← Back to Traceable

Privacy Policy

Last updated: 6 November 2026

This Privacy Policy explains how Traceable Docs Pty Ltd (ACN 702 883 494), referred to as "we", "us", or "Traceable", collects, uses, and protects your personal information when you use the Traceable application and website (the "Service").

1. Who we are

Traceable is a requirements traceability and validation documentation tool. Traceable Docs Pty Ltd is the entity responsible for your personal information handled through the Service.

2. Information we collect

  • Account information: your name, email address, job title, and organisation name, provided when you create an account or complete onboarding.
  • Billing details: the company name, billing address and Australian Business Number (ABN) your organisation's invoices show, and the email address invoices are sent to.
  • Content you create: documents, requirements, comments, and other material you author or upload in the Service.
  • Messages: messages you post in document discussions and conversations, your replies and reactions, and the earlier text of any message you edit, as described in section 8.
  • Activity in discussions and conversations: which messages you have read, the conversations you have muted, and whether you are currently online, which is shown to other members of your organisation.
  • Records of changes: the changes you make to your organisation's settings, members, projects, documents and signatures, when you made them, and the values before and after. They are kept in your organisation's audit log, which its Admins can view and export.
  • Usage information: basic product analytics such as pages visited and features used, so we can understand and improve the Service.
  • Technical information: information your browser sends automatically, such as IP address and device or browser type.

3. How we use your information

We use your information to:

  • provide, operate, and secure the Service,
  • create and manage your account and organisation,
  • respond to your requests and provide support,
  • improve the Service and develop new features, and
  • meet our legal and regulatory obligations.

4. How your information is stored and processed

We use trusted third-party providers to run the Service. These may include cloud hosting and database providers, product analytics, email delivery services, payment processing (Stripe, which receives your organisation's billing details to issue invoices, work out tax and take payment), and AI model providers, used only with zero data retention, for the built-in Assistant described in section 7. These providers process information only on our behalf and under agreements that require them to protect it. We do not sell your personal information.

5. Sharing your information

We disclose personal information only:

  • to the service providers described above,
  • to members of your own organisation, according to the access and roles set within the Service, including the people who can read a discussion or conversation you post in, as described in section 8,
  • to an external application you connect and authorise, as described in section 6,
  • to our support staff, while an Admin of your organisation has granted support access, as described below,
  • where you ask us to, or
  • where required by law or to protect our legal rights.

Support access: an Admin of your organisation can let our support staff into the organisation for a period they choose of up to 30 days, read only or with edit access, and can end it at any time. While it lasts, our support staff can see your organisation's projects, documents and their discussions at the level granted, are listed among its members as Traceable support, cannot sign, and everything they do is recorded in your organisation's audit log under their name, marked as Traceable support. Their access ends when the grant expires or is revoked.

6. Applications you connect (AI assistants and other integrations)

The Service lets you connect an external application, such as an AI assistant, so that it can read and author your documents on your behalf. This is off by default. It requires an administrator of your organisation to permit external applications and to grant you access individually, and it requires you to approve the connection on a consent screen that names the application and what it is asking for.

When you approve a connection, document content leaves the Service. The application receives the content it requests, on your instruction, and handles it under your own agreement with that application's provider rather than under this Policy. We are not a party to that agreement and we do not control what the provider does with the content. You, or your organisation, are the party exporting that data.

A connected application reaches only what you can reach yourself, and only while the connection lasts. That includes the document discussions and conversations you can read, so other people's messages in them can leave the Service with the content it requests. It can also post messages as you, shown as yours and marked with the application's name. Every change it makes is recorded against your name, and you or an administrator can revoke a connection at any time, which takes effect immediately.

Decide what an application may see before you approve it, particularly where your documents contain personal information or material a regulator would treat as controlled.

7. The built-in AI Assistant

The Service includes an Assistant that answers questions about using Traceable and helps you report a problem or suggest an idea. It is available only to signed-in users. This section is about that Assistant; applications you connect yourself are covered by section 6.

  • What is sent, and to whom: each message you send to the Assistant is sent, with the conversation so far, the address and title of the page you are on (a title can include the name of a document you have open), and your browser and operating system type, to a third-party AI model provider. We use only AI models run with zero data retention, so the provider does not keep your messages or use them to train its models. The model we use may change, but it will always meet that condition.
  • What the Assistant can see: it answers only from Traceable's help documentation, which is sent with your message. The AI model has no web access: it cannot access the internet, and it cannot read your organisation's documents or any other content in the Service. Only what you type, and the page and browser details above, reach it.
  • Where the conversation is kept: the conversation is kept only in your browser, for the browser session. It is not stored on our servers unless you submit it with feedback. If you do, the conversation since your previous action and your original wording are stored with the feedback item.
  • Usage records: for each reply we record usage information, namely the type of reply, the model used, token counts, response time, which help articles were cited, and whether you marked the answer as helpful or sent it on to us. These records do not contain the content of your messages or of the Assistant's replies.
  • Limits: a daily limit applies to the number of replies each user can receive from the Assistant.

8. Discussions and conversations

The Service lets members of an organisation discuss a document and hold conversations with one another.

  • Who can read a message: a message in a document's discussion can be read by everyone who can read that document. A message in a conversation can be read only by the members of that conversation.
  • Editing: when you edit a message, it is shown as edited, and its earlier text is kept and can be seen by the people who can read the message.
  • Removing: when you remove a message, it is shown as removed and its text is no longer displayed, but the text is kept with your organisation's records. An Admin of your organisation can remove any message in a discussion or conversation they can read, and the message is shown as removed by an Admin. To ask for the text of a message to be erased, contact us as described in section 10.
  • Emails: when someone mentions you, the email we send includes their comment. The daily reminder email, if you have it turned on, lists excerpts of your unread messages. These emails are sent through our email delivery provider. You can turn the reminder off in your account preferences.
  • Online presence: while you are signed in, other members of your organisation can see that you are online. While you type a message, the people who can read that discussion or conversation can see that you are typing.

Discussions and conversations are not monitored by us. They are not part of your organisation's controlled records: see section 5 of the End-User License Agreement.

9. Security

We take reasonable steps to protect your information using appropriate technical and organisational measures. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

10. Your rights

Subject to applicable law, you may request access to, correction of, or deletion of your personal information, and you may export the content you have created. To make a request, contact us using the details below.

11. Data retention

We keep your information for as long as your account is active and for as long afterwards as is needed to meet our legal obligations, resolve disputes, and enforce our agreements. Messages, including removed messages and the earlier text of edited ones, are kept for as long as the organisation they were posted in keeps its account, unless erased on request under section 10. Your organisation's audit log is kept for as long as the organisation keeps its account, as part of its records.

12. International transfers

Your information may be stored or processed in countries other than the one you live in. Where it is, we take steps to ensure it remains protected consistent with this Policy.

13. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the "Last updated" date above. When we make a material change, we will notify you within the Service at least 30 days before it takes effect. If you do not agree to a change, you may close your account, as described in section 10 of the End-User License Agreement.

14. Contact us

If you have questions about this Policy or how we handle your information, contact us at privacy@traceabledocs.com.