Privacy Policy

1. Who we are & what this policy covers

The Tracehold browser extension and this website are operated by Tracehold B.V. ("Tracehold", "we", "us"), formerly Verifia, established in the European Union at Werfkade 25, 1033 TA Amsterdam, Netherlands.

This policy covers:

• the free Tracehold browser extension distributed through the Chrome Web Store and other browser stores; and
• this website, tracehold.com.

When Tracehold is deployed and centrally managed by an organisation (our paid Insight and Governance plans), that organisation is the data controller for the information processed through its deployment, and Tracehold acts as its processor under a Data Processing Agreement (DPA). In that case, your employer's privacy notice and the DPA govern; the section below describes what the managed product sends so you have the full picture.

2. What the extension does

Tracehold helps prevent sensitive information — passwords, API keys, source code, personal data, financial details, confidential documents — from being shared with AI tools such as ChatGPT, Claude, Gemini and Copilot. When you are about to send something to an AI tool, the extension checks it on your device, before it leaves the browser, and can warn you, redact the sensitive part, or block the action according to the active policy.

3. Data the extension accesses on your device

To do its job, the extension needs to read certain things locally, on your device. Reading is not the same as collecting: the items below are analysed in your browser and are not transmitted to us by the free extension.

• Text you enter into AI tools and web pages — the prompts, messages and text fields you are about to submit. This is inspected on the device to detect sensitive content. The text itself is not sent to Tracehold.
• Files you choose to scan — if you ask the extension to check a file (e.g. a document or image), it is read locally to detect sensitive content and then discarded. The file is not kept or uploaded.
• The website you are on — the extension needs to know when you are on an AI tool so it can activate. It uses this only to decide whether and how to run; it does not build a browsing-history profile.
• Your local settings — your preferences (e.g. which warnings you have dismissed) are stored on your device using the browser's extension storage.

4. What we collect — and what we don't

Free extension

The free Tracehold extension is designed to run entirely on your device. It does not require an account and, by default, does not transmit any of the following to Tracehold:

• the content of your prompts, messages or chats;
• the contents of files you scan;
• your browsing history;
• names, emails or other personal identifiers.

If we ever introduce optional, privacy-preserving diagnostics (for example, anonymous crash reports), they will be off by default, clearly explained, and described here before they are enabled.

Managed deployments (Insight / Governance)

When an organisation deploys Tracehold centrally, the product sends a small amount of detection metadata to that organisation's Tracehold backend so security and compliance teams can act on risk. This metadata is limited to:

• the type of sensitive item detected (e.g. "an API key") — not the value itself;
• the severity of the finding and a timestamp;
• the AI tool or site involved and the user/account it relates to, for the organisation's audit trail.

Even in managed deployments, the prompt itself does not leave the browser by default. On desktop endpoints, an organisation may choose to retain the exact text behind an alert so an admin can tell a real leak from a false alarm; where that option is enabled, the text is encrypted and can only be revealed through an audited, permission-controlled action. These behaviours are configured by the organisation, not by Tracehold.

5. Browser permissions we request — and why

The extension requests only the permissions it needs to function. Each is used solely for the purpose described, never to collect data for any unrelated reason. The exact permissions are listed on the Chrome Web Store page and in the extension's manifest; typically they include:

• Access to AI tool sites (host permissions) — so the extension can detect sensitive content on the AI pages you use. Used only to run detection on those pages.
• Reading the active page / scripting — to inspect the text you are about to submit and to show in-page warnings or redaction.
• Storage — to save your settings locally on your device.
• Notifications (if requested) — to alert you when something sensitive is caught.

We do not request permissions for advertising, tracking, or any purpose unrelated to data-loss prevention.

6. How we use information

Information processed by the extension is used for one purpose only: to detect and prevent sensitive data from leaving your browser, and — in managed deployments — to give the deploying organisation the audit trail and compliance reporting it needs. We do not use your information for any other purpose.

7. Sharing & disclosure

• We do not sell your data. Ever.
• We do not share your data with advertising or data-broker networks, and we do not use it for ad targeting or to assess creditworthiness or lending.
• We do not use your data to train AI or machine-learning models.
• Managed deployments: detection metadata is made available to the organisation that deployed Tracehold (the data controller), as described in §4.
• Service providers: where we use infrastructure providers to run the managed service, they act on our instructions under contract, within the EU, and only to the extent needed to provide the service.
• Legal: we may disclose information if required by law, or to protect the security, rights or safety of users and the public.

8. Chrome Web Store — Limited Use disclosure

Tracehold's use of information received from Google APIs, and any data the extension accesses, adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements. Specifically:

• we collect and use data only to provide and improve the extension's single purpose — data-loss prevention;
• we do not sell this data, and we do not transfer or use it for personalised advertising, creditworthiness, or lending;
• we do not transfer this data to third parties except as needed to provide the single purpose, for security, or to comply with the law; and
• we do not allow humans to read your data, except with your affirmative consent, where necessary for security or to comply with applicable law, or where the data has been aggregated and anonymised.

9. Data retention & deletion

Free extension: the only data it keeps is your local settings, stored on your device. You can clear it at any time, and uninstalling the extension removes it. Because prompt content and files are never stored, there is nothing on our side to delete.

Managed deployments: detection metadata is retained according to the deploying organisation's configuration and DPA. Requests to access or delete that data should be directed to your organisation as the data controller; we will assist it as its processor.

10. Security

Security is the product, so it is built in rather than bolted on: detection happens on the device; data we do store in the managed service is encrypted in transit and at rest and isolated per organisation; updates to the extension and detection rules are signed and verified before they are applied; and internal access is least-privilege and audited. You can read more on our Security page.

11. Where your data lives

Tracehold is built and hosted in the European Union, in France, on Contabo and OVH infrastructure, with EU data residency, so the tool that protects your data does not create a new cross-border transfer problem. Organisations that prefer to keep everything on their own infrastructure can self-host the entire stack, in which case data never leaves their premises.

12. Your rights (GDPR and similar laws)

Where we process your personal data, you have the right to access, rectify, erase, restrict or object to that processing, and to data portability, subject to applicable law.

• For the free extension, we hold essentially no personal data about you on our servers — most "data" stays on your device under your control.
• For managed deployments, your employer is the data controller; please direct rights requests to it, and it will instruct us as its processor.

You also have the right to lodge a complaint with your local data protection authority.

13. Children

Tracehold is a workplace security tool intended for organisations and professionals. It is not directed to children and we do not knowingly process children's personal data.

14. Changes to this policy

We may update this policy as the product evolves. When we do, we will revise the "Last updated" date above, and for material changes we will provide a more prominent notice (for example, in the extension or on this page).

15. Contact us

Questions about privacy, or want to exercise a right?

• Privacy enquiries: privacy@tracehold.com
• Data Protection Officer: dpo@tracehold.com
• General: hello@tracehold.com
• Post: Tracehold B.V., Werfkade 25, 1033 TA Amsterdam, Netherlands

Tracehold is built and hosted in the European Union, in France, on Contabo and OVH infrastructure, with EU data residency and an optional full self-host. See our Security and Terms DPA Subprocessors pages for more.