Your data, handled with care.

Who we are

Trovecrest is a trading name of [owner's legal name], a sole trader based at [business address]. For the purposes of data protection law we are the controller of the personal information described in this notice.

You can contact us about anything in this notice through our enquiry page or at [privacy contact email].

What we collect

When you send an enquiry

• Your name and email address.
• What you tell us about the problem you want to solve and the goals you choose.
• Optional details about your business: its type, team size and website.
• The library opportunity you were reading, if you arrived from one.

When you create an account

• Your email address, used to sign you in.
• Profile details you choose to add: your name, company, website, business type and team size.
• Your settings, such as your monthly spending cap and the tools you follow.
• Sign-in records: when and from which browser you signed in, so you can see and end sessions.
• If you sign in with Google, the basic profile Google shares with us (name and email).
• Which workspaces you belong to and your role in each. Business details and settings belong to the workspace and are shared with the colleagues in it, who also see your name and email.

When a colleague invites you

• Your email address, entered by the colleague who invites you, so we can send you the invitation. It is encrypted, and the invitation link works once and expires after 7 days.

When you use a tool

• The information and files you put into the tool, and the results it produces for you.
• Usage records needed to charge you correctly and to enforce your spending cap.
• Payment details are collected and stored by Stripe, our payment provider. We never see or store your full card number.

When you browse the site

• Basic technical information such as your IP address, browser type and the pages you request. Our hosting provider records this in server logs, and we use it to keep the site secure and to limit spam.

We do not ask for special category data, such as health information, and we ask you not to send it.

How we use it, and why

• To reply to your enquiry and, if you ask us to, to prepare a proposal. Our legal basis is taking steps at your request before entering into a contract, and our legitimate interest in responding to people who contact us.
• To provide your account and tools: signing you in, running the tools you use, charging for them and enforcing your spending cap. Our legal basis is performing our contract with you.
• To process information you put into tools. When it includes personal data about other people, you are the controller and we act as your processor: we use it only to produce the outcome you asked for, and for nothing else. We do not use it to train AI models.
• To keep the site secure, including detecting spam and abuse. Our legal basis is our legitimate interest in protecting the site and the people who use it.
• To meet legal obligations, such as keeping business records where the law requires it.

We do not sell your information, use it for advertising, or add you to a mailing list. If we ever want to send you news, we will ask for your consent first.

Who we share it with

We use a small number of trusted service providers who process information on our behalf and only on our instructions:

• Railway, which hosts the website, its database and files, in the United States.
• Anthropic, whose AI models run our tools. It processes what you put into a tool to produce the result.
• Stripe, which takes payments and stores card details.
• Resend, which delivers sign-in links, enquiry emails and account notices.
• Google, if you choose to sign in with your Google account.
• Cloudflare Turnstile, which helps us tell people from bots when you send an enquiry, if it is enabled.
• Cloudflare Web Analytics, which counts visits and page views without cookies and without building a profile of you, if it is enabled.

We choose providers whose business terms do not allow them to use your data to train their models or for their own purposes.

International transfers

Our service is hosted in the United States, so your information is transferred there and to the countries where our providers operate. Where data protection law requires it, we rely on recognised safeguards such as standard contractual clauses. If your organisation needs UK or EU hosting, tell us: we plan to offer it as demand grows.

We may also disclose information if the law requires it.

How long we keep it

We keep enquiries for as long as we need to respond and follow up, and for no longer than [retention period, e.g. 24 months] unless we go on to work together. Information about clients is kept for as long as the law requires for business and tax records.

Account information is kept while your account is open. When you delete your account, your profile and settings are deleted straight away, together with any workspace you are the only member of and the data our tools hold for it. A workspace shared with colleagues stays with them; copies in backups are overwritten within [backup retention, e.g. 30 days]. Payment and invoice records are kept by Stripe and by us for as long as tax law requires.

Server logs are kept only for a short period by our hosting provider.

Your rights

Depending on where you live, you may have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct information that is wrong or incomplete;
• ask us to delete your information;
• object to, or ask us to restrict, how we use it;
• ask us to transfer it to you or to another organisation;
• withdraw consent at any time, where we rely on consent.

If you have an account, you can do much of this yourself: edit your profile, download a copy of your data, and delete your account from the Security and data page. For anything else, contact us using the details above. We will respond within the time the law allows, usually one month.

If you are unhappy with how we handle your information, you can complain to your local data protection authority. In the UK this is the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to put things right first.

Cookies

We do not use advertising or tracking cookies, and the site works without storing cookies for analytics. We use only strictly necessary cookies:

• a sign-in cookie that keeps you signed in to your account, set only when you sign in;
• if the enquiry form's human check is enabled, a Cloudflare cookie that protects against abuse.

If we ever add cookies that are not strictly necessary, we will ask for your permission first.

Keeping it secure

• Everything you send to us travels over an encrypted connection.
• Personal data is encrypted by our application before it is stored, using AES-256. This covers your profile details, files and data you put into tools, and access to any accounts you connect. Each workspace has its own encryption key, and deleting a workspace deletes its key. Your sign-in email is the one exception: our sign-in system needs to read it to recognise you, so it is protected by access controls instead.
• Sign-in links are single-use, expire after 10 minutes, and are stored only in scrambled (hashed) form.
• Card details are encrypted and held by Stripe, never by us.
• Access to systems and data is limited to the person who runs and supports the service.

No method of transmission or storage is completely secure, but we take these steps to protect what you share.

Changes to this notice

We may update this notice as the site and our services change, for example when new tools or connections launch. The date at the top shows when it was last updated.