Notice

How TRACE handles personal data you send

7Unit operates TRACE Surface Scan and decides why personal data you send is used. DPDP is the Indian personal data protection statute that applies to that handling. This page is the notice of what is collected and why. A Surface Scan of a submitted domain records public engineering evidence. It does not collect that organisation's customer records through these forms.

This is not a legal compliance determination about any scanned organisation.

What you can send

• Work email, used to send a verification link and the complete engineering report for that scan.
• Name, organisation, optional phone, and optional message, used to contact you about an Engineering Audit request.
• Organisation-declared Internal Readiness answers, stored with the verified report session for that scan.

What these forms do not create

• A marketing or newsletter list.
• Plaintext results tokens or magic-link tokens in Postgres.
• Cookie values from scanned sites.

What a Surface Scan records

A scan records publicly visible engineering evidence for the submitted domain. That evidence is about the public surface. It is not a personal account.

Session identifiers

An anonymous browser session identifier is used for the complimentary scan allowance and funnel events. Public IP addresses used for allowance are stored as HMAC keys in Redis, not as plaintext in Postgres.

Mail TRACE sends

Transactional only: verification, the requested report, and an Engineering Audit notice to 7Unit. No nurture sequence.

Access, correction, and erasure

Write to hello@7unit.tech to request a copy, a correction, or erasure of personal data you sent. The same address receives opt-out and abuse reports.

Optional measurement scripts, when configured, record public page views on the homepage and scanner disclosure. They are not loaded on report, verification, or this notice. Work emails are not sent to those scripts.