Data privacy

We monitor payments, not people. The service is designed for minimal data collection and a privacy-first approach.

Here is what data is needed and how it is used.

Our privacy manifesto

In a world where banks request many documents for KYC and AML, we believe payment tracking should be simpler. UETRACE does not need to know your identity, where your money comes from or where it is going. For a basic status check, we only need the 36-character UETR.

🚫 No KYC documents

We do not request passports, company records, invoices or bank statements, and no email or phone registration is required.

👁️ No control of your money

A UETR cannot be used to access an account, withdraw money or change a payment route. We obtain only technical transaction-status data.

🗑️ Minimal retention

A one-off check on the website is not saved. After a tracked transfer reaches a final status (ACCC, RJCT or RFND), its active tracking data is deleted.

🛡️ Telegram privacy

Interaction uses Telegram’s infrastructure. We do not ask for access to your phone number or profile; you can request deletion of your data.

What data we process

Correspondent-bank search limit — to enforce three searches per 24 hours, the server stores an HMAC-based identifier derived from the network IP address and the times of searches. The raw IP address, entered bank name and search results are not stored in this counter. Visitors sharing one public IP address share the limit.
UETR — references you submit for a check or active tracking.
Telegram User ID — to reply to you and deliver tracking notifications within the bot. We do not request your telephone number.
Plan and payment information — to identify valid access, including Telegram Stars purchases or manually confirmed USDT transfers.
Additional payment details — amount, currency and debit date if you request a refined search; they are used for that check.
Payment comments — optional comments you provide. Please avoid sensitive personal or company information.

Technical note — disaster recovery:
Although completed tracks are removed from the active database, the hosting provider keeps automatic server snapshots for disaster recovery. These are retained for seven days and then overwritten. Access is restricted at infrastructure level.

What we do not do

Link technical user identifiers to verified real-world identities.
Send payment-check identifiers to advertising or analytics platforms.
Request card details or online-banking credentials.
Keep a historical transaction log of one-off website checks.
Keep completed active tracks beyond the applicable deletion process.

Connection security

The website uses HTTPS. Payment checks go through a server-side interface; no bank credentials or bank-system calls are exposed to the browser.

Data-related questions: @gpi42.