivery logs (sender and recipient addresses, delivery status and connecting IP); they are rotated automatically by size and, at current volumes, kept for less than 90 days. We also send you an automatic acknowledgement of receipt that includes a copy of what you wrote.

Server logs. The service that receives the form records in the server's system logs the IP address of the request and, for a successful submission, the company name and email address you entered (for the short form, the email address). It does not log the text of your message. We have not set a deletion schedule for these log entries: the system journal is limited by size, not by time, and currently holds entries going back several months, while the copy in the syslog files is rotated weekly and kept for about a month. Our web server does not keep access logs.

Bot protection. The contact form uses Cloudflare Turnstile, provided by Cloudflare, Inc. (United States), to tell people from bots. Cloudflare receives your IP address and signals from your browser. The transfer relies on the EU-US Data Privacy Framework, in which Cloudflare, Inc. participates. The short form at the foot of pages has no Turnstile check; its notification email to us includes your IP address. See the Subprocessors page.

Cookies and local storage. This website sets no cookies. It stores a single item, th_lang, in your browser's local storage, and only if you use the language switcher or answer the language suggestion; it keeps your language choice. On the contact page only, the Cloudflare Turnstile widget runs inside a frame served by Cloudflare and may store a technical item (cf.turnstile.u) in your browser's local storage for its own operation; it sets no cookies.

7. How we use information

• Free extension: to run the free service, to measure how it is used (usage statistics), to deal with the false-positive reports you send and to understand why people uninstall. Our legal basis is our legitimate interest in operating and improving the free extension (Article 6(1)(f) GDPR); the survey and the reports are voluntary.
• Managed deployments: only to provide the service the organisation subscribed to: to detect and prevent sensitive data from reaching AI tools and to give the organisation the audit trail and compliance reporting it needs.
• This website: to answer enquiries, as described in section 6.

We do not use your information for any other purpose.

8. Sharing & disclosure

• We do not sell your data. Ever.
• We do not share your data with advertising or data-broker networks, and we do not use it for ad targeting or to assess creditworthiness or lending.
• We do not use your data to train AI or machine-learning models.
• Managed deployments: event data is made available to the organisation that deployed Tracehold (the controller), as described in section 4.
• Service providers: we use Contabo for hosting; OVHcloud, only if the optional LLM classifier has been switched on for an organisation; Cloudflare, for the bot protection of the contact form on this website; and Vercel, which only redirects www.tracehold.com to this website. The current list, with locations, is on the Subprocessors page.
• Legal: we may disclose information if required by law, or to protect the security, rights or safety of users and the public.

9. Chrome Web Store: Limited Use disclosure

Tracehold's use of information received from Google APIs, and any data the extension accesses, adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements. Specifically:

• we collect and use data only to provide and improve the extension's single purpose: data-loss prevention;
• we do not sell this data, and we do not transfer or use it for personalised advertising, creditworthiness, or lending;
• we do not transfer this data to third parties except as needed to provide the single purpose, for security, or to comply with the law; and
• we do not allow humans to read your data, except with your affirmative consent, where necessary for security or to comply with applicable law, or where the data has been aggregated and anonymised.

10. Data retention & deletion

Free extension, in your browser: the extension keeps its settings and counters, its installation identifier and a short queue of statistics events not yet sent. You can clear them at any time. Uninstalling removes the local copy, but the block counter and the installation identifier are also kept in your browser's own sync storage (synchronised by your browser account, not by Tracehold), so they can be restored if you reinstall the extension. Prompt content and files are never stored.

Free extension, on our servers: usage statistics are kept for as long as they remain necessary to produce usage statistics. The text fragment of a false-positive or missed-detection report is deleted automatically after 90 days; the other fields of a report (rule, domain, note, browser type, IP hash) are kept as long as they are needed to improve detection. Uninstall-survey answers are kept for as long as they are needed to understand and improve the free extension.

Managed deployments: Tracehold applies these platform-wide default periods: event records 365 days; masked samples and any kept content 90 days (the record stays, the content is removed); endpoint-agent telemetry 90 days; browser-installation records 180 days after their last activity; the console activity log, including the IP address, 30 days (older entries are removed whenever the service starts). These are the automatic purges: other derived records, such as the history of risk scores and incident reports, are not purged automatically and are deleted under the end-of-contract rule or on the organisation's request. The periods are the same for all organisations. When the contract ends, an organisation's data is deleted at its request within a maximum of 30 days. Requests to access or delete data go to your organisation as controller; we assist it as processor.

Website: see section 6.

11. Security

Security is built into the product. The free extension analyses prompts in your browser. In the managed service, data travels over HTTPS; the raw content of findings that your organisation keeps and the stored secrets of LDAP, OIDC and SIEM integrations are encrypted at the application level with AES-256-GCM; for signed-in users and API keys each organisation's data is separated by organisation and the database enforces it with Row-Level Security; the detection rules the paid extension downloads travel over HTTPS and their integrity is verified before use; and revealing kept content needs a specific permission and is logged. You can read more on our Security page.

12. Where your data lives

Tracehold's servers, including app.tracehold.com and this website, are hosted in the European Union by Contabo GmbH. Three providers apply under specific conditions:

• OVHcloud AI Endpoints, only if the optional LLM classifier has been switched on for an organisation: the text, the recent context of the conversation, older messages sent for summarising and, where endpoint interception is enabled, text extracted from files are sent in transit for classification. OVHcloud states publicly that its AI Endpoints are hosted in France and that it does not retain the data or use it for training; these are OVHcloud's own public statements.
• Cloudflare, Inc. (United States), for the bot protection of the contact form on this website, as described in section 6. The transfer relies on the EU-US Data Privacy Framework.
• Vercel Inc. (United States), for the address www.tracehold.com. Requests to www.tracehold.com are answered by Vercel Inc., which only redirects to tracehold.com (it receives the IP address and the requested address). The transfer relies on the EU-US Data Privacy Framework.

13. Your rights (GDPR and similar laws)

Where we process your personal data, you have the right to access, rectify, erase, restrict or object to that processing, and to data portability, subject to applicable law.

• For the free extension and for website enquiries, write to privacy@tracehold.com. Where data is held only against a random installation identifier or an IP hash, we may not be able to link it to you, and we will tell you what we can and cannot identify as yours.
• For managed deployments, your employer is the controller; please direct rights requests to it, and it will instruct us as its processor.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or with the data protection authority of your country.

14. Children & professional use

Tracehold is a workplace security tool intended for organisations and professionals. It is not directed to children, and not to anyone under 16, and we do not knowingly process their personal data.

15. Changes to this policy

We may update this policy as the product evolves. When we do, we will revise the "Last updated" date above, and for material changes we will provide a more prominent notice (for example, in the extension or on this page).

16. Contact us

Questions about privacy, or want to exercise a right?

• Privacy enquiries: privacy@tracehold.com
• Data protection contact: dpo@tracehold.com
• General: hello@tracehold.com
• Post: TraceHold B.V., Werfkade 25, 1033 TA Amsterdam, Netherlands (KvK 97572896, VAT NL868118278B01)

Related pages: Security, Terms, DPA and Subprocessors.