Privacy Policy

Introduction

TraceNode Corp. ("we", "us", "our") provides a compliance management platform for licensed gambling operators. This Privacy Policy explains how we collect, use, store, and protect personal data in connection with the TraceNode Lite service ("Service"). It applies to all operators, their staff, and any individuals whose data is submitted through the Service.

By using TraceNode Lite, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, do not use the Service.

Data We Collect

We collect data in the following categories:

Account data (operator)

• Company name, contact email address, and password hash
• Licensed jurisdictions and timezone preferences
• API key metadata (key hash only — raw keys are never stored)
• IP addresses and login timestamps

Dispute data (player/subject)

• Dispute records submitted via the API or intake form, including player identifiers, dispute type, claim amount, and resolution outcome
• Player contact information and complaint details as submitted by the operator

Audit data

• Hash-chained audit log entries recording every dispute state change, reviewer action, and report generation event
• Regulator access logs for time-limited regulator portal access

Staff training data

• Staff email addresses used to assign compliance quizzes
• Quiz completion records and score data

Usage data

• Page views, feature usage, and error events via our analytics system
• Browser type, device information, and referring URL for security and debugging

How We Use Data

Purpose	Legal Basis
Providing the dispute management service	Contract performance (operator agreement)
SLA monitoring and breach alerts	Contract performance
Regulatory report generation	Contract performance; legitimate interest in compliance
Audit log integrity (hash chaining)	Legitimate interest in audit trail integrity
Account security and fraud prevention	Legitimate interest in platform security
Service improvement and debugging	Legitimate interest in platform reliability
Regulatory body access (optional, operator-controlled)	Operator consent to grant time-limited access

We do not use dispute data or player information to train external AI models, or to profile individuals for marketing purposes.

Data Retention

Data is retained as follows:

Data Category	Retention Period
Account data	Duration of account + 90 days after closure
Dispute records & audit logs	Minimum 7 years (regulatory requirement; operators should retain their own copies)
Staff training records	Duration of account + 3 years after staff record deleted
Analytics events	90 days

Data Sharing & Third Parties

We share data only in the following circumstances:

• Regulatory bodies — when you grant time-limited access via your Settings. Access is logged and you can revoke it at any time.
• Sub-processors — Polsia Inc. (infrastructure provider), Neon (Postgres cloud database), and Render (web hosting). All bound by data processing agreements.
• Legal obligations — where required by applicable law, court order, or regulatory authority.

We do not sell, rent, or trade personal data to third parties.

Data Security

We protect data using:

• TLS encryption in transit for all data transmitted between your systems and our service
• Password hashing using PBKDF2-SHA512 with 310,000 iterations
• Append-only audit log with SHA-3-256 hash chaining — tamper evidence without DLP encryption
• Role-based access controls within the application
• Regulator access logged and time-limited via expiring access tokens

No system is completely secure. If you become aware of a data breach, contact us immediately at security@tracenode.com.

Your Rights

Depending on your jurisdiction, you may have the right to:

• Access a copy of your personal data (request via email to admin@tracenode.co)
• Correct inaccurate personal data
• Request deletion of personal data (subject to regulatory retention requirements)
• Object to certain processing activities
• Export your data in a machine-readable format

Requests are fulfilled within 30 days. Contact us using the details below for any data rights requests.

Cookies

TraceNode Lite uses the following cookies:

Cookie	Purpose	Expiry
tn_demo_sess	Demo session authentication	24 hours
_tracenode_session	Operator session (future auth)	7 days

Cookies are not used for advertising or cross-site tracking.

Changes to This Policy

We update this Privacy Policy when our data practices change materially. The effective date is shown at the top of the page. Material changes will be communicated via the email address registered to your account at least 30 days before they take effect.

Contact

For data privacy questions or to exercise your rights:

TraceNode Corp.
Data Protection Officer
Email: privacy@tracenode.com
Website: https://tracenode-lite.polsia.app