Complete case summary
Request type, scope, identity state, target and open decisions.
Managed GDPR request operations · Early access
Turn every GDPR request into a review-ready response pack in 24 hours.
For an accepted pilot, forward the request or connect your intake. Trace would map the case across your tools, assemble the available evidence, draft response and audit timeline, then flag what needs human review.
For product teams with user data spread across modern cloud tools.
Application only—no payment today Pilot target—not yet a demonstrated SLA No autonomous legal decisions
Prototype interface · Sample data
Case TR-0241 · Illustrative case
Access + erasure request
Ready for review01
Intake
Intake
02
Scope
Scope
03
Evidence
Evidence
04
Review
Review
Sources in scope
SBSupabase24 records
STStripe7 records
INIntercom11 records
S3Object storageReview flag
Latest events
Draft response prepared
Third-party data flagged
Stripe records mapped
Request received
Response pack
Case summaryPDF
Source inventoryCSV
Evidence packageZIP
Audit timelineJSON
Review boundary
ARAuthorised reviewerDecision remains with customer
One exception and one retention question require review before any response or deletion action.
Two clocks, one controlled case
24h01
Proposed target for an accepted request to become a review-ready case pack—not a legal closure deadline.
1mo02
General GDPR time limit for action. Controllers must act without undue delay; a justified extension may apply.
003
New privacy-ops hires is the operating hypothesis. The pilot exists to test whether managed readiness can support it.
02 Official timing guidance: European Data Protection Board. “One month” is not the same as a fixed 30-day period.
The operating model
You forward the request. Trace runs the workflow.
After onboarding—not through this public website—one accepted request becomes one scoped case with a visible review boundary.
See the full workflow01Pilot setup
Map only what matters
Identify the sources, identifiers, access path and known gaps before the clock starts.
02Structured
Capture and classify
Record the request type, identity status, scope, deadline and customer instructions.
03Managed
Assemble the evidence
Retrieve or import in-scope records, normalise the inventory and flag missing or third-party data.
04Human review
Hand off for judgement
Prepare the response draft and case timeline. An authorised reviewer decides what happens next.
The response pack
What is ready for review tomorrow.
The pilot target is a secure, structured case package—not sensitive files sent as ordinary email attachments.
Data-source inventory
What was checked, how it was accessed and what remains unmapped.
Evidence package
Available requester data, organised by source and ready for review.
Response draft
A structured starting point—not final legal advice or autonomous approval.
Exception notes
Third-party data, retention questions, missing sources and uncertainty.
Timestamped timeline
A record of case events and decisions. No immutable-log claim is made.
Your stack stays yours
Connect as little as possible.
Early pilots favour controlled exports and least-privilege access over broad, permanent credentials. Status labels describe reality—not a fake marketplace.
SB SupabasePilot mapping FB FirebasePilot mapping ST StripePilot mapping IN IntercomManual import HS HubSpotManual import ZD ZendeskPlanned PG PostgresPilot mapping S3 S3-compatible storageManual import A0 Auth0Under evaluation
Pilot mapping—configured by handManual import—customer-provided evidencePlanned or under evaluation
See access methods and limitations The decision boundary
Automation where it is safe. Judgement where it matters.
Trace is being designed to assemble, organise and flag. Your authorised reviewer decides what is disclosed, withheld, corrected or deleted.
Assemble what is available
Sources, records, metadata, response draft and open questions in one case.
Decide with context
Third-party rights, exemptions, identity, retention and final wording stay with authorised people.
Trace prepares
Evidence assembled24 source records and one missing-source warning.
Human decides
Disclosure reviewedOne third-party reference requires a case-specific decision.
Trace records
Decision loggedTimeline and package update after authorised approval.
Early-access offer
Start with a concrete outcome.
You are seeing the Paid pilot first presentation. Prices are hypotheses under validation, not a promise of general availability.
Concierge pilot
€1,500 one-time
One test or live request
Map up to three primary sources and prepare one review-ready case with a human review handoff.
- Stack-readiness review
- Up to three primary sources
- One case pack
- Implementation recommendation
Accepted pilots only · terms agreed before payment
Annual
€3,490/ year
Pilot credit subject to approval
Maintain the mapped workflow for future requests after the pilot demonstrates fit.
- Maintained source map
- Managed case operations
- Review handoff
- Audit-package preparation
Commercial hypothesis · credit is not automatic
No checkout is active. Applying does not create a contract. If Trace can accept the work, scope, timing, data handling, price and pilot terms are confirmed before payment or customer data transfer.
Read the full pricing rationaleStraight answers
Before you trust Trace with a request.
The honest answer is sometimes “not yet” or “it depends.” That is part of the product.
What is a data subject access request?
A data subject access request, often called a DSAR, is a request by an individual to exercise the GDPR right of access. The controller generally needs to confirm whether it processes the person’s data, provide a copy, and provide information about that processing. Other rights—such as erasure or rectification—are related but distinct.
Can every request be completed in 24 hours?
No. Trace’s proposed pilot target is a review-ready case pack within 24 hours after an accepted scope and required access are in place. Final legal decisions, identity questions, source outages, complex exemptions and customer approvals may take longer. It is not a promise that every request can be legally closed in 24 hours.
What is the GDPR response deadline?
Controllers must act without undue delay and generally within one month. A justified extension of up to two further months may apply for complex or numerous requests, provided the requester is informed within the first month. See the EDPB explanation.
Does Trace make legal decisions?
No. Trace is being designed to assemble available evidence, structure the case and flag uncertainty. Your authorised reviewer decides what is disclosed, withheld, corrected or deleted and what response is sent.
Which systems can Trace connect to?
Early pilots will prioritise Supabase, Firebase, Stripe, Postgres and controlled exports. The current interface is a prototype; no one-click connector marketplace is claimed. Every source and access method is confirmed during pilot scoping.
Who reviews the response?
The pilot is designed around an authorised human review step. Reviewer identity, qualifications, responsibilities and availability must be agreed in the accepted pilot scope. The public application does not assume that capacity already exists.
What happens to customer data?
No live request data should be submitted through this website. Before any accepted pilot processes case data, the access method, purpose, retention, delivery, deletion and contractual roles must be documented in the pilot terms and DPA.
Is Trace a data processor?
The intended model is for Trace to act on the customer’s documented instructions, but GDPR roles are factual and depend on the actual processing. Exact controller and processor roles will be set out in a reviewed DPA before live data is handled.
Can we begin with one request?
Yes. The proposed concierge pilot is intentionally limited to one accepted test or live request and up to three primary sources. Scope and operational readiness are confirmed before any payment or data transfer.
What if we receive very few requests?
The pilot is intended to test whether a maintained readiness workflow is worth more than restarting coordination each time. If request volume is genuinely low and the stack is simple, a recurring service may not be the right fit.
Why is there an implementation fee?
A request workflow is only useful when it knows where your data lives. Implementation is intended to cover source mapping, access configuration, test retrieval and the first reviewed case. The amount and scope remain commercial hypotheses until accepted in a proposal.
A controlled first request
Your next request should not start with a search through six systems.
Start with one scoped request. Trace is preparing a limited number of concierge pilots for modern product teams.