This notice explains what TracePrep Inc., a Texas corporation (214 S Main St Ste 101-C, Duncanville, TX 75116), does with the information you give us through the Site's forms, including the Contact page, and the way we measure how traceprep.com is used. It covers the marketing site only. Data handled inside the TracePrep product application is covered by the Product Application Privacy Addendum, which is published when the application is released. Two entries in the section 5 table reach past this Site deliberately rather than quietly: Anthropic is named there even though it handles nothing you submit through this Site, so that you do not have to wait for another document to learn that we plan to use it in the product application, and the Customer.io row also names the account email the product application sends.
TracePrep is built for business use by accounting professionals. We do not aim the Site at children and do not knowingly collect information from anyone under 18.
1. The email you give us
When you give us your work email through a form on the Site (the Get started page, the calculator, the footer, the sample Study, a resource download, or the Contact page), we send it to Customer.io, the service we use to store contacts and send email. If you tell us your firm's size, we keep that with it. We use your email to reply to you about TracePrep. It is never recorded as an analytics property. If you join the waitlist, we use your email to tell you when the TracePrep plugin, and if you asked, the TracePrep app, is available. Every such email has an unsubscribe link.
If you reached the Site from a campaign link, we also keep the campaign parameters in that link (the UTM values: source, medium, campaign, term, and content) so we know how you found us. Apart from the Contact page (section 2), we do not store the rest of the web address you came from.
When you request a resource download, we email you the resource automatically. No other form sends an automatic email. We reply to you ourselves.
We do not sell your information. We do not share it for cross-context behavioral advertising.
2. The Contact page
The Contact page sends your name, your email, your message, the reason you picked, your firm's size if you give it, the page you sent it from, and the address that referred you to that page to ClickUp, the service we use to track and answer messages, where Bobby reads and answers it. Your email also goes to Customer.io, as in section 1. The form is TracePrep's own and posts to our own endpoint, not a third party's. Two pieces of third-party code run on the page: our own measurement, described in section 3, which runs on every page of the Site, and the Cloudflare bot check described in section 5, which loads only once you start filling this form in.
3. How we measure the Site
We use PostHog to count anonymous page views and two page-speed readings: largest contentful paint and cumulative layout shift.
When an email form goes through, we also count one anonymous conversion carrying which form it was, the same campaign values, and for a resource download which resource, never your email or any way to identify you. When you click a call to action on a blog post, we count one anonymous click carrying the post and the button.
PostHog runs without cookies and keeps nothing in your browser storage. It does not build a profile of you, identify you, record your session, or capture what you type into forms or the page. A page view records only the path you visited, never the query string after it.
PostHog respects the Do Not Track signal. If your browser sends it, measurement stays off. PostHog also forwards these same anonymous readings to Google Analytics 4 as a downstream destination it manages for us.
4. Cookies and consent
TracePrep's own measurement sets no cookies and writes nothing to your browser storage. There are no advertising, retargeting, or social pixels on the Site. Because of that, no consent banner is shown for our own measurement, and there is nothing of ours to opt out of beyond the Do Not Track signal your browser already sends.
If we ever add a cookie, a persistent identifier, or an advertising tag, that is a material change: we will publish a new version of this notice at least 30 days before it takes effect and re-assess whether a consent mechanism is required.
4a. The Sign in link
The Site's header and footer link to the TracePrep product application at https://app.traceprep.com/. The link's address contains no query string, no identifier, no campaign value, and nothing you entered in a form here. When you follow it, your browser contacts app.traceprep.com and sends what a browser normally sends to a site it visits: your IP address and your browser's standard request headers. Those headers can include the fact that you came from traceprep.com, and any cookie the application set on an earlier visit.
Opening the application's first page sets no cookie. If you start to sign in, the application uses WorkOS to handle sign-in and sets a cookie for that step, and once you are signed in it sets a cookie that keeps you signed in. Those cookies are the application's. This Site does not set them or read them, and nothing in section 4 about this Site's own measurement changes.
Past the link, this notice does not cover what you give the application, such as your name and work email when you create an account. That belongs to the Product Application Privacy Addendum, which is not published yet (see the opening paragraph). WorkOS handles nothing you submit through this Site.
5. Who processes data for us
| Processor | What it handles | Where to read more |
|---|---|---|
| Customer.io | Stores the work email, firm size, and campaign values you submit; sends our replies and the resource emails you request. It also sends the TracePrep product application's account email from info.traceprep.com, such as a Study assigned to you, a change request, a PDF ready to download, or a reminder. For the emails it sends, Customer.io may record whether an email was opened and whether a link in it was clicked, using identifiers it attaches to each message | https://customer.io/legal/privacy-policy |
| PostHog | Anonymous page views, page-speed readings, form conversions, and call-to-action clicks | https://posthog.com/privacy |
| Google Analytics 4 | Receives the same anonymous readings as a downstream destination PostHog manages | https://policies.google.com/privacy |
| Vercel | Hosts and serves the Site; handles request logs | https://vercel.com/legal/privacy-policy |
| MongoDB Atlas | Stores the Site's published content | https://www.mongodb.com/legal/privacy-policy |
| Amazon Web Services (S3) | Stores images and media used on the Site | https://aws.amazon.com/privacy/ |
| ClickUp | Receives what you send through the Contact page | https://clickup.com/terms/privacy-policy |
| Cloudflare | Sits in front of the Site as its network layer, so it handles every request before our host does, and receives the request data and network error reports that come with that; also runs the bot check on the Contact form, which loads when you start filling that form in and sees your IP address and a one-time token | https://www.cloudflare.com/privacypolicy/ |
| Anthropic | Nothing you submit through this Site. We plan to use Anthropic's models inside the TracePrep product application; what they will handle there is set out in the Product Application Privacy Addendum | https://www.anthropic.com/legal/privacy |
This list is reviewed quarterly. Adding a processor that handles personal information is a material change under section 9.
The Anthropic row is the one entry that does not describe processing on this Site. No Site data reaches Anthropic today: the Site has no connection to it, in code or in configuration. We have not audited every downstream automation our other processors can run, so we state what we control rather than an absolute. It is listed because the product application will use it, and we would rather name it early here than have you find it only in a document that has not been published yet. When the product application is released, the Product Application Privacy Addendum is the notice that governs what it handles there.
6. Why we may process your information
- To reply to you about TracePrep, because you asked us to by submitting the form.
- To understand how the Site is used, on the basis of our legitimate interest in improving it, using anonymous readings only.
- To keep the Site secure and available, and to meet legal obligations.
7. How long we keep it
- Your email and campaign values: kept in Customer.io while you remain a contact. Ask us to delete them and we will, and we will confirm when it is done.
- Contact page messages: kept in ClickUp so the conversation history stays useful. Ask us to delete them and we will.
- Anonymous measurement: kept under PostHog's own retention. It carries no identifier that could be tied back to you.
- Request logs: kept by Vercel under its standard retention, and by Cloudflare under its own, since Cloudflare handles the request first.
8. Your choices and rights
Whatever state or country you are in, you may ask us to tell you what we hold about you, correct it, delete it, or send you a copy. Reach us through the Contact page or at [email protected]. Written requests may be sent to TracePrep Inc., 214 S Main St Ste 101-C, Duncanville, TX 75116.
We do not sell personal information and we do not share it for cross-context behavioral advertising. We do not use it for automated decision-making that produces a legal or similarly significant effect.
If you are a Texas resident, the Texas Data Privacy and Security Act (TDPSA) gives you these rights and a right to appeal a refusal. If you are a California resident, the California Consumer Privacy Act as amended (CCPA/CPRA) gives you an equivalent set. If we decline a request, we will explain why and tell you how to appeal, and you may complain to the Texas Attorney General at https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint. Residents of other states with a similar law have equivalent rights, and we honor them on the same terms rather than asking where you live.
We will respond within 45 days and will tell you if we need the extension the law allows.
We honor these rights whether or not a given law's applicability threshold reaches us. TracePrep Inc. may not currently meet the processing-volume or revenue threshold of the Texas Data Privacy and Security Act, the California Consumer Privacy Act, or their equivalents. We are not going to make you check. The rights above are available to every person who asks, on the same terms.
9. Changes to this notice
This notice is versioned. Each version is published at /legal/versions/<version>/privacy and stays available there. A material change, including any change to what we collect, how long we keep it, or who processes it, takes effect no sooner than 30 days after it is published, and the prior version controls until then. A clarification or typo fix takes effect on publication.
The version dated 2026-09-22 was an exception, and we would rather say so here than leave it in a file you cannot see. The version dated 2026-09-22 added Cloudflare and Anthropic to section 5 and took effect the day it was published, without the 30 days. The owner of TracePrep Inc. waived the period for this version only; the reason, and the part of the reasoning that does not support it, are recorded in the repository at docs/legal/process.md section 12a. Cloudflare was already in place and had been missing from the table, and Anthropic handles no Site data at all, so nothing about what reaches a vendor changed on that date. The 30 days stand for every later change.
10. Questions
Reach us through the Contact page and Bobby will answer.