Privacy Policy

Traceo is committed to protecting the privacy of its users. This privacy policy explains how we collect, use, store, and protect your personal data when you use our website and application.

This policy informs you about those activities; using the service is not treated as consent. Traceo acts as controller for the Website, accounts, enquiries, and support, and as processor for operational data entered by customers, who remain responsible for that processing.

The controller responsible for processing personal data is:
TRACEO HACCP (simplified joint-stock company)
Registered office: 16 Hameau de Mesmeur, 29120 Tréméoc, France
SIREN: 999 358 856 - SIRET (registered office): 999 358 856 00014
VAT number: FR95 999358856
Email: [email protected]

We may collect the following types of data:

• Identification data: first name, last name, professional email address
• Connection data: IP address, browser type, connection timestamps
• Operational data: temperature logs, goods receipt records, HACCP reports
• Business data: establishment name, address, professional contact information

Your data is collected for the following purposes:

• Provide and improve our HACCP management services
• Manage your user account and authentication
• Generate food compliance reports
• Ensure the security of our platform
• Respond to contact and demo requests and arrange the requested commercial follow-up
• Respond to your support requests
• Comply with our legal obligations

Processing relies on:

• Steps before entering a contract: responding to contact, demo, and quotation requests
• Performance of a contract: managing accounts, providing the service, and delivering support
• Legitimate interests: securing, maintaining, and improving our services, preventing abuse, and responding to professional enquiries
• Consent: measuring audiences with Google Analytics; consent may be withdrawn at any time
• Legal obligations: retaining accounting documents and responding to legally valid requests

Account data is retained during the contract. Operational data may be exported during the contract and for up to six months after it ends, and may then be deleted subject to a legal obligation or documented instruction from the customer acting as controller.

Data from contact and demo requests is retained for up to 3 years from collection or the last contact.

Connection data is retained for up to 12 months for security purposes.

Your data is never sold to third parties. It may be shared with:

• Our technical processors: website hosting and secure form processing (Cloudflare), transactional email delivery for forms (Brevo), application hosting (Contabo, European Union), storage and backups (Scaleway, Paris), AI-assisted extraction and support through Vercel AI Gateway and configured model providers including Google and Anthropic, voice transcription (ElevenLabs), audience measurement after consent (Google Analytics)
• Competent authorities: where legally required or pursuant to a judicial request

All our processors are bound by contractual confidentiality and security obligations in compliance with GDPR.

Some data may be transferred to countries outside the European Union, particularly the United States, when we use Cloudflare, Vercel, certain AI model providers, ElevenLabs and, if you accept audience-measurement cookies, Google Analytics. Depending on the provider and transfer, these flows rely on an adequacy decision, the EU–US Data Privacy Framework where applicable, or the European Commission’s standard contractual clauses.

Under GDPR, you have the following rights:

• Right of access: obtain a copy of your personal data
• Right to rectification: correct inaccurate data
• Right to erasure: request deletion of your data
• Right to restriction: restrict the processing of your data
• Right to portability: receive your data in a structured format
• Right to object: object to the processing of your data
• Withdrawal of consent: withdraw consent at any time where processing relies on it

To exercise these rights, contact us at: [email protected]

You may lodge a complaint with the CNIL or the competent supervisory authority in your country (www.cnil.fr).

Some features use AI to propose extraction or assistance from content submitted for that purpose, such as label images, reception or cleaning documents, text, or voice. Results may be inaccurate and must be checked by the user before they are saved. Traceo does not use these features to make decisions that produce legal or similarly significant effects on a person.

We implement appropriate technical and organizational measures to protect your data against unauthorized access, loss, destruction, or alteration, including:

• Encryption of data in transit (HTTPS/TLS)
• Encryption of data at rest
• Secure authentication using JWT tokens
• Role-based access controls
• Regular backups

Our website uses cookies and storage that are essential to operate the service. If you accept, we also use Google Analytics to measure website audience and demo requests. This measurement is not enabled without your consent, and advertising tracking is not enabled. You can withdraw consent or change your choice at any time through “Manage cookies” in the footer.

This policy may be updated periodically. In the event of a substantial change, we will inform you by email or through a notification on our platform.

For any questions regarding this privacy policy or your personal data:
Email: [email protected]