Privacy Policy

Tracebud ("Tracebud", "we", "us") provides supply-chain traceability and EU Deforestation Regulation (EUDR) compliance tools for farmers, cooperatives, exporters, and buyers.

For privacy questions or to exercise your rights, contact privacy@tracebud.com.

This policy applies to:

• tracebud.com — marketing site, waitlist, and product information
• Tracebud mobile field app — offline-first plot mapping, land papers, harvest deliveries, and producer documents
• Tracebud web dashboards — cooperative, exporter, and buyer compliance workflows

Some organizations use Tracebud under their own account. When a cooperative or exporter invites you, they may also have policies that apply to your relationship with them. Tracebud processes data on their instructions only within the access you approve.

Depending on how you use Tracebud, we may process:

• Directly from you — when you register, map plots, upload documents, record deliveries, or change settings
• On your device — the field app stores data locally first; it syncs when you sign in and choose to back up
• From organizations you work with — for example when a cooperative links your producer profile, subject to consent rules in the platform
• Automatically — server logs, security monitoring, and optional analytics

When you upload land papers in the field app, Tracebud may run an automated document check to confirm the file looks like a valid land title, lease, or possession letter, and to extract key fields (such as holder name or registry reference) for compliance workflows.

How automated checks treat your file:

• The check is used only to validate and process your upload — not to build a public profile about you
• We configure our AI providers, where supported, with zero data retention and no training on your prompts or documents for these checks
• The automated system does not "remember" your document in a personal AI memory separate from your Tracebud account
• A human reviewer at your cooperative or exporter may still review unclear cases before export approval

What we keep after the check: your original file (photo or PDF) and a structured summary of the review outcome (for example accepted, needs clearer photo, or registry mismatch). These are stored in your Tracebud account under the same security and access rules as your other farm data.

If a file cannot be read, we will ask you to upload a clearer copy. We do not use failed uploads for unrelated marketing or advertising.

We use personal data to:

• Provide plot mapping, document storage, harvest logging, and traceability features
• Run compliance checks required for EUDR and buyer due diligence
• Sync data between your device and your organization's Tracebud workspace
• Authenticate users and prevent fraud or abuse
• Respond to support requests and improve product reliability
• Meet legal, tax, and regulatory obligations
• Send service-related messages (not unrelated third-party marketing)

We do not sell your personal data. Tracebud is not a data broker. We do not rent farm data to advertisers or unrelated third parties.

If you are in the European Economic Area or United Kingdom, we rely on one or more of the following:

• Contract — to provide the service you or your organization signed up for
• Legitimate interests — to secure the platform, prevent abuse, and improve reliability, balanced against your rights
• Legal obligation — to retain certain compliance and audit records where law requires
• Consent — for optional cookies, certain sharing choices, and where consent is required by law

You control sharing. In the field app, cooperatives and buyers only receive access to your plots, deliveries, and documents when you (or your organization's policy) grant it. You can review and revoke access in Data sharing settings where available.

• Farmers / producers — own their farm-origin data; can export a personal copy and manage sharing grants
• Cooperatives — see member data only within active sourcing and consent relationships
• Exporters and buyers — see supplier data only for compliance and shipments you are linked to
• Tracebud staff — limited access for support, security, and operations under internal controls
• Sub-processors — infrastructure and service providers listed in Section 13

• Farmers own their farm data. Plots, photos, GPS boundaries, and documents you capture belong to you. You can download copies where the product provides export.
• Cooperatives own their operational records about members, subject to member rights and applicable law.
• Exporters and importers own their shipment and due diligence records created in their workspace.

Leaving Tracebud does not automatically delete records that your cooperative or buyer must keep for legal compliance — see Section 11.

Depending on your location, you may have the right to:

• Access a copy of your personal data
• Correct inaccurate data
• Delete data or request erasure
• Restrict or object to certain processing
• Data portability
• Withdraw consent where processing is consent-based
• Lodge a complaint with your local data protection authority

In the field app, use Settings → Data sharing to manage access, export a personal JSON backup, or submit a deletion request. You can also email privacy@tracebud.com. We respond within the timeframes required by applicable law.

We keep data only as long as needed for the purposes above, including:

• Active accounts — while your account or organization subscription is active and you use the service
• Compliance and audit records — up to five (5) years or longer where linked to submitted due diligence or regulatory filings, as required by law
• Evidence documents — for the retention period tied to the plot, shipment, or audit event they support
• Marketing site analytics — according to cookie settings and analytics provider defaults

When you request erasure, we apply cryptographic shredding for identifiable personal fields where possible. Records that must remain for legal compliance (for example an accepted DDS reference or immutable audit log) may be retained in redacted or pseudonymized form so regulatory obligations are met without unnecessary ongoing identification.

We use technical and organizational measures appropriate to the sensitivity of compliance data, including:

• Encryption in transit (TLS) for data sent between your device and our servers
• Encrypted storage with our cloud infrastructure providers
• Role-based access controls and tenant isolation between organizations
• Audit logging for compliance-relevant actions
• Monitoring for abuse and unauthorized access

No method of transmission or storage is 100% secure. If you believe your account has been compromised, contact privacy@tracebud.com immediately.

We use trusted service providers to host and operate Tracebud, such as:

• Cloud hosting and database providers
• Authentication and storage services
• Email delivery
• Error monitoring (when enabled in production)
• AI gateway providers for document checks (with privacy controls described in Section 5)

Providers process data only on our instructions and under contractual safeguards. If data is transferred outside your country, we use appropriate mechanisms (such as Standard Contractual Clauses) where required.

Our marketing website may use cookies and similar technologies for essential functionality, preferences, and — with your consent where required — analytics to understand how visitors use tracebud.com. You can manage cookie choices in the cookie banner. See our cookie notice for details on specific tools in use.

The mobile field app does not use advertising cookies.

Tracebud is a business and compliance platform. It is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided data, contact us and we will delete it where appropriate.

We may update this Privacy Policy from time to time. We will post the new version on this page and update the "Last updated" date. For material changes, we may notify you by email or in-app notice where appropriate.