TRASEO

Privacy Policy

Last updated: 9 October 2026

This Privacy Policy explains how TRASEO processes information when it provides its Lead Accountability service.

Who processes your data

TRASEO generally acts as a processor or service provider for CRM data processed on behalf of the agency or business using the service, subject to the applicable arrangement. For support correspondence, service administration, and security operations, the operator may determine purposes independently and may act as controller.

For questions or privacy requests, contact support@traseo.app.

Data and purposes

• Installation, Location, and user context support authentication, tenant separation, and access control.
• Pipelines, stages, Opportunities, minimal Contact names, and referenced CRM users support Lead qualification and outcome reporting.
• Conversation and Message metadata supports First Outbound, delivery evidence, attribution, and conservative Human Response Time derivation.
• Product configuration, sync health, security records, and operational logs support product operation, reliability, and protection.

TRASEO does not store message body or text, HTML, attachments, Contact email, Contact phone, postal address, raw webhook bodies, raw provider responses, or arbitrary provider JSON in its audited application data model.

CRM integration and providers

TRASEO receives supported CRM data through OAuth/API integration and provider webhooks, and also performs periodic reconciliation. Provider availability, event delivery, and available evidence affect what can be shown. The connected CRM remains the system of record.

Technical providers include the connected CRM, IONOS hosting infrastructure in Europe, Healthchecks.io for safe operational status, and the external support mailbox. Healthchecks receives operational status only, not CRM records, messages, Contact data, or business values. Google Drive is not active storage; rclone is installed only and no customer-data upload is configured.

Cookies and security

TRASEO uses essential Product Session, CSRF, bootstrap-challenge, and OAuth-state cookies for authentication and security. No analytics cookies, marketing cookies, behavioral tracking, or tracking SDKs are used by the application.

Safeguards include HTTPS, OAuth, AES-256-GCM encryption for provider tokens, server-side Product Sessions, CSRF protection, server-authoritative tenant scoping, Ed25519 webhook verification, minimized communication storage, bounded logging, PostgreSQL backups, restore testing, and operational monitoring.

Retention and deletion

When a provider disconnect or uninstall is processed, TRASEO access is disabled and a 30-day recovery period begins for that Location. Reinstalling during that period preserves existing history and cancels pending deletion. After 30 days without reactivation, live Location application data is automatically deleted. Limited technical and security records are retained only for bounded operational periods.

Earlier deletion may be requested after the integration is disconnected and inactive. Existing local backups may retain earlier copies for up to approximately 7 additional days under normal backup rotation. TRASEO does not promise immediate deletion from already-created backups.

Your rights

Where applicable under data-protection law, requests may include access, rectification, erasure, restriction, objection, and portability. For CRM data processed on behalf of an agency or business, TRASEO may need to coordinate a request with the relevant customer or controller. Contact support@traseo.app. You may also complain to the competent data-protection supervisory authority.

International processing

TRASEO identifies its hosting infrastructure only as IONOS in Europe on the basis of current operator information. The specific datacenter country and the global processing locations of independent providers are not asserted here and remain subject to the applicable provider terms and legal review.