The short version
- We collect what we need to run Spectrace: your account details, records of how the service is used, and billing details if you pay.
- Content that teams put into Spectrace belongs to them. We process it on their behalf and only to provide the service.
- AI features send the content they need to OpenAI. Neither OpenAI nor we use it to train AI models.
- We do not sell personal data, and we use no advertising, analytics or tracking cookies.
- Our database is in the European Union. Some providers process data in the United States, under legal safeguards.
- You can access, correct, delete or export your data. Email hello@spectrace.io.
1Who we are
Spectrace is provided by Spectrace Ltd, a company registered in England and Wales with company number 17472485. Our registered office is 128 City Road, London EC1V 2NX, United Kingdom.
For the personal data this policy describes as ours, Spectrace Ltd is the controller: we decide how and why it is used. You can contact us about privacy at hello@spectrace.io or by post at our registered office. A director of Spectrace Ltd is responsible for data protection at Spectrace, and is the person in charge of the protection of personal information for the purposes of Quebec law.
2What this policy covers
This policy explains how we handle personal data when you visit spectrace.io, create an account, are invited to a workspace, use Spectrace (including the web app, the GitHub App, the VS Code extension, the MCP server and the API), request access, contact us, or pay for a subscription.
Content that customers put into Spectrace
Our customers are the businesses and teams that use Spectrace. The content they and their users put into a workspace, or connect to it, belongs to them: requirements, acceptance criteria, test cases, comments, attachments, imported documents and issues, source code and pull request data from connected repositories, Slack messages sent to Spectrace, and the names, email addresses, comments and approvals of people who review a requirement through a shared review link. We call this workspace content.
For workspace content, the customer is the controller and we are its processor: we handle it only to provide Spectrace to that customer, on its instructions, under our Data Processing Addendum. The customer's own privacy notice explains how it uses that data. If you appear in a customer's workspace content (for example you are named in a requirement or an imported issue) and want to exercise your rights, please contact that customer. If you contact us instead, we will tell you who to contact or pass your request on where we can identify the customer.
This policy still describes how we protect workspace content, which providers process it, where, and for how long, so that customers and the people in their content can see it.
3Personal data we collect
| Kind | What it includes | Where it comes from |
|---|---|---|
| Account details | Your name, email address, profile picture and job title; your workspaces and roles; how you sign in. Your password is stored by our sign-in provider in hashed form. | You, or Google or GitHub if you sign in with them |
| Invitations | The invitee's email address and role, any message added, and who sent the invitation. | The person who invites you |
| Connected accounts | Your user name and identifiers in GitHub, GitLab, Jira, Linear or Slack when you connect them, and access tokens, which we store encrypted. | You and the service you connect |
| Billing details | Billing name, email and address, tax ID, subscription and payment history, and your card's brand, last four digits and expiry date. Stripe collects and holds card numbers; we never receive them. | You and Stripe |
| Messages to us | Emails and feedback you send us, with your email address and, for feedback sent in the app, the page you were on and your browser. | You |
| Access requests | Your email address and anything else you tell us when you ask for access while sign-up is by invitation. | You |
| Activity records | Records of what is done in a workspace and by whom, with names and email addresses (audit logs); usage of plans and allowances; records of background jobs; requests that AI agents make over the MCP server, with credentials removed; and whether our emails were delivered and, where our email provider reports it, opened. | Your use of Spectrace |
| Editor activity | If you use the VS Code extension: which files you work on for a requirement and, in a session you start with Start with SpecAI, the paths of files that change in your workspace and up to 4,000 characters of their new or changed lines, used to show which acceptance criteria the work covers. | Your editor |
| Technical and security data | IP address, browser and device type, pages requested, and the approximate location (country and city) worked out from your IP address when you use the access page; logs kept by our hosting provider. | Your device |
| Error reports | Technical details of errors, the page and your browser. When an error happens in your browser, a recording of the moments before it, with all text masked and all images and media blocked. For a sample of visits, measurements of how long pages take to load. | Your device |
We do not ask for special categories of personal data, such as health or religious beliefs, and we ask customers not to put them into Spectrace.
4How we use personal data, and our legal bases
UK and EU data protection law requires a legal basis for each use of personal data. These are ours.
| What we do | Legal basis |
|---|---|
| Create and run your account, and provide Spectrace and its features | Performing our contract with you. Where you use Spectrace through your employer's or another organisation's workspace, our legitimate interest in providing the service that organisation has asked for. |
| Send emails about the service, such as sign-up and sign-in links, invitations, security notices, trial and billing notices, and notices about your workspace | Performing our contract with you, or our legitimate interest in running it |
| Take payments, issue invoices, calculate tax and keep financial records | Performing our contract, and complying with our legal obligations under tax and company law |
| Keep Spectrace secure, prevent fraud and abuse, enforce plan limits, and control access while sign-up is by invitation | Our legitimate interest in protecting Spectrace, our customers and you |
| Find and fix errors and keep the service reliable | Our legitimate interest in providing a service that works |
| Answer your messages and feedback | Our legitimate interest in helping you, or performing our contract |
| Understand how Spectrace is used, from our own activity records, so we can improve it and plan capacity | Our legitimate interest in improving Spectrace |
| Comply with the law, respond to lawful requests, and deal with legal claims | Our legal obligations, and our legitimate interest in protecting our rights |
Where we rely on legitimate interests, we have weighed them against your rights and interests. You can object at any time (see Your rights).
We do not send marketing emails. If we start, we will send them only to people who have agreed to receive them or, where the law allows, to customers about similar products, and every one will include a way to unsubscribe.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.
You need to give us your name and email address to create an account, and billing details to buy a paid plan. Without them we cannot provide Spectrace or the plan. Everything else is up to you.
5AI features
Some features of Spectrace use AI models: extracting requirements from documents, text, web pages and Slack messages; improving requirements; suggesting acceptance criteria; generating test cases; checking requirements for ambiguity; checking pull requests against requirements; commit messages and progress hints in the VS Code extension; and the same tools when AI agents use them through the MCP server.
To provide these features we send the content each one needs to OpenAI, which processes it for us as a service provider. That can include requirement text, imported documents, Slack messages, recently changed lines of code from a VS Code session and, for pull request checks, the pull request description, its code changes and related code from the repository. We also turn requirement text and repository code into embeddings (numeric representations used to find related items) and store them in our database.
OpenAI does not use content we send it to train its models. Under its terms for business customers it may keep that content for up to 30 days to detect abuse, and then deletes it unless the law requires it to keep it longer. We do not use personal data or workspace content to train AI models either.
Before sending content, most features remove recognisable credentials such as API keys, tokens and passwords. They do not remove names or other personal data, so we encourage customers to keep personal data in requirements to what their work needs.
AI output can be wrong, and nobody's rights are decided by it. If you connect your own AI tool to Spectrace, for example an AI coding agent through the MCP server or an assistant through the VS Code extension, what you send to that tool is handled under your agreement with its provider.
7Our service providers
These providers process personal data on our behalf. For workspace content they are our sub-processors under the Data Processing Addendum. We will update this list, and notify customers as the addendum requires, before a new provider starts processing workspace content.
| Provider | What it does | Personal data | Location |
|---|---|---|---|
| Supabase | Sign-in, the database and file storage | Account details and all workspace content | European Union (Frankfurt, Germany), with support access from the United States and Singapore |
| Vercel | Hosting the website, the app and its API | All data passing through the Service, including IP addresses | United States and European Union (Frankfurt, Germany) |
| Trigger.dev | Background jobs, such as indexing code, AI processing, verification and email | The workspace content and account details each job works on | United States |
| OpenAI | AI models and embeddings for the AI features | Workspace content sent for AI processing, including source code and pull request changes | United States |
| Brevo | Sending service emails | Recipients' email addresses and the content of the emails | European Union (France and Belgium) |
| Stripe | Payments, invoices and tax | Billing contact details, billing address, tax ID and payment card details | United States, European Union and United Kingdom |
| Sentry | Error monitoring | Error reports and, for errors in the browser, recordings with all text masked | European Union (Frankfurt, Germany) |
| Upstash | Caching | Internal identifiers, roles and workspace names; no names or email addresses of people | United States |
8International transfers
We are based in the United Kingdom. Our database and file storage are in the European Union, in Frankfurt, Germany. Some of our providers process data in the United States, and our database provider's support staff may access it from the United States and Singapore, as the table above shows.
Transfers to the European Union rely on the UK's adequacy regulations for the EEA. Transfers to US companies certified under the UK Extension to the EU-US Data Privacy Framework rely on the UK's adequacy regulations for the United States, and, for data from the European Union, on the European Commission's adequacy decision for the Data Privacy Framework. Other transfers, including those to OpenAI and to our database provider, rely on the standard contractual clauses approved by the European Commission, with the UK's International Data Transfer Addendum where UK law applies. You can ask us for a copy of the safeguards that apply.
9How long we keep personal data
| Data | How long we keep it |
|---|---|
| Account details | While your account exists. When you delete your account, we delete them 30 days after you confirm the deletion (you can cancel during that time), and keep only a record that the deletion happened. |
| Workspace content, including activity records within a workspace | Until the customer deletes it, or the workspace is deleted. We then delete it within 90 days. |
| Billing and tax records | 6 years after the end of the financial year they relate to, as UK law requires |
| Messages and feedback | 2 years after we last hear from you |
| Access requests | Until 12 months after sign-up opens to everyone, unless you ask us to delete them sooner |
| Access page logs | 12 months |
| Requests made by AI agents over the MCP server | 6 months |
| Email delivery records | 12 months |
| Invitations | 12 months after they are accepted, revoked or expire |
| Error reports | Up to 90 days |
When you delete your account, content in workspaces that continue belongs to those workspaces and stays there; we remove your name from it where we can. Invoices stay with our tax records. We may keep data longer where the law requires it or to establish, exercise or defend a legal claim.
10Your rights
Under UK and EU data protection law you have the right to: access the personal data we hold about you and get a copy; have it corrected; have it deleted; restrict how we use it; receive it in a portable format; object to our use of it based on legitimate interests; and withdraw any consent you have given. You can also object at any time to direct marketing.
Many of these you can do yourself in Spectrace: edit your profile under Settings, delete your account under Settings, Account, and export a project's requirements from its requirements list. For anything else, email hello@spectrace.io. We may need to confirm your identity. We will reply within one month, or tell you within that month if we need up to two more months because the request is complex. There is no charge in most cases.
If your data is in a customer's workspace content, the customer decides on your request, as explained in What this policy covers.
Your right to object
Where we use your personal data on the basis of our legitimate interests, you can object at any time, on grounds relating to your situation, by emailing hello@spectrace.io. We will then stop, unless we have compelling legitimate grounds that override your interests, or need the data to establish, exercise or defend a legal claim.
Complaints
If you are unhappy with how we have handled your data, you can complain to us at hello@spectrace.io. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome. You also have the right to complain to the Information Commission, the UK's data protection regulator (ico.org.uk), or, in the European Union, to the data protection authority where you live or work.
11If you are in the United States
Wherever you live, you can ask us to tell you what personal data we hold about you, to give you a copy, to correct it and to delete it, as described in Your rights. You can authorise someone to make a request for you; we may ask them for proof. If we decline a request, you can appeal by replying to our decision, and if you are not satisfied with the outcome, contact your state attorney general. We will not treat you differently for exercising these rights.
The categories of personal information we collect are identifiers (such as name, email address and IP address), customer records (such as billing details), commercial information (such as subscriptions), internet activity (such as logs of pages requested), approximate location derived from an IP address, and professional information (such as job title). We collect them from the sources and use them for the purposes described above, and disclose them only as described in Who we share personal data with.
We do not sell personal information or share it for cross-context behavioural advertising, and we have not done so in the past 12 months. We do not share personal information with third parties for their own direct marketing. We do not collect, use or sell personal data to train large language models.
The only sensitive personal information we collect is what you use to sign in, such as your password and the access tokens of services you connect. We use it only to sign you in and keep accounts secure, never to infer characteristics about you.
Do Not Track and Global Privacy Control: we do not track visitors across other websites, and we do not allow third parties to collect information about your activity over time and across websites through Spectrace. We have no advertising or analytics trackers, so these signals do not change how Spectrace works. We treat a Global Privacy Control signal as a request to opt out of sale and sharing, which we do not do in any case.
Nevada residents may send a request not to have their personal information sold to hello@spectrace.io. We do not sell personal information, and we will confirm that in reply.
12If you are in Canada
By using Spectrace, you agree to our collection, use and disclosure of your personal information as this policy describes. You can withdraw that agreement, subject to legal and contractual limits, though we may then be unable to provide Spectrace to you.
Your personal information is stored and processed outside Canada, by us and by the service providers listed above: in the United Kingdom, the European Union (Germany, France, Belgium and Ireland), the United States and Singapore. It may be accessible to courts and authorities under the laws of those countries. Our service providers may use it only to provide their services to us.
The person in charge of the protection of personal information at Spectrace is a director of Spectrace Ltd, who you can reach at hello@spectrace.io. You can ask to access and correct your personal information, or ask about our policies on service providers outside Canada, at the same address. This policy also summarises our practices on keeping and destroying personal information, on who in our team can access it, and on handling complaints. You can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, to the Commission d'accès à l'information.
14Security
We protect personal data with measures that include encryption of data in transit, encryption of stored data by our hosting providers, additional encryption of access tokens for connected services, storing API keys and one-time codes only as hashes, role-based access within workspaces, and limits on repeated sign-in and API requests. The Security page in our documentation gives more detail, and the Data Processing Addendum lists the measures we commit to.
Within Spectrace, only the people who need access to provide, secure or support the service can access personal data, and they are bound by confidentiality.
No system is completely secure. If a breach affects your personal data, we will tell you and the authorities where the law requires.
15Children
Spectrace is a business tool for adults. You must be 18 or over to create an account, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.
16Changes to this policy
We will update this policy when our practices change. We will post the new version here with a new date and, if a change is significant, we will tell account holders by email before it takes effect.
We will not start using personal data in a materially different way from what this policy describes, such as using it to train AI models, without telling you first and, where the law requires it, asking for your consent. Such a change applies only to data collected after it takes effect, unless you agree otherwise.
17Contact us
Email hello@spectrace.io, or write to Spectrace Ltd, 128 City Road, London EC1V 2NX, United Kingdom.
Registered in England and Wales, company number 17472485.