TraceSpec Privacy Policy

Effective date: 29 August 2026 Last updated: 31 August 2026

This Privacy Policy explains how Elyven Ltd, trading as TraceSpec (“TraceSpec”, “we”, “us”, or “our”), collects, uses and protects personal data when you visit our website, contact us, create an account, subscribe to TraceSpec, use the TraceSpec platform, or otherwise interact with us.

TraceSpec is a specialist trace heating design decision-support tool for professional and business users. It is not intended for personal, household or consumer use.

1. Who we are

Controller: Elyven Ltd Trading/product name: TraceSpec Company number: 17328579 Registered office: 9 Hazelhurst Road, Slough SL1 8EE, United Kingdom Registered in: England and Wales Website: https://www.trace-spec.com General enquiries: hello@trace-spec.com Support: support@trace-spec.com Privacy contact: privacy@trace-spec.com

For most website, account, billing, support and marketing activities, Elyven Ltd is the controller of your personal data. Elyven Ltd is registered with the UK Information Commissioner’s Office and has paid the ICO data protection fee.

Where a customer uses TraceSpec to upload or enter personal data about its own personnel, clients, project contacts or other third parties into the platform, we may act as a processor on behalf of that customer. In that case, our Data Processing Addendum applies as part of our Terms of Business.

2. Scope of this policy

This policy applies to personal data processed through:

• our public website and landing pages;
• enquiry, early-access, demo, contact or newsletter forms;
• TraceSpec account registration and login;
• subscription, billing and payment administration;
• use of the TraceSpec platform;
• support, product feedback and technical communications;
• diagnostics, usage, availability and security monitoring;
• marketing communications, where applicable.

This policy does not apply to third-party websites, services or integrations that have their own privacy policies.

3. Personal data we collect

We may collect and process the following categories of personal data.

3.1 Website and enquiry data

When you visit our website or contact us, we may collect:

• name;
• business email address;
• phone number, if provided;
• company or organisation name;
• job title or role;
• country or region;
• enquiry content and correspondence;
• newsletter, marketing or early-access preferences;
• cookie consent preferences.

3.2 Account and user data

When you create or use a TraceSpec account, we may collect:

• name;
• business email address;
• company or organisation name;
• job title or professional role;
• account login and authentication data;
• account settings and preferences;
• workspace, seat or team membership information;
• subscription plan and account status;
• audit, activity and access logs.

We do not intentionally collect personal account information from users who are not acting in a business or professional capacity.

3.3 Billing and subscription data

When you subscribe to TraceSpec, we may collect:

• billing name and organisation;
• billing address;
• tax/VAT details, if provided;
• subscription plan, renewal dates and payment status;
• invoice and transaction metadata;
• Stripe customer, subscription and payment identifiers.

Payment card details are processed by Stripe. We do not store full payment card numbers on our own systems.

3.4 Product and project data

When you use TraceSpec, you may enter, generate or upload information such as:

• project names and references;
• customer/client names or project identifiers, if you choose to include them;
• line lists, thermal design inputs, calculation assumptions and design basis data;
• product/candidate selections, suitability scores, warnings and review notes;
• exported reports;
• uploaded files such as line lists, drawings, PDFs, datasheets or other project documents, if this functionality is available;
• comments, notes or metadata added by users.

TraceSpec project data is normally engineering or commercial data rather than personal data. However, it may contain personal data if you choose to include identifiable names, contact details or other information about individuals. You are responsible for ensuring that you have the right to enter or upload any information into TraceSpec.

3.5 Technical, diagnostic and usage data

We may collect technical and usage data, including:

• IP address;
• approximate location derived from IP address;
• device, browser and operating system information;
• referring URLs;
• pages visited and features used;
• session events and product usage events;
• login, access and security logs;
• error, crash and diagnostic logs;
• performance and availability data.

TraceSpec does not currently use Google Analytics, Vercel Web Analytics or another optional analytics provider at launch. No optional analytics, advertising, remarketing, heatmap, session-replay or behavioural-marketing storage was observed on the TraceSpec origin during the 31 August 2026 production scan.

3.6 Support and communications data

When you contact us for support or otherwise communicate with us, we may process:

• your contact details;
• email content and attachments;
• support request details;
• product feedback;
• troubleshooting information;
• records of our responses.

4. How we collect personal data

We collect personal data:

• directly from you when you submit forms, create an account, subscribe, use TraceSpec or contact us;
• automatically through cookies, browser storage, logs and similar technologies;
• from payment processors, hosting providers, authentication providers and other service providers;
• from your employer, colleagues or account administrators if they invite you to a TraceSpec workspace;
• from public or professional sources where relevant to business communications.

5. How and why we use personal data

We use personal data for the purposes and lawful bases set out below.

Where we rely on legitimate interests, we consider whether our interests are overridden by your rights and freedoms. You may object to processing based on legitimate interests in certain circumstances.

6. Cookies and similar technologies

We use cookies and similar technologies to operate the website and platform, remember preferences where needed, support account access, maintain security and support payment workflows. TraceSpec does not currently use optional analytics or marketing technologies at launch.

If we introduce non-essential cookies or similar technologies in future, they will be used only where permitted by applicable law and, where required, with your consent. You can review cookie information through our cookie settings tool.

For more detail, see our Cookie Policy.

7. Marketing communications

We may send marketing communications about TraceSpec where you have requested them, consented to them, or where we are otherwise permitted to do so under applicable law.

You can opt out of marketing emails at any time by using the unsubscribe link in the email or contacting privacy@trace-spec.com.

We will still send service, security, billing and account communications where necessary for the operation of TraceSpec.

8. Aggregated and anonymised data

We may create aggregated, statistical or anonymised data from use of TraceSpec, including to:

• understand product usage;
• improve calculation workflows, scoring, usability and reporting;
• analyse market and engineering patterns;
• develop new features;
• produce non-identifying commercial or technical insights.

We will not use aggregated or anonymised data in a way that reasonably identifies you, your organisation, your project, your client or any individual.

Aggregated or anonymised data is not personal data where it can no longer reasonably identify an individual.

9. Customer confidential project data

We treat customer project data entered into TraceSpec as confidential customer information, subject to our Terms of Business.

We may access customer project data where necessary to provide, support, secure, troubleshoot and improve TraceSpec, comply with law, enforce our terms, or as otherwise authorised by the customer.

We will not publish customer project data or use it for named marketing case studies without appropriate permission.

10. Who we share personal data with

We may share personal data with:

• hosting and infrastructure providers, including Vercel and Supabase;
• authentication providers, including Clerk for sign-up, sign-in and session management;
• payment processors, including Stripe;
• email and communication providers, including UK2.net / UK-2 Limited / THG;
• authentication, logging, monitoring and development tooling providers;
• professional advisers, including lawyers, accountants, auditors and insurers;
• regulators, public authorities, courts and law enforcement where required;
• potential investors, buyers or group companies in connection with a corporate transaction;
• other users within your organisation or workspace, where relevant to account administration and collaboration.

We do not sell personal data.

We may share aggregated or anonymised information with partners, manufacturers, customers or prospective customers, provided it does not reasonably identify individuals, customers, projects or clients.

11. Subprocessors and suppliers

Where we process customer personal data as a processor, we use subprocessors to provide the service. Our current core service providers include:

We maintain a more detailed Data Protection & Processing page, including a subprocessor matrix and indicative processing locations, at https://www.trace-spec.com/legal/data-protection-processing.

We may update our providers from time to time. Where required by applicable data protection law or our Data Processing Addendum, we will provide appropriate notice of material subprocessor changes.

12. International transfers

We are based in the United Kingdom and may provide TraceSpec to customers internationally.

We aim to host core application and database data in the UK and/or EEA where reasonably practicable. However, some service providers may process or access personal data in other countries, including the United States or other jurisdictions.

Where personal data is transferred internationally and safeguards are required, we rely on appropriate transfer mechanisms such as adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, the EU Standard Contractual Clauses, Data Privacy Framework certification where applicable, or other lawful safeguards.

13. How we protect personal data

We use technical and organisational measures designed to protect personal data, including access controls, authentication, encryption in transit, cloud provider security controls, logging, backups, and restrictions on staff access.

No system is completely secure. You are responsible for keeping your login details confidential, using appropriate account security practices, and ensuring that information you upload is appropriate for use in a cloud SaaS platform.

For more detail, see our Security Statement.

14. How long we keep personal data

We keep personal data only for as long as reasonably necessary for the purposes described in this policy, unless a longer retention period is required or permitted by law.

Our typical retention approach is:

Deleted data may remain in backups until the relevant backup cycle expires.

15. Your rights

Depending on where you are located and the applicable law, you may have rights to:

• access your personal data;
• correct inaccurate personal data;
• request deletion of personal data;
• restrict processing;
• object to processing based on legitimate interests;
• withdraw consent where processing is based on consent;
• request data portability;
• complain to a data protection authority.

To exercise your rights, contact privacy@trace-spec.com.

We may need to verify your identity and may not always be able to comply with a request, for example where we need to retain data for legal, security, accounting or contractual reasons.

16. Customer-controlled personal data

If your personal data has been entered into TraceSpec by one of our customers, that customer is usually the controller of that data. In that case, please contact the relevant customer first. We will assist the customer in responding to rights requests where required by our Data Processing Addendum and applicable law.

17. Children

TraceSpec is intended for business and professional users. It is not directed at children and we do not knowingly collect personal data from children.

18. Data protection complaints

We would appreciate the opportunity to resolve any privacy concern first. You can raise a data protection complaint by contacting privacy@trace-spec.com.

We will acknowledge receipt of a data protection complaint within 30 days, take appropriate steps to investigate it, keep you informed where appropriate, and tell you the outcome without undue delay.

You also have the right to complain to the UK Information Commissioner’s Office or another relevant data protection authority.

19. Changes to this policy

We may update this Privacy Policy from time to time. The updated version will be posted on our website with a revised “last updated” date. Where changes are material, we may provide additional notice by email or in-product notification.

20. Contact

For privacy questions or requests, contact:

Elyven Ltd / TraceSpec Email: privacy@trace-spec.com Registered office: 9 Hazelhurst Road, Slough SL1 8EE, United Kingdom