Privacy Policy

TRACE (tracecase.app) is an AI decision-support system for humanitarian caseworkers at NGOs, UN agencies, and humanitarian organizations. It supports field teams in assessing risk, structuring case documentation, and generating referral recommendations, with greater speed and consistency than manual processes allow.

TRACE processes sensitive humanitarian case data on behalf of the organizations that deploy it. TRACE is a prototype. This policy describes what the current build actually does, and states plainly where a control is not yet in place.

From caseworkers and organizational administrators: Account name and email address, held for sign-in, and the organization the caseworker belongs to. This is used to authenticate users and to scope case records to that organization.

From field sessions: Case content entered during case sessions, which we process to generate structured case records, risk assessments, and case documentation. Case records are stored on the device. Sign-in is not enabled in this prototype, so no case created in the app reaches TRACE's servers today. Voice capture in the current prototype is simulated, so no audio is recorded or transmitted. See our Data Protection page for architecture details.

Technical and operational data: Standard application and hosting logs used to diagnose errors.

Today, case records stay on the device and are readable only by the person using it. When sign-in is enabled, case records saved to TRACE's servers will be readable by others in the caseworker's own organization, access will be scoped to that organization, anonymous access will be refused, and every change will be recorded with who made it and when. An administrator of the database will also be able to read the records it holds. There is no encryption at rest.

We use account name and email to sign caseworkers in and to communicate with your organization about the service. We do not sell, share, or use account data for advertising.

We process field session data on your behalf to deliver TRACE's core features: AI-assisted structuring of case notes, risk scoring, referral recommendations, and document generation. We perform this processing under your organization's instructions, as a data processor.

We use technical logs internally to diagnose errors and monitor application stability. When sign-in is enabled, a change history will record who made each change to a case and when.

TRACE uses a limited number of third-party services to deliver the product:

Lovable is used for application hosting and infrastructure. That environment holds no case records today, because sign-in is not enabled; when it is, case records saved by signed-in caseworkers will be held in a database there. There is no encryption at rest.

AI model providers. AI features send case content to Anthropic's API to be processed and returned; it is not retained by TRACE. Case content sent for AI processing is subject to Anthropic's standard API terms. No other third party receives case content.

We do not use case content to train AI models ourselves.

If you are in the EU or California, you have the right to access, correct, or delete personal data we hold about you. The current prototype cannot self-serve those requests. A case cannot be deleted from inside the app; it can only be closed. Deletion of a case or of account data would be carried out manually by an administrator, and we do not commit to a response time. There is also no structured consent capture in the app. Requests related to case records should be directed to your organization's data officer. Requests related to your account data (name, email) can be sent directly to us at elkedikoume@gmail.com.

California residents have the right to know what personal information is collected, request deletion, and opt out of sale. TRACE does not sell personal data. Deletion requests would be handled manually, as described above.

Not yet. There is no retention policy and no automatic expiry. Nothing is deleted on a schedule. Case records stay on the device until removed there, and account data remains until removed manually. When sign-in is enabled, case records saved to TRACE's servers will remain on the server until removed manually, and signing out will not remove them.

Configurable retention periods, case-level permanent deletion, and a data export on contract termination are on the roadmap, not in the current prototype.

If a personal data breach affecting case data occurs, we will notify your organization's designated data officer and provide a description of the breach, its likely consequences, and the measures taken or proposed. No pilot involving real personal data has begun, and no formal incident-response process is in place yet.

TRACE is operated from the United States. If your organization is based in the EU or another jurisdiction with cross-border data transfer restrictions, we can execute a Data Processing Agreement with Standard Contractual Clauses. Contact elkedikoume@gmail.com to request this.

TRACE is designed for deployment in humanitarian contexts and takes its reference points from the IASC Operational Guidance on Data Protection in Humanitarian Action and the UN Personal Data Protection and Privacy Principles. The prototype has not been assessed or certified against them. Organizations deploying TRACE are responsible for ensuring their use complies with applicable humanitarian standards and the data protection frameworks of their own operations.

If we make material changes to this policy, we will notify organizational administrators by email. Continued use of TRACE after a change takes effect constitutes acceptance.

For privacy questions or to exercise your rights: elkedikoume@gmail.com

For security-specific inquiries: security@tracecase.app