TRACER Privacy Policy

1. About This Privacy Policy

TRACER is a research information management and institutional research platform provided by BytesWrite Solution Private Limited (“BytesWrite”, “we”, “us”, or “our”).

TRACER enables educational and research institutions to manage and present information relating to faculty members, researchers, publications, intellectual property, funded research, consultancies, awards, events, supporting documents, research metrics, analytics and related institutional activities.

This Privacy Policy explains how personal data and related information may be collected, received, used, stored, shared, displayed, protected, retained and deleted in connection with TRACER.

TRACER is primarily provided as an institutional business-to-business service. Accordingly, certain processing activities are carried out on behalf of the Institution using TRACER, while certain limited processing activities are undertaken by BytesWrite to operate, secure, support and administer the platform.

This Policy should be read together with the applicable TRACER Terms & Conditions and, where relevant, any agreement or data-processing arrangement entered into between BytesWrite and the Institution.

2. The Institution’s Role and BytesWrite’s Role

The Institution using TRACER generally determines matters such as:

• which faculty members, researchers and other users are included in TRACER;
• what institutional information is provided to the platform;
• which users receive access;
• how roles and permissions are assigned;
• how institutional records are reviewed or verified;
• which records are used for institutional reporting; and
• which eligible professional or research information is made publicly accessible.

3. Information TRACER May Process

The information processed through TRACER depends upon the Institution’s configuration and the modules being used. It may include the following categories.

4. Where Information Comes From

Information processed through TRACER may come from several sources.

5. Why We Process Information

Information may be processed for purposes including:

• providing and operating TRACER;
• maintaining institutional research information;
• creating and maintaining researcher and faculty profiles;
• managing publications and research outputs;
• managing intellectual property and research projects;
• supporting institutional research administration;
• operating verification and approval workflows;
• generating reports, dashboards, statistics and exports;
• supporting authorized institutional reporting requirements;
• retrieving, associating and enriching research metadata;
• providing public research profiles where authorized;
• authenticating users;
• maintaining security and preventing misuse;
• providing technical and customer support;
• diagnosing and resolving service issues;
• understanding and improving service performance;
• complying with applicable contractual obligations; and
• complying with applicable law.

6. Public Research Profiles

One of TRACER’s purposes is to help Institutions present their research activity in a structured and transparent manner.

Where enabled by the Institution, certain professional and scholarly information may be made publicly accessible through TRACER’s public-facing research features.

Public information may include categories such as researcher name, photograph, academic or professional position, department, research interests, selected education information, professional profile links, publications, research metrics, intellectual-property information, funded research, awards, and other authorized professional research information.

BytesWrite enables public display pursuant to the Institution’s configuration, authorization or documented instruction.

Internal institutional records, administrative information and supporting documents are not intended to become public merely because they are maintained in TRACER.

Public research information may be indexed, cached or independently stored by search engines and other third-party services. Accordingly, removal of information from TRACER may not immediately remove copies that have previously been indexed or independently stored by third parties outside BytesWrite’s control.

7. Research Data Transparency and Accuracy

TRACER may consolidate research information from multiple sources, including institutional records, submissions by researchers and coordinators, authorized external research sources, and automated metadata-enrichment processes.

Different sources may occasionally contain incomplete, inconsistent or outdated information. Where relevant, TRACER provides institutional workflows through which information may be reviewed, associated, corrected or verified.

Research metrics and metadata originating from external sources may change when those external sources update their records. TRACER therefore does not represent all externally sourced research information as permanently complete or error-free.

8. AI-Assisted Processing

TRACER may use third-party artificial-intelligence services to assist with selected research-information and metadata-enrichment functions.

Depending on the functionality being used, information processed for this purpose may include selected research metadata such as publication titles, author names, affiliations, publication identifiers, venue information, and where an enabled AI-assisted verification feature requires it, the relevant supporting proof PDF(s) associated with the record.

Only information reasonably necessary for the enabled AI-assisted feature is processed for that purpose. The use of a proof PDF for an enabled verification workflow does not mean that all uploaded documents are transmitted to an AI service.

Customer Data, including Customer Personal Data, will not be used by BytesWrite or an AI provider for generalized model training or unrelated model improvement unless expressly authorized in writing by the Institution.

AI-assisted functionality is intended to support research-information workflows and reduce manual effort. It does not replace institutional verification or authoritative research sources where authoritative information is required.

AI-assisted results may be reviewed, corrected or rejected through applicable workflows. BytesWrite may change the technology providers used to deliver such functionality without changing the underlying purposes described in this Policy.

9. Service Providers

BytesWrite uses selected technology and service providers to operate TRACER. These providers may support cloud hosting, databases, storage, secure content delivery, authentication, communications, analytics, security, service monitoring, and artificial-intelligence functionality.

Such providers may process limited information where necessary to provide their services to BytesWrite. BytesWrite seeks to use service providers subject to appropriate contractual, security and legal requirements relevant to the services they perform.

Detailed information regarding relevant service providers may be provided to institutional customers where appropriate as part of contractual, procurement or due-diligence processes.

10. External Research Services

External scholarly and research-information services are different from technology providers operating TRACER on BytesWrite’s behalf.

Where authorized and permitted, TRACER may submit limited research identifiers or metadata to an external research-information service in order to retrieve relevant scholarly information (such as publication identifiers, researcher identifiers, or similar scholarly information).

External research services remain independently responsible for their own services, terms, licences and privacy practices. TRACER’s ability to access a particular external source may change because of provider availability, licensing, technical restrictions or institutional access arrangements.

11. Where Information Is Processed

As of the Last Updated date of this Policy, TRACER’s core database and primary object-storage infrastructure are configured in India, unless otherwise agreed in the applicable Agreement or Order Form.

However, not every technical operation is necessarily performed exclusively within India. Certain specialized services, global network functions, authentication services, communications, analytics or AI-assisted functionality may involve processing in other jurisdictions.

12. Cookies and Similar Technologies

TRACER may use cookies and similar technologies necessary for functions such as authentication, maintaining user sessions, account security, application preferences, service operation, and performance analysis.

Certain cookies are necessary for authenticated TRACER functionality. Disabling required cookies may prevent parts of TRACER from functioning correctly.

13. Security

BytesWrite maintains technical and organizational safeguards designed to protect information processed through TRACER from unauthorized access, disclosure, alteration, misuse or loss. Security controls are applied according to the nature of the information and relevant service functionality.

These may include controls relating to authentication, access permissions, session management, restricted access to institutional records, protected access to uploaded documents, application validation, security monitoring, and operational logging.

Institutions are also responsible for appropriately assigning user access and administrative permissions within their deployment.

No internet-based service can guarantee absolute security. Accordingly, BytesWrite does not represent that every security incident, vulnerability or unauthorized attempt can always be prevented.

14. Security Incidents

Where BytesWrite becomes aware of a security incident affecting information processed through TRACER, BytesWrite will assess and respond to the incident in accordance with applicable law and relevant contractual obligations.

Depending on the circumstances, response measures may include investigation, containment, remediation, preservation of relevant information and required communications with affected Institutions or competent authorities.

Applicable Indian cybersecurity requirements, including CERT-In directions, may apply to certain security incidents.

15. How Long Information Is Retained

TRACER does not apply one universal retention period to every category of information. Customer Data is retained for the period reasonably necessary to provide TRACER, support the Institution’s authorized use of the service, meet applicable contractual requirements, and comply with applicable legal obligations.

Where an institutional subscription expires or is terminated, data export, active-production deletion and backup handling are governed by the applicable Agreement, DPA and TRACER Data Retention & Deletion Schedule.

Under the standard TRACER exit process, unless otherwise agreed in writing, the Institution may request an export of its Customer Data within 30 calendar days following termination or expiry. After the applicable export period ends, or earlier where the Institution confirms that no further export is required, BytesWrite may begin deletion of Customer Data from active production systems and will use reasonable efforts to complete that deletion within 30 calendar days after the deletion process begins.

Deletion from active production systems does not necessarily result in immediate removal from protected backup copies. Information remaining in backups is not intended for ordinary product use and will expire or be overwritten through the applicable automated backup lifecycle, subject to lawful retention requirements.

Certain limited records may be retained for longer where reasonably necessary to comply with law, security or audit requirements, legal process, contractual record-keeping obligations, or the establishment, exercise or defence of legal claims.

16. Access, Correction and Privacy Requests

Depending on applicable law and the nature of the processing, individuals may be entitled to request actions concerning their personal data, including access, correction, completion, updating, deletion or erasure where applicable, withdrawal of consent, and grievance redressal.

Because TRACER is primarily an institutional service, an Institution may be the appropriate first point of contact where the request relates to information controlled by that Institution. BytesWrite may reasonably assist Institutions with valid requests as required by applicable law and contractual arrangements.

We may need to verify the identity or authority of the person making a request before acting upon it. Certain information may need to be retained where required or permitted by law or where necessary for legitimate legal, security or contractual purposes.

17. Information Relating to Individuals Under 18

TRACER is primarily designed for higher-education and research institutions and their faculty members, researchers, administrators and other authorized personnel.

Some institutional records may nevertheless relate to students or other individuals under the age of 18. Where an Institution provides such information, the Institution should ensure that it has the necessary authority and follows applicable requirements relating to such processing.

BytesWrite will process such information only for authorized service purposes and subject to applicable contractual and legal requirements.

18. Third-Party Links

TRACER may contain links to research profiles, scholarly databases, publishers, DOI records, professional networks, institutional websites, and other external services.

When a user leaves TRACER and visits an independent third-party service, the third party’s own privacy practices and terms apply. BytesWrite does not control the independent privacy practices of third-party websites.

19. Legal and Regulatory Compliance

BytesWrite handles personal information in accordance with applicable legal and regulatory requirements relevant to TRACER.

Indian privacy and cybersecurity requirements continue to evolve, including the phased implementation of the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. The final Rules expressly provide staged commencement dates for their substantive operational provisions.

Accordingly, BytesWrite may update its processes and this Policy as applicable requirements become effective.

Nothing in this Policy should be interpreted as a representation that a particular legal framework applies to a processing activity where that framework does not legally apply.

20. Changes to This Privacy Policy

We may update this Policy to reflect changes to TRACER, changes in data-processing practices, new or modified functionality, changes in applicable law, changes in service-provider arrangements, or improvements to privacy or security practices.

The current version will display its Last Updated date and version. Where required by applicable law or contract, additional notice of material changes will be provided.

Changes to this public Privacy Policy do not by themselves override an executed agreement or Data Processing Addendum between BytesWrite and an Institution.

21. Contact and Grievance Redressal

Questions, concerns or privacy requests relating to TRACER may be directed to:

BytesWrite Solution Private Limited
Delhi, India

Privacy / Grievance Contact: support@byteswrite.com

Where a request concerns information controlled by an Institution using TRACER, BytesWrite may coordinate with or refer the request to the relevant Institution.