How Tracewise handles your documents.

01Responsibilities and ownership.

Your organisation decides which documents to provide and must have authority to do so. The Tracewise operator must identify its legal entity, contact details and responsibilities for account data and uploaded documents in the final privacy notice. Nigeria Data Protection Act the Commission's directive

02Applicable data-protection duties.

Applicable privacy and data-protection requirements depend on the operator, users and processing locations. The final service documentation must identify the legal basis, incident contact and notification process; no compliance certification or response deadline is asserted here.

03The document journey.

Document content and extraction instructions may be sent to the configured Azure processing services. The exact request payloads, stored results and any logging must be documented for the deployed configuration.

04Storage and retention.

Tracewise stores workspace records in Cloudflare D1 and original documents and revision snapshots in R2 through Sites. Trash and restore preserve history; permanent erasure and scheduled retention are not implemented. Storage residency, backups and contractual retention commitments still need operator confirmation. privacy notice

05AI processing services.

Document processing uses Azure Document Intelligence for OCR and Azure OpenAI for field extraction. The deployed path has been tested with synthetic invoices. Confirm the applicable resource locations, routing and transfer arrangements with the operator before relying on a residency requirement.

A document’s contents can include names, phone numbers, signatures and other personal data. Field descriptions may also accompany extraction requests. Upload only material you are authorised to process and avoid unnecessary sensitive information.

Provider handling, retention, model-use restrictions and regional commitments depend on the Azure services and settings in use. Obtain the applicable provider documentation and a verified deployment summary before relying on a residency or training-use requirement. privacy notice tell us

06Protection and review history.

The workspace keeps original readings, reviewer changes and approved revision snapshots. New audit events form a SHA-256 chain per workspace; older events remain readable without a chain. These application controls are not a claim of certified or externally immutable storage.

07Files shared for a demonstration.

Use sample or redacted files for an initial demonstration. Agree with the operator on purpose, recipients, retention and deletion before sharing real records. A request form should not be treated as authorisation to publish or reuse your documents.

08Access and permissions.

ChatGPT sign-in is supplied by the hosting platform. Tracewise separately checks workspace membership and role for each operation. Invitations are email-bound links with seven-day expiry, shared manually. The hosted application remains private: an invitation or API key does not grant outer hosting access.

Tracewise uses ChatGPT sign-in through its hosting platform. It does not maintain a separate password database. Access to stored documents and workspace operations is checked by the application.

09Personal data within documents.

Documents may identify other people. Extract only the fields you need, restrict who can view them and establish an appropriate retention period. Confirm how deleting a document affects derived values, logs and backups.