Trace Privacy Policy

Last updated: October 27, 2026

Ember Labs, LLC ("Trace", "we", "us") makes software that helps online merchants respond to card chargebacks. This policy covers two groups of people: merchants who use Trace, and their customers, whose order details pass through Trace when a dispute is filed.

What we collect and why

From merchants

Account details: name, email address, business name, and the business details you enter in your profile (website, policies, how you verify customers).
Billing details. Card payments are handled by Stripe, or by Shopify for stores installed from the Shopify App Store. We never see or store full card numbers.
Connection credentials for your store and payment processor (for example a Shopify access token, a WooCommerce key, a Stripe restricted key, Braintree or Square credentials). They are encrypted at rest and used only to read disputes and evidence and to submit your approved response.
How you use Trace: which disputes you open, edit and send, and the responses you approve (the activity log).

From your store and payment processor, for each disputed transaction

The dispute itself: amount, reason, deadline, status and outcome.
The order: items, amounts, shipping address, carrier and tracking, delivery status.
The customer: name, email and billing and shipping address. We do not ask for phone numbers.
Payment checks: card brand and last four digits, address and security-code check results, 3-D Secure result, risk signals, and the customer's earlier payments with you.

We collect only what is needed to assemble evidence for a dispute and, for decided disputes from the past year, to show you patterns in your own results.

How we use it

To assemble the evidence for a dispute, draft a response with the help of an AI model, and, after you review and approve it, submit it to your payment processor.
To run your account, send alerts and deadline reminders, bill you, and provide support.
To show you statistics, patterns and reports about your own disputes.
To keep Trace secure and prevent abuse.
In anonymized, de-identified form only (see below), to improve how Trace works.

We never auto-submit a response without your approval. We never sell personal data. We never use customer data to contact customers or for advertising.

AI processing

Drafting uses a third-party AI model provider. Dispute facts are sent to it to write the draft. Under our agreement with the provider, that data is not used to train its models.

Who we share data with

Only the service providers needed to run Trace, under contracts that limit them to doing that work: hosting and database (Vercel, Supabase), queueing (Upstash), email (Resend), error monitoring (Sentry, with personal data scrubbed), authentication (Clerk), payments (Stripe, and Shopify for Shopify-billed stores), and the AI model provider. We also send your approved response and files to your payment processor, which passes them to the card network. We may disclose data if the law requires it.

Anonymized data

After the retention period below, we keep only de-identified records of disputes: reason code, kinds of evidence used and outcome, with nothing that identifies a customer. We use them to improve drafting and to build aggregate statistics. They are not tied to an individual customer.

How long we keep data

Customer details tied to a dispute: for the life of the dispute plus 2 years after it is decided, then deleted or irreversibly anonymized.
If a merchant disconnects Trace or closes their account: customer details tied to their disputes are deleted within 90 days.
If a store uninstalls the Trace app from Shopify: the store's data is erased 48 hours later unless the store reconnects.
Account and billing records: as long as the account exists and for the period tax and accounting law requires.

Your choices and rights

Merchants can ask us to delete their account data at any time, except where records for a dispute still in progress or recently decided must be kept.
A customer of a merchant who wants their data accessed or deleted should ask that merchant, who can forward the request to us. For Shopify stores, we also respond to Shopify's customer data request and redaction webhooks automatically.
Depending on where you live (for example the EU, UK or California) you may have additional rights, including access, correction, deletion and objection. Write to the address below.

Security

Data is encrypted in transit and at rest. Credentials are encrypted with a separate key. Production and test data are kept in separate systems. Access to customer data is limited to what is needed, is recorded, and requires strong authentication for staff. If a security incident affects your customers' data, we will tell you without undue delay and within 72 hours of confirming it.

Children

Trace is for businesses and is not directed to anyone under 16.

Changes

We will post changes here and, for material changes, email merchants.

Contact

support@tracechargebacks.com Â· Ember Labs, LLC, 302 Riverbend Blvd, Longwood, FL 32779