Privacy policy

Trusterio is run by Cloudgeeks [legal form, e.g. B.V.], [address], registered with the Dutch Chamber of Commerce under [KvK number] (“we”). For anything in this policy, write to privacy@trusterio.com.

This policy covers the personal data we decide about ourselves: your account, your billing, your messages to us and your visits to this website. For that we are the controller.

What a customer keeps in Trusterio about its own people, suppliers and customers is the customer’s. We process it only on the customer’s instructions, as its processor, under our data processing agreement. If you are, say, an employee whose account a customer reads through an integration, the customer is the one to ask first.

• Your account: name, work email, a hash of your password, your two-step verification factor, and the times you sign in. To give you an account and keep it yours (performing our contract with you or your employer, Art. 6(1)(b) GDPR).
• Which version of these terms you accepted, and when. To show that you did (our legitimate interest, Art. 6(1)(f), and our legal obligations).
• Billing: the company, billing contact, address and VAT number. Card details go straight to Stripe and never reach us. To invoice and to keep the books the law requires (Art. 6(1)(b) and (c)).
• A request to get started: what you fill in on our start form: your name, work email, company name and size, the frameworks you tick and anything you add. To answer you and set up your account (steps at your request before a contract, Art. 6(1)(b)).
• Messages to us: what you write to hello@, security@ or support. To answer (Art. 6(1)(f)).
• Security records: the audit log of what was done in an account and by whom, and our servers’ request logs, including IP addresses. To keep the service secure and to investigate misuse (Art. 6(1)(f)).

We use no analytics, no advertising and no tracking pixels. This website loads no scripts or fonts from anybody else.

Trusterio AI Assist writes drafts from a customer’s own records. The text a draft needs is sent to a model run by Scaleway in France, on paid terms, with training on the data switched off. We do not train models on your data, and nothing a draft says is used until a person approves it.

Only the companies on our subprocessor list, each for the one job named there, and each bound by a data processing agreement. We sell no data to anybody. We disclose data to authorities only when the law requires us to.

In the European Union. Where a subprocessor could transfer data outside the EU, the list says so and names the safeguard.

• Your account and what is in it: while the account is open. When its owners close it, everything is deleted 30 days later, unless they reopen it first.
• Backups: overwritten after [30] days.
• Invoices and the records behind them: seven years, as Dutch tax law requires.
• A request to get started that did not lead to an account: [12 months].
• Server request logs: [period].

You can ask for a copy of your personal data, have it corrected or deleted, object to or restrict how we use it, and take it with you in a common format. Write to privacy@trusterio.com; we answer within a month. If you think we got it wrong, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), or to the authority where you live.

Every connection is encrypted, every account can require two-step verification, every customer’s data is separated in the database itself, and every change is written to an audit log. Found a weakness? Write to security@trusterio.com.

The version and date are at the top. When we change what this policy says, you are asked to accept the new version the next time it matters, and we tell account owners by email beforehand.