Privacy Notice (Beta)
Version privacy-v4. Last updated 30 October 2026.
This notice describes what TraceAnalysis-AI (“we,” “us”) collects when you use the TraceAnalysis invited beta, and why. It is written to match the product as it works today. It is not a GDPR transfer agreement or HIPAA BAA. Processing terms for Customer Personal Data are in the Data Processing Addendum.
Contact: [email protected].
1. Who this is for
The TraceAnalysis invited beta is offered only in the United States. It is not offered to users in the EEA, UK, or Switzerland. Do not create an account or use this instance if you are located in those regions. The beta is an invited group of testers, expected to be colleagues and friends in the United States. The Data Processing Addendum applies to personal data we process for Customer.
2. What we collect
Account. Username, optional email address, optional profile photo (avatar), a scrypt password hash, and authenticator (TOTP) enrollment state. Invited users must enroll TOTP. We do not store your password in plain text.
Session cookie. `ta_session` is an essential, HttpOnly cookie used to keep you signed in. It is not an advertising cookie. We do not use marketing pixels or analytics cookies in this beta.
Browser storage (on your device). The product uses browser `localStorage` for IDE pane layout and a local cache of chat conversation history, and browser `sessionStorage` for per-tab maps that restore stand-in labels (for example `app-1` or `[REDACTED_GUID_1]`) to the real values only in your browser. Those maps are not sent in API request bodies or model prompts. Clearing site data removes them.
Diagnose reports. The diagnostic ZIP is not uploaded. After on-device parse and a client privacy mask (including stand-in renaming described in §3), we receive a structured finding. We mask it again on the server, run an optional high-risk PII second pass before model calls (§5), and store the report (problem, root cause, evidence excerpts, timeline, retrieval trace, explanation, remediations, curated error-code lookups). Optional follow-up chat is stored with your account on the server and may also be cached in your browser. Saved prompts, projects, and folders are stored with your account. Cross-report Compare is off by default; you can enable it on your Profile page if you want to review multiple saved reports side by side.
Knowledge. Curated knowledge and proposals are shared across operators on this instance. Customer diagnostic ZIPs are never ingested into the knowledge base. Error-code titles and short meanings shown in the report come from our curated catalog of original summaries that link to public Microsoft Learn pages where available; they are not Microsoft documentation; TraceAnalysis is not affiliated with Microsoft. Codes missing from the catalog are marked unknown.
Contact form. The public site emails your name, email address, and message to [email protected]. We use that only to reply.
3. Masking, stand-ins, and residual identifiers
Before a finding leaves your browser, the client:
- Redacts common tokens (emails, UPNs, `DOMAIN\user` accounts, IPs, MACs, user paths, serials, secrets/tokens, and many GUID shapes).
- Renames session identity values to stable stand-ins such as `device-1`, `org-1` / `org-1.example`, `enrollment-1`, `dm-guid-1`, and `app-1` (and related forms such as `app-1_4`).
- Maps other unrecognized GUIDs to `[REDACTED_GUID_N]` tokens.
The browser keeps placeholder → real maps in memory / `sessionStorage` so the person who ran the analysis can still see real Intune app IDs (and similar) on their own screen. Those maps are never included in stored server findings or outbound model prompts.
On the server we re-apply pattern masking, apply a device-name / DNS-domain backstop, and — when the OpenMed privacy-filter pass is enabled for the instance — run a high-risk PII second pass on text bound for the language model, replacing detected high-risk spans with tokens such as `[REDACTED_EMAIL]` or `[REDACTED_NAME]`. That second pass is fail-open: if the model is disabled, slow, or unavailable, diagnose continues on the regex-masked text and the miss may be recorded for operators.
Masking is imperfect. Pattern rules and the second pass can miss values. Public Microsoft service identifiers, diagnostic error codes, product names, and free-text excerpts can remain by design when they are needed for troubleshooting. Do not treat stored reports as anonymous. Do not paste raw logs, secrets, passwords, or tokens into chat.
4. Why we use the data
We use this data to operate your account (including TOTP), generate explanations, retrieve curated knowledge and error-code catalog entries, let you review and export reports, improve the invited beta, and keep the instance secure (rate limits, abuse, CSRF origin checks). That use is based on these Terms you accept and on operating the service you asked for.
We do not sell personal data. We do not use stored reports for advertising.
5. Models and other systems
Your ZIP is opened in your browser and never uploaded. Before anything leaves your browser, identifiers are masked and renamed as described in §3.
The masked findings (and your chat question, when you use chat) are sent through a language-model gateway we operate (LiteLLM) to OpenAI's API in the United States for AI analysis. The default chat model alias on this beta is `gpt-5.4-mini`. Application requests set OpenAI's `store=false` so completions are not kept in OpenAI's customer-controlled stored-completions feature. That setting is not a zero-retention promise: OpenAI does not use API data to train its models unless a customer opts in (this beta is configured without that opt-in), and OpenAI may still retain API inputs and outputs for up to 30 days for abuse monitoring. If OpenAI is unavailable, a model we host ourselves (for example a local vLLM / Ollama chat alias on the operator's model host) is used as a fallback. Local embedding models used for curated knowledge retrieval are also operator-hosted.
When enabled, the OpenMed `privacy-filter-multilingual-v2` model runs on operator-controlled infrastructure (the same model host stack as other local models, or in-process). It is used only for the PII second pass and is not a separate commercial sub-processor.
Retrieved knowledge chunks, curated error-code catalog text, and — if web search is enabled on this instance — short web snippets may be included in model prompts. Treat model output as untrusted and verify before acting.
Because this beta is offered only in the United States, we do not describe EEA/UK/Switzerland transfer mechanisms on this page. OpenAI still processes masked findings in the United States as a sub-processor; see the sub-processor list and the DPA for the OpenAI agreement status.
Vectors for curated knowledge live in Qdrant. Application data lives in Postgres on the same host stack. We do not send customer ZIPs to those systems.
See the sub-processor list for OpenAI and related links.
6. Retention
Diagnostic reports, chat, and related session records are kept for 30 days by default (`RETENTION_DAYS`), or until you delete them. A scheduled job deletes expired sessions and cascades linked chat. We may delete beta data sooner if we reset the instance. Account records remain until you ask us to delete them or we end the beta.
Other operational records may be kept longer than 30 days as needed to run and secure the service — for example stage timings (default 90 days, purged by a daily scheduled job), token-usage stats (default 365 days, purged by a daily scheduled job), OpenMed miss / PII-incident rows (default same as `RETENTION_DAYS`), LiteLLM spend-log metadata (configured 30 days, prompts not stored in spend logs), and infrastructure logs.
Host backups (when configured) are age-encrypted dumps of Postgres and the Qdrant volume retained on TraceAnalysis-AI's own server (not a third-party backup vendor) for 7 days. Customer diagnostic ZIPs are never included in backups. Deleted reports and chat can therefore remain in encrypted backups for up to that backup window after app deletion.
OpenAI may retain API inputs and outputs for up to 30 days for abuse monitoring, as described in §5.
7. Sharing
We do not sell your data. We share masked findings with OpenAI as described in §5 and on the sub-processor list. We may also share information if required by law, to prevent abuse, or with operators who help run this instance. Knowledge proposals you submit are visible to other operators on the instance (approve/reject is admin-controlled).
8. Your choices
You can export a report as JSON or Markdown, or copy a ticket-format summary, from the session page. You can delete a report; deletion removes that session's linked chat turns from the server and prunes matching browser chat cache entries. You can stop using the service. Email [email protected] to ask us to delete your account and stored reports. We will do that as far as backups and legal holds allow.
Cross-report Compare stays off unless you enable it on Profile. You can change email (with verification and TOTP when enrolled) and manage your avatar on Profile.
9. Children and age
You must be 18 or older to use the beta. The service is not directed to children under 13. Do not create an account for a child.
10. Changes
We may update this notice. The version identifier (privacy-v4) will change when we do. Material changes will require a new acceptance where the product already asks you to accept Terms.