RootTrace Privacy Policy

1. Who We Are

RootTrace is operated by ByteAffinity LLC, Hopewell, New Jersey, USA. Contact us at support@byteaffinity.com or (609) 455-8507.

2. Information We Collect

We may collect the following categories of information:

• Account information: name, email address, password hash, email confirmation status, MFA status, role, workspace membership, account status, and login metadata.
• Workspace information: organization name, environments, services, hosts, users, roles, invitations, integrations, billing plan, usage limits, and settings.
• Collector and infrastructure telemetry: collector keys, collector status, heartbeat timestamps, host identifiers, hostname, instance identifiers, EC2 metadata and tags when available, bare-metal labels, system metrics, Docker, Kubernetes, EKS, database, web server, queue, disk, memory, CPU, process, systemd, TCP, and service-health diagnostics.
• Incident data: issues, incidents, timeline events, comments, notes, recommendations, postmortems, acknowledgements, resolutions, audit events, and related evidence.
• Search and AI data: search queries, embeddings, reverse mappings to workspace documents, AI recommendations, generated summaries, prompts assembled from workspace evidence, confidence labels, and source-event references.
• Integration data: integration type, configuration metadata, webhook host hints, delivery status, and redacted integration details. Secrets are intended to be stored and displayed in redacted form where applicable.
• Billing data: plan, subscription status, Stripe customer and subscription identifiers, checkout and portal events, payment status, invoices, and billing metadata. Payment card details are processed by Stripe, not stored directly by RootTrace.
• Support and feedback: messages, feedback submissions, contact details, support requests, and related troubleshooting information.
• Device, security, and usage data: IP address, user agent, request metadata, authentication events, rate limiting data, API logs, error logs, browser or device information, and security audit details.

3. Sensitive Data and Customer Responsibility

RootTrace is designed for operational diagnostics. You should not submit secrets, passwords, private keys, SSH keys, cloud secrets, regulated personal data, protected health information, payment card data, or other highly sensitive information unless you have legal authority and have configured appropriate safeguards. The collector and API include secret-redaction concepts, but no automated redaction is perfect.

4. How We Use Information

We use information to:

• provide, operate, secure, monitor, and maintain RootTrace;
• authenticate users, enforce roles, isolate workspaces, issue and revoke tokens, and prevent unauthorized access;
• process collector data, create issues and incidents, generate recommendations, support AI search, and draft postmortems;
• send account, security, confirmation, password reset, MFA, invite, billing, and support emails;
• process billing, subscription changes, cancellations, and plan limits;
• detect abuse, debug errors, rate limit requests, audit actions, and enforce our Terms;
• respond to support requests, feedback, legal requests, and security issues;
• improve reliability, usability, performance, and safety of the Service.

5. How We Share Information

We may share information with service providers and processors who help us operate RootTrace, including cloud hosting, databases, search and vector storage, AI model providers, email delivery, billing and payment processing, monitoring, support, and security services. We may also share information with integrations you configure, such as Slack or PagerDuty.

We may disclose information if required by law, legal process, security investigation, enforcement of our Terms, protection of rights and safety, business transfer, merger, financing, sale, or similar transaction.

We do not sell personal data for money. We do not use targeted advertising in the RootTrace application at this time.

6. AI and Vector Search

RootTrace may create embeddings and workspace-scoped search indexes for issues, incidents, comments, recommendations, and postmortems. Embeddings are linked back to primary workspace records and are intended to be isolated by workspace. AI prompts should be built from workspace evidence, but you remain responsible for avoiding submission of secrets or data you are not authorized to process.

7. Retention

Diagnostic and incident retention depends on your plan and workspace settings. Current default plan retention periods are: Free - 1 day; Startup - 90 days; Growth - 365 days. Some account, billing, audit, security, backup, abuse-prevention, and legal records may be retained longer when necessary for legitimate business, security, accounting, legal, or compliance purposes.

Deleting a workspace or account starts deletion workflows for associated active records where supported. Residual copies may remain temporarily in backups, logs, caches, audit records, billing systems, or third-party processors, subject to operational and legal retention needs.

8. Security

RootTrace is designed around zero-trust and least-privilege principles, including tenant isolation, role-based access controls, hashed tokens where appropriate, scoped collector keys, outbound collector design, revocation, audit logs, and secret-redaction patterns. No system is completely secure. You are responsible for securing your account, users, credentials, collectors, integrations, environments, and customer systems.

9. Your Privacy Choices and Rights

Depending on your location and applicable law, you may have rights to request access, confirmation, correction, deletion, portability, or to opt out of certain processing. Where the New Jersey Data Privacy Act or another applicable privacy law applies, we will process verified requests as required by that law. You may contact us at support@byteaffinity.com.

If we deny a privacy request and applicable law provides an appeal right, you may appeal by replying to our decision email with "Privacy Appeal" in the subject line.

10. Children

RootTrace is intended for business users and is not directed to children. Do not use RootTrace if you are under 18 years old.

11. International Use

RootTrace is operated from the United States. If you access the Service from outside the United States, you understand that information may be processed in the United States and other locations where our processors operate.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The updated policy will be posted at this page with a revised date. Continued use of RootTrace after the effective date means you acknowledge the updated policy.

13. Contact

ByteAffinity LLC
Hopewell, New Jersey, USA
Email: support@byteaffinity.com
Phone: (609) 455-8507