Privacy Policy

1. Who we are

Traceable (“we”, “us”) is operated by Abstract Studio. For data-protection purposes we are the controller of account data, and a processor / data fiduciary acting on the instructions of our users for the open-analytics they collect about their own recipients. Contact us at info@abstractstudio.in.

2. Data we collect

Account data (you, our user)

• Email address (used to sign in via magic link)
• Your links, uploaded files, recipient labels, and settings

Open-analytics (recorded when a link opens)

• Timestamp of the open
• Coarse location (country, region, city) derived from IP — the raw IP is never stored
• Device type, operating system, and browser (from the User-Agent)
• Referrer, when available
• For uploaded files: how long the document was viewed
• A rotating, hashed session identifier (to count unique opens without identifying anyone)

3. What we never do

• No tracking or advertising cookies, and no cross-site tracking
• No device fingerprinting
• No storing of raw IP addresses (used transiently for geo lookup, then discarded)
• No selling or renting of personal data to anyone

The only cookie we set is a strictly-necessary, signed session cookie that keeps you logged in. It is exempt from consent requirements.

4. Why we process it (lawful basis)

• Contract (GDPR Art. 6(1)(b)) — to provide the service you signed up for: authentication, hosting your links, and showing you their analytics.
• Legitimate interests (Art. 6(1)(f)) — to measure link opens in a privacy-preserving, aggregate way and to keep the service secure (e.g. bot filtering, rate limiting). We minimise data so these interests do not override individuals' rights.
• Under the DPDP Act we process personal data for the legitimate uses and on the consent basis described above; our users are responsible for the lawful basis of the recipients they choose to track.

5. Retention

Account data is kept while your account is active. Open-analytics are automatically deleted 15 days after they are recorded by a scheduled purge job. Deleting a link removes its analytics and any stored file immediately; deleting your account erases everything we hold about you.

6. Who processes data for us (sub-processors)

We use a small set of vetted providers to run the service. We do not sell data to them; they process it only to deliver their function.

7. International transfers

Some providers above are located outside the EEA/UK and India. Where personal data is transferred internationally, it is protected by appropriate safeguards such as the EU Standard Contractual Clauses and the providers' own data-processing terms.

8. Security

Data is encrypted in transit (HTTPS) and at rest by our database and storage providers. Access is restricted, sessions are signed, passcodes are hashed, and we minimise what we collect in the first place (no raw IPs, no fingerprinting).

9. Your rights

Under the GDPR and the DPDP Act you have the right to access, correct, export (portability), and erase your personal data, to restrict or object to processing, and to withdraw consent. You can:

• Export all your data from Settings → Export my data
• Erase your account and all data from Settings → Danger zone
• Exercise any other right, or lodge a complaint, by emailing info@abstractstudio.in

You may also complain to your local supervisory authority (EU/UK) or the Data Protection Board of India.

10. Transparency to recipients

People who open a hosted document see a notice that the link is tracked by its owner. Analytics are for the document owner — comparable to website analytics — not surveillance of named individuals unless the owner explicitly creates a per-recipient link. Owners are responsible for using Traceable lawfully toward the people they share links with.

11. Children

Traceable is not directed to children and we do not knowingly collect data from them.

12. Changes

We may update this policy; material changes will be reflected by the “last updated” date above.