Effective 2026-10-18. Operated by Track AI ROI. Questions: elijah@trackairoi.com.
1. Who we are and what this covers
Track AI ROI ("the platform", "we") is an independent measurement service for companies that use AI in their work, and for the consulting firms that help them. A company connects the usage it already pays for, states what an implementation is meant to achieve, and the platform computes whether it did. This policy explains what information the platform handles when you use it at trackairoi.com, and what you can do about it.
The platform is built for businesses. Each workspace belongs to a company (or a consulting firm), and the people who sign in act on that company's behalf. Where this policy says "your company", it means the company whose workspace you belong to. Your company decides what goes into its workspace and who at the company may see it; we process that information to run the service for your company.
2. What we collect
Account information
- Name, email address and a password, which we store as a salted hash, never in clear text. If you sign in with Google or Microsoft instead, we receive your name, email address and the identifier those services use for you; we never see your password for those services.
- Session records: a hashed session token, the browser's user-agent string, and when the session was created and last used. Sessions expire after 30 days.
- For a consulting firm, the firm's name and verified email domain, and the public profile the firm chooses to publish (see section 5).
Workspace content your company enters
- Company name, industry, size and departments.
- Workflows, implementations, goals, baselines, sample run timings, costs and subscriptions, confirmed financial events, readiness questionnaire answers, suggestions and comments, roadmap events and check-in responses.
- People at your company who are named as participants in an implementation or as department members: their name, role, department and, where your company adds them, their email address so they can receive check-ins or timing requests.
- Hourly wages, if a company administrator chooses to enter them for department members. Wages are the most sensitive item in a workspace and are treated accordingly: only your company's administrators can see them, they are hidden from any consulting firm unless your company turns sharing on, and they are used only to show your company its own current labor cost.
Metering credentials and the usage they unlock
- API keys your company connects so the platform can read usage from an AI provider (for example an Anthropic, OpenAI or Google Cloud key). Keys are encrypted at rest with AES-256-GCM and are never displayed back after they are saved. Your company can revoke a key at any time; we then stop reading with it and delete our copy.
- Provider usage read with those keys: tokens, requests and cost by day, by model and, where the provider reports it, by the person or key that made the requests. We read usage figures only. We never read, request or store the content of prompts or responses.
- Instrumented runs, if your company adds the platform's run snippet to its own AI solution: when a run finished, how long it took, token counts, cost, which workflow step it belonged to, an environment label, and an identifier for the person running it (such as an email) if your company sends one. The snippet carries no prompt or response content.
- Microsoft 365 Copilot usage, only if a Microsoft 365 administrator at your company grants consent: Microsoft's Copilot usage report, which lists each user's last activity dates by application. We use it to show your company its own adoption. Each time the report is read (normally once a day) the platform keeps one row per person: their Microsoft sign-in name, display name, the roster entry it matched, and their last activity dates, active days and prompt counts by application. Your company's administrators can see who was active. Consent can be withdrawn in Microsoft 365 at any time.
Records from business systems your company connects
- Webhooks and scheduled pulls. Your company can give a business system (a ticketing, CRM or ERP system, for example) a private address to send records to, or have the platform fetch records from it on a schedule with a key your company provides. The platform receives whatever that system sends: typically completed work items with who completed them (a name or email address), timings, costs, financial events and roster entries. Records are mapped to the platform's fields and stored with the source they came from. Events that arrive before a mapping exists are held for up to 7 days; the raw body of each delivery is kept for 30 days so a failed delivery can be inspected and re-sent.
- File imports. A file your company uploads or pastes is held as a draft for up to a day while it is mapped, then deleted.
Workflow recordings
- The recorder. A person can install the Track AI ROI recorder, a browser extension, and press Record on the platform's Workflows page to document a workflow by doing it once. While it runs, the recorder notes the pages used (their title, site and path, never the part of an address after a question mark), the buttons and links used (their labels), the labels of the fields filled in, the time of each, and the step marks and notes the person adds. It never records what is typed into a field, not even how long it was, and it skips any field that looks like a password, card, account, identity or tax number. It takes no screenshots. Recording starts only when the person presses Record from their own account, shows on every page while it runs, and stops when the person presses Stop or after 4 hours. Nobody can start it for someone else, and nobody else can see a recording before the person adds it as a workflow. The recorded events and the draft steps are deleted when the recording is added or discarded, and after 7 days untouched; what remains is the workflow the person approved and a count of its steps.
Information we generate
- Verdicts, KPIs, snapshots of those KPIs over time, and an append-only, hash-chained record of changes to each workspace (the audit trail). Audit entries refer to people and companies by internal identifiers, not by name or email address. Some older entries also carry a name: the name of a roster member who was removed or restored or whose wage was viewed, an engagement's name, or a company's name when it was created. Because the audit trail cannot be edited without breaking the chain that proves it is intact, those older entries are kept as written, including after an erasure (see section 8).
Technical information
- Our hosting provider keeps standard request logs (IP address, path, status, timing) for operating and securing the service. The platform itself keeps a short-lived, in-memory count of sign-in attempts per IP address to slow down brute-force attempts; it is not written to the database.
- Emails we send record whether delivery succeeded.
We do not collect precise location, device identifiers, or any information for advertising, and we do not buy information about you from anyone.
3. How we use it
- To run the service: computing adoption, outcomes, costs and verdicts; producing dashboards, proof reports and scheduled report emails; matching usage to implementations.
- To communicate about the service: invitations, sign-in links, password resets, timing and check-in requests to the people your company names, a single reminder to a person who was invited and has not yet answered the readiness questionnaire, plan and trial notices, deletion confirmations, and replies to your messages.
- To keep the service secure and working: authentication, rate limiting, abuse prevention, debugging and uptime monitoring.
- To bill a subscription, when your company subscribes (see section 6 on Stripe).
- To improve the service, using aggregated figures that do not identify a person or a company.
We do not use your company's data to train AI models, we do not sell it, and we do not share it with advertisers.
4. Who can see what inside the platform
- Your company owns its workspace. Everything in it is visible to the people your company has added, according to their role: administrators can see and change everything (including wages); viewers can see the workspace and contribute suggestions, timings and their own check-in answers.
- A consulting firm your company has engaged can see the workspace while the engagement is open, and keeps read access to the history of implementations it worked on after the engagement ends. It cannot see wages unless your company turns sharing on, and it cannot alter verdicts, baselines once agreed, or confirmed financial events.
- Other companies and other firms see nothing of your workspace. Isolation is enforced inside the database itself, not only in the application.
- The platform operator (us) can see workspace data in order to run the service, respond to support requests and investigate problems. We do not browse customer workspaces otherwise.
5. What can become public
Nothing about your company is shown outside its workspace without a deliberate action by your company. These are the ways information can leave the workspace:
- Proof reports. Your company (or an engaged firm) can open a read-only proof report page for an implementation or for the whole company and share its link. Anyone who has the link can read that page; the links use long random identifiers and are not listed or indexed anywhere. Share them as you would share a document.
- A consulting firm's public profile. A firm may publish its track record at a public address. The profile shows the distribution of its verdicts across every implementation it committed, its realised net cash, and a table of its implementations with client names withheld. A client company's name or report appears there only if that company explicitly consents to be featured, and the consent is the company's to withdraw.
- The marketplace. If your company opts in to being found by consulting firms, firms with a published profile see your industry and size first; your company's name is shared with a firm only when your company accepts an introduction.
- Calendar invitations and emails your company sends through the platform go to the people it addresses them to.
6. Service providers we rely on
We use a small number of providers to run the service. Each receives only what its job needs.
| Provider | Purpose | What it handles |
|---|
| Render (United States, Oregon region) | Hosting the application and the database | All platform data, encrypted in transit and at rest; request logs |
| Resend | Sending email | Recipient address, subject and body of the emails described in section 3 |
| Stripe | Subscription payments, when a company subscribes | Billing contact and payment details, entered on Stripe's own pages; we never see card numbers |
| Google, Microsoft | Optional sign-in; optional Microsoft 365 Copilot usage report | Your name, email and account identifier at sign-in; the usage report only after an administrator consents |
| Anthropic, OpenAI, Google Cloud | Reading usage figures with the keys your company connects | We send your key and a date range to the provider's usage endpoint and receive usage figures. No workspace data is sent for this |
| Anthropic (United States), as a sub-processor | The import assistant, which proposes how the columns of an imported file or webhook feed map to the platform's fields | The column names and, unless "Send column names only" is ticked, up to 40 sample rows of the file, which can include names and email addresses of the people in it; the company's task names and implementation titles; and any instruction the person importing types. The exchange is stored with the import record and emptied after 30 days |
| Anthropic (United States), as a sub-processor | The workflow recorder's draft steps: from a recording, the assistant proposes the steps for the person to review | The recorded events condensed into a log of page titles, sites, button and field labels, step marks, notes and times (never typed values); the department's name; and any instruction the person reviewing types. The exchange is stored with the recording's action record and emptied after 30 days |
If we add or replace a provider that handles customer data, we will update this table before it takes effect.
7. Cookies
The platform sets only the cookies it needs to work, all first-party:
| Cookie | Purpose | Lifetime |
|---|
| kf_session | Keeps you signed in | 30 days, or until you sign out |
| kf_stepup | Remembers that you re-entered your password for a sensitive action | Minutes |
| kf_oauth | Protects a Google or Microsoft sign-in while it is in progress | 10 minutes |
| kf_next | Returns you to the page you asked for after signing in | Until used |
There are no analytics, advertising or third-party tracking cookies, and no tracking pixels in our emails.
8. How long we keep data, and deletion
- While a workspace is active, its data is kept so the record stays complete. The platform's value rests on a continuous, tamper-evident history, so verdicts, baselines, usage figures and the change log are append-only during that time.
- Deleting your own account. You can delete your account from Settings. Your name, email address and sign-in are removed immediately, together with the other places the platform holds them in the workspaces you belonged to or were listed in: roster and implementation entries (and any wage), the name or email on work records from connected systems and imports (replaced with an anonymous label), your rows in the Microsoft 365 activity report, report and check-in recipient lists and send records, questionnaire invitations, the browser details of your sessions, every workflow recording you made, and any import draft, import assistant transcript, captured webhook event or workflow recording in progress that mentions your name or email. Records you created stay, attributed to an anonymous identifier, so your company's history remains intact. Audit-trail entries written before identifiers replaced names stay as written (section 2). You cannot delete your account while you are the last administrator of a company or the last owner of a firm, until you hand that role to someone else.
- Deleting a workspace. An administrator can schedule the whole workspace for deletion. It becomes read-only for 30 days, during which the deletion can be cancelled. Then every person in it is erased as above, and the company's name, contacts, roster, wages, public listing, report recipients, questionnaire invitations, per-person Microsoft 365 activity, import drafts, import assistant transcripts, captured webhook events and workflow recordings are removed; the names on work records are replaced with anonymous labels. Connected keys and sources are disconnected: the Microsoft 365 link, scheduled pulls and measured-usage keys are deleted, webhook addresses and source tokens are revoked with their secrets deleted, and the stored secrets of provider keys are deleted, so nothing is read from or received for the workspace again. Proof figures and the change log remain, anonymised, apart from older audit-trail entries kept as written (section 2).
- Paused workspaces. If a trial ends or a subscription lapses, the workspace becomes read-only. Metering continues for a 30-day grace period. Data is kept for at least 365 days after the pause, and we notify administrators 30 days before anything is removed.
- Connected keys are deleted when your company disconnects them. Hosting request logs are kept by our hosting provider for a short period under its retention policy.
- Fixed retention windows, applied by a daily job:
- Sessions expire after 30 days and are deleted 30 days after they expire or are signed out.
- Sign-in, invitation and password-reset links are deleted 7 days after they expire or are used.
- Import drafts: up to a day.
- Webhook events waiting for a mapping: up to 7 days. Raw delivery bodies: 30 days.
- Import assistant transcripts (the sample rows sent to Anthropic and its reply): emptied after 30 days. A record that the assistant ran, with its cost and outcome, stays.
- Workflow recordings: the recorded events and draft steps are deleted when the recording is added as a workflow or discarded, or after 7 days untouched; the closed record (identifiers and counts only) is deleted after 30 days. The assistant's log of the recording is emptied with the transcripts above.
- Records of scheduled report and check-in emails, which list the recipients: 180 days.
9. Security
Connections use TLS. API keys are encrypted at rest with AES-256-GCM under a key held only by the platform. Passwords are stored as salted hashes. Each company's data is separated by row-level security rules enforced by the database for every query, and the roles that compute verdicts are separate from the roles that read and write workspace data. Changes to a workspace are written to an append-only, hash-chained log. Sensitive actions require re-entering your password. No system is perfectly secure; if we learn of a breach affecting your information we will tell your company's administrators without undue delay.
10. Your choices and rights
- See and correct your account details in Settings, and your company's content in its workspace.
- Take a copy. A company's administrators and a firm's owners can download the workspace's data as a JSON file from Settings, under Account. Stored keys and secrets are left out.
- Delete your account, or ask your company's administrator to delete the workspace, as described in section 8.
- Stop check-in and timing emails for yourself with the opt-out in each email or in Settings; your company's administrators can turn them off for everyone.
- Withdraw Microsoft 365 consent in Microsoft 365, revoke a connected key in Settings, unpublish a firm profile, or withdraw consent to be featured, at any time.
- Ask us at elijah@trackairoi.com for a copy of the personal information we hold about you, or to correct or delete it. We answer within 30 days. If your information was entered by your employer's company, we may refer the request to that company, since the workspace is theirs.
11. Notice for California residents
In the past twelve months we have collected the categories of personal information described in section 2: identifiers (name, email, account identifiers), professional information (role, department, employer, and, where entered, wages), internet activity on the platform (session and usage records), and inferences drawn from usage figures (adoption). We collect them for the purposes in section 3, from you, from your company, and from the providers your company connects. We disclose them only to the service providers in section 6, and, where your company chooses, as described in section 5. We do not sell personal information and we do not share it for cross-context behavioral advertising. California residents may request access to, deletion of, or correction of their personal information, and may not be discriminated against for doing so, by writing to elijah@trackairoi.com. Much of the information on the platform is handled on behalf of your employer; where that is the case, we will direct the request to them and help them respond.
12. Children
The platform is a business service and is not directed at anyone under 18. We do not knowingly collect information from children.
13. Changes to this policy
When this policy changes, we update the effective date at the top. For changes that affect what we collect or who we share it with, we also notify workspace administrators by email before the change takes effect.
Track AI ROI, operator of Track AI ROI. Email elijah@trackairoi.com.
See also the Terms of Service and how verification works.