Find
Work out where the person appears across the client’s systems.
Managed data-rights operations · In validation
More privacy-request capacity. Without another senior hire.
Trace is developing the operations layer behind data-rights requests: source mapping, evidence retrieval, review-ready case packs and audit trails. Privacy professionals keep legal judgement and the client relationship.
No production access. Do not send request details, identities, exports or credentials through this website.
Prototype interface · Sample data
Case TR-0241 · Illustrative case
Access request · Synthetic rehearsal
Prepared for authorised review01
Intake
Intake
02
Sources
Sources
03
Evidence
Evidence
04
Review boundary
Review boundary
Sources in scope
PGPostgresMapped
STStripeMapped
INIntercomMapped
Latest events
Evidence manifest prepared
Retention exception recorded
Source inventory completed
Synthetic intake recorded
Evidence manifest
Case summaryPDF
Source inventoryCSV
Exception notes1 open
Activity recordJSON
Review boundary
ARAuthorised reviewerDecision remains with customer
One retention exception remains visible. Disclosure, redaction, erasure and final wording require an authorised decision.
The capacity problem
Senior privacy time is being spent on retrieval, not judgement.
A data-rights request may require legal judgement, but much of the work around it is operational: finding the systems, matching identifiers, chasing exports, documenting gaps and preparing a case another person can review. Privacy firms absorb that work inside senior delivery. Internal teams rebuild it from scratch.
Structure
Record what was searched, what was found and what remains uncertain.
Prepare
Turn fragmented evidence into one case an authorised professional can decide.
Two ways in
One operating layer. Two ways to use it.
01 / Partner model Explore the partner model 02 / Direct model See the SaaS workflow
For outsourced DPO and privacy firms
Add delivery capacity behind your existing service. You keep the client, the advice and the final judgement. Trace is being designed to handle the repeatable retrieval and evidence work beneath it.
For modern SaaS teams
Create a known path through your systems before a request becomes an internal project. Trace is being designed to prepare the case and escalate only defined exceptions.
The proposed workflow
From incoming request to a review-ready case.
The workflow ends at a visible decision boundary. Disclosure, redaction, retention, erasure and final wording remain with an authorised privacy professional and the controller.
- 01
Intake recorded
- 02
Scope and identity state confirmed
- 03
Approved sources searched
- 04
Evidence organised by source
- 05
Exceptions made visible
- 06
Case prepared for authorised review
Clear ownership
Trace prepares. Authorised privacy professionals decide.
This is the proposed operating boundary under validation. It is not yet a responsibility structure contractually operational for all customers.
Proposed operating role
Trace is being designed to prepare
- Intake and case structure
- Source maps
- Approved retrieval coordination
- Source inventories
- Evidence organisation
- Draft response structure
- Exception notes
- Timestamped activity records
- Closure evidence
Decision boundary
The authorised privacy professional retains
- Identity sufficiency decisions
- Interpretation of the request
- Disclosure and redaction decisions
- Retention and exemption decisions
- Erasure or correction authorisation
- Legal advice
- Final response approval
- The client and requester relationship
The first paid wedge
Map the workflow before a real request tests it.
The proposed Readiness Sprint is a fixed-scope engagement that maps up to three systems, defines the evidence path and rehearses one synthetic request. It is designed to produce something useful before Trace handles any live request.
Target price under validation€2,500
- Source map for up to three agreed systems
- Identifiers and matching assumptions
- Source owners and retrieval paths
- Decision and exception boundaries
- Synthetic dry run
- Illustrative evidence pack
- Readiness gaps and recommended next steps
No live personal data is required for the synthetic dry run. Payment can follow only after scope, delivery capacity and terms are confirmed in writing.
Explore the Readiness SprintIntake ownership
Who receives the request, records it and owns the next hand-off.
Identity matching
Which identifiers connect the same person across agreed systems.
Source coverage
Which sources are in scope, how they are checked and where gaps remain.
Decision boundary
Which questions require an authorised privacy professional.
Evidence trail
What records the search, exceptions, decisions and closure path.
Deliberately narrow
Start where the workflow can become repeatable.
- Outsourced DPO or privacy firms with multiple clients
- Modern SaaS, marketplace and subscription companies
- Structured customer data
- Approximately three primary sources
- Stable identifiers such as email address or user ID
- A named privacy decision owner
- A willingness to test the workflow on synthetic data
- Employee disputes
- Litigation or contested legal matters
- Broad mailbox, Slack or file-share discovery
- Health data or children’s data
- Large volumes of unstructured documents
- Autonomous legal decisions
- Organisations requiring certifications Trace cannot yet evidence
- Urgent live matters before scope and delivery capacity exist
See the output
Understand the proposed deliverable before the product exists.
The sample case uses fictional people, systems and records. It shows the intended structure of a review-ready case: what was searched, what was found, which questions remain open and where human judgement begins.
TRACE / SYNTHETIC CASE 001
- Case summary
- Source inventory
- Evidence manifest
- Exception register
- Decision boundary
- Activity record
Fictional records only
Commercial model under validation
Readiness first. Coverage after the workflow is proven.
Open for design-partner discussions
Readiness Sprint
Target €2,500 one-time
Explore the Readiness Sprint Map up to three systems and rehearse one synthetic request.
Planned
Privacy Operations Coverage
Expected from €750 per month
Maintained source map, monitored readiness, periodic tests and reserved operational capacity.
Planned
Standard request preparation
Expected €750 per standard request
A mapped, structured request prepared for authorised review within an agreed scope.
These prices are being tested. They are not a checkout, binding offer or promise of production availability.
Founder note
A note from the founder
“I am building Trace to understand whether privacy teams need a dependable operations layer between advice and the actual work of finding, structuring and evidencing a request. I am looking for privacy professionals willing to walk through their last real workflow: where it became manual, where senior judgement was needed and what should become repeatable.”
Mees Tierolff · Founder, Trace
Email Mees about your workflowStraight answers
Questions before a workflow conversation.
What is managed data-rights operations?
It is the operational work around a request: mapping sources, coordinating approved retrieval, structuring evidence, documenting exceptions and preparing a case for an authorised privacy professional to decide.
Is Trace a law firm or external DPO?
No. Trace is developing an operations layer for privacy professionals and internal teams. It does not provide legal advice or replace the controller, external DPO or authorised decision-maker.
Is Trace already live?
No. Trace is pre-launch and validating the operating model with prospective design partners. There is no production service or general availability today.
What is a Readiness Sprint?
A proposed fixed-scope engagement to map up to three agreed systems, define the evidence path and rehearse one request using synthetic data. The target price under validation is €2,500.
Who makes the final privacy decisions?
The authorised privacy professional and controller retain decisions about identity, interpretation, disclosure, redaction, retention, exemptions, erasure, correction and final wording.
Do I send request data through this website?
No. Do not send identities, request contents, exports, credentials or other personal data through this website. The first conversation is only about the workflow.
Which systems are in the initial scope?
The proposed starting point is up to three structured systems with stable identifiers and an agreed retrieval path. The actual systems and boundaries would be confirmed in writing.
Can a privacy firm use Trace behind its own client service?
That is the primary model under validation. The firm would keep the client relationship, advice and final judgement while Trace prepares the repeatable operational layer beneath it.
What happens after I join the waitlist?
Trace may invite a small number of relevant teams to a workflow conversation. Joining does not create a contract, reserve delivery capacity or authorise access to any system.
Why test readiness before a real request arrives?
A synthetic rehearsal can expose missing owners, identifiers, retrieval paths and decision boundaries without using live request data or discovering those gaps against a deadline.
Founding design partners
Show us where the last request became expensive.
Join the design partner list or describe the workflow in an email. Do not send names, request contents, exports or credentials. The first conversation is about the operating problem, not access to personal data.